Usama Arshad
Senior Security Engineer
Tabby
Usama Arshad is a Senior Security Engineer at Tabby with over six years of experience in cybersecurity, specializing in offensive security, penetration testing, red teaming, application security, and security automation. He has extensive experience assessing web, mobile, API, cloud, and internal infrastructure environments, particularly within fintech and regulated organizations. Usama is OSCP certified and has delivered more than 150 security assessments and red team engagements throughout his career.
Speaker sessions
When LSASS Won't Dump: Red Teaming Active Directory Under RunAsPPL, WDAC, and Patched noPac
Most Active Directory attack playbooks assume LSASS memory dumping, unrestricted living-off-the-land binaries, and an unpatched noPac are still viable. In mature, defensively hardened enterprise environments, none of them are. This session is built from real multi-session red team engagements against segmented Active Directory domains protected by RunAsPPL level 2 with UEFI lock, Windows Defender Application Control (WDAC), and patched privilege-escalation paths, and walks through what still works when the standard toolkit is blocked at every turn.The session covers: recovering credential material through Volume Shadow Copy-based SAM/SYSTEM/SECURITY hive extraction once LSASS memory access is locked down; weaponizing NTLM relay opportunities with Responder and ntlmrelayx inside segmented networks; using BloodHound-driven attack path analysis to validate DCSync feasibility before attempting domain compromise rather than guessing; falling back on Kerberoasting and ASREPRoasting when in-memory techniques are unavailable; adapting post-exploitation and lateral movement when WDAC blocks common LOLBins; and pivoting into segmented network zones through MSSQL trust relationships.The session closes with a reporting methodology often missing from offensive security talks: documenting positive controls alongside findings, so defenders receive credit for what is genuinely stopping the attack chain, along with a precise picture of the remaining gap. Attendees will leave with a concrete, field-tested toolkit for operating against genuinely hardened Active Directory environments, and a framework for communicating results that strengthens the relationship between red and blue teams rather than just producing a list of findings.
- 17:30
- Wed
- 02 Dec
Stage:
Briefing Stage 1
Sessions Type:
Keynote