@mariuszbit gave Modern Initial Access and Evasion Tactics at WarCon on 25 June 2022 and shared the slides.
One slide says to phish to persist rather than phish for access, and credits the idea to Matt Hand, whose article Challenging our Mental Model of Initial Access came out on 16 June.
Hand argues that red teams and defenders alike expect a lure to run its payload and call back right away, and suggests a delayed callback instead, for example by dropping a DLL that Microsoft Teams only loads on its next restart.
The earlier post on Hand’s article looks at what the delay means for detection.
The slides take the same route: drop a proxy DLL as %LOCALAPPDATA%\Microsoft\Teams\version.dll and let Teams side-load it.
WarCon’s policy kept the talk off tape, so he plans to give it again at x33fcon and try to get that one recorded.
