SO-CON 2022: Adversary Tactics - Tradecraft Analysis Training -October 2022

SO-CON 2022: Adversary Tactics - Tradecraft Analysis Training -October 2022

Actions and Detail Panel


Date and time


Hyatt Regency Reston

1800 Presidents Street

Reston, VA 20191

View map

Refund policy

Refunds up to 7 days before event

Eventbrite's fee is nonrefundable.

Hybrid Event - This course will take place onsite in Reston, VA and online, using virtual software to stream live instructors.

About this event

Hybrid Event

This course will take place both In Person in Reston, VA and Live Online (using virtual software to stream live instructors). Course scheduled delivery hours will be 9:00AM to 5:00PM ET.

Limited In Person seating is available on a first-come, first-served basis. If you would like to attend In Person, select the "In Person ticket type" during registration.

Confirmed attendees will receive logistics information one week prior to the event.


COVID Safety Protocols

Updated: June 2, 2022

  • Vaccine Status: All attendees and staff are encouraged to be fully vaccinated to attend trainings; however, there will be no vaccine status requirement or verification.
  • Masks: Masks are recommended, but not required, for everyone in attendance. Masks should be well-fitting and cover the nose and mouth.
  • Hand Sanitizing & Washing: Hand sanitizing stations will also be available throughout the training space. We encourage people to wash their hands frequently.
  • Social Distancing: Seats within the classrooms will be laid out to provide spacing between participants. As for social distancing while not in your seat, we ask that you do your best and keep your mask on.
  • Testing: Testing options will be provided onsite.
  • Wellness Checking: Please self-evaluate your wellness on a daily basis. If at any point during the training you feel sick/have a fever/have symptoms of COVID, please quarantine in your hotel room. We can immediately switch you to remote attendance so you don't miss any class time while isolating.
  • Please note that SpecterOps will continue to monitor COVID data and local guidance until the event and may update protocols accordingly. If you have any questions, please contact


Your organization has just implemented the leading detection and response products. Are they configured with default configuration? How much faith should you have in your ability to detect sophisticated attacks? How would you simulate attacks to ensure robust detections are in place? This course will teach the importance of understanding the inner workings of attack techniques and telemetry availability and provide a workflow for developing robust detection analytics or data driven evasion decisions. Focusing on various Windows components and attacker TTPs, you will dive deep into how software abstracts underlying capabilities and how attackers can interact with deeper layers to bypass superficial detection capabilities.

Course Summary

Knowledgeable detection engineers and red team operators know that while there are many effective products, all of them have gaps that can be exploited by a sophisticated adversary. A mature security program must continuously test and enhance product detection configurations to have an effective response capability. Unfortunately, they often run into a number of limitations, primarily in a lack of understanding of the:

  1. attack technique itself
  2. telemetry used for each detection
  3. effectiveness of the detection

The result often leads to blind spots within the detection and response capabilities, ineffective detection strategy, and a false sense of security in the organization's ability to respond to advanced threat actors. When simulating sophisticated attacks, red team operators need to truly understand how a given technique works, the telemetry/artifacts it generates, and the strategies and biases that a defender might use to detect a technique. How organizations may respond to attackers is crucial in red team attack planning, technique selection, and evasion.

In Adversary Tactics: Tradecraft Analysis, we will present and apply a general tradecraft analysis methodology for offensive TTPs, focused on Windows components. We will discuss Windows attack techniques and learn to deconstruct how they work underneath the hood. For various techniques, we will identify the layers of telemetry sources and learn to understand potential detection choke points. Finally, the course will culminate with participants creating their own technique evasion and detection strategy. You will be able to use the knowledge gained to both use your telemetry to create robust detection coverage across your organization, and truly assess the efficacy of that coverage.

Whether you are a red team operator or detection engineer, you will have a comprehensive understanding of several attack chains. Red team operators will learn an approach to analyzing their own tools, a better understanding of which techniques to select to evade detection, and how to better describe to defenders why an evasion was successful. Detection engineers will understand how to craft a strategy to create robust detections and better detect families of attacks.

Course Syllabus

Day 1:

  • Attack and Detection Strategies
  • Native PSExec Overview
  • Tradecraft Analysis Process
  • Capability Identification
  • Capability Deconstruction
  • IPC Mechanisms

Day 2:

  • Securable Objects
  • Identifying Choke Points
  • Telemetry Source Identification
  • How EDR Tools Work
  • Organic Logging
  • SACLs
  • Function Hooking
  • Kernel Callback Functions
  • ETW

Day 3:

  • Operationalizing Telemetry
  • Understanding Attacker Controlled Fields
  • Operationalizing Detection Research
  • Operationalizing Evasion Research
  • Understanding the Triage, Investigation, and Remediation Process
  • Evading the Response Process
  • Documentation and Evaluation Metrics
  • Detection Documentation
  • Evasion Documentation

Day 4:

  • Capstone Exercise

Participant Requirements

This course is intended for expert blue teamers, detection engineers, and red team operators. Participants should be familiar with detection engineering and/or red team operations, and be generally comfortable with Windows internals, attack technique analysis, offensive tools and techniques

Hardware Requirements

  • Internet Connection
  • 8GBs of RAM
  • Modern Web Browser capable of rendering HTML5


How can I contact the organizer with any questions?

Please email with any questions.  

What's the refund policy?

Full refunds will be provided up to 7 days before the course start date.

Share with friends