Understanding the risk through red teaming exercise

Charles Hamilton, an executive director at KPMG, walks through four real attack techniques used in his red team engagements and, for each, asks the same question: could the target actually detect it. First is Azure device code phishing, where a victim enters a legitimate Microsoft login code, handing the attacker access and refresh tokens that can be extended to read email, download attachments and harvest credentials via the Graph API, largely invisible in default logging. Second is loading an unsigned DLL through a Microsoft-signed .NET executable's config file, evading execution-policy and EDR controls because they inspect the executable, not the accompanying config file. Third is PetitPotam, a still-exploitable technique for coercing domain controller authentication and relaying it, especially when SMB signing is disabled, to fully compromise a domain. Fourth is stealing browser cookies by duplicating a locked file handle to bypass MFA and reach applications like Citrix without touching credentials in memory, avoiding EDR monitoring of processes like LSASS. Throughout, he stresses network visibility and SIEM aggregation as the common defense gap, and closes with audience questions on phishing variants, cookie geofencing workarounds and whether OWASP Top 10 compliance is enough on its own (it is not).