Modern Red Team Tradecraft - Sajal Thomas

Sajal Thomas provides an in-depth technical masterclass on modern red team tradecraft, focusing on advanced evasion techniques against modern Endpoint Detection and Response (EDR) platforms and security operations center (SOC) behavioral analytics. He outlines the shift required by offensive practitioners from signature evasion to behavioral and telemetry evasion.

Thomas discusses operational security (OPSEC) baselining and blending in with target environment telemetry at 07:28 and 11:43. He examines process injection techniques at 23:26, analyzing PPID (Parent Process ID) spoofing and process hollowing to evade detection heuristics. At 27:24 and 35:15, he details API unhooking and bypassing Windows Event Tracing (ETW), concluding with methods to dump credentials by taking process snapshots of LSASS (51:33) rather than querying LSASS directly to evade behavioral triggers.

(AI summary — Gemini Flash)