[LIVE] Active Directory Hacking & AMA (8/27/26)
The live session on Active Directory exploitation and the subsequent Q&A revealed critical vulnerabilities in legacy authentication protocols that remain unpatched in 40% of enterprise environments. Specific demonstrations showed how attackers can escalate privileges to domain admin status within minutes using unmonitored Kerberos tickets and misconfigured Group Policy Objects. The analysis highlighted that 85% of the tested systems lacked multi-factor authentication on administrative accounts, creating a single point of failure for entire networks. These findings underscore the urgent need for immediate remediation of identity management configurations to prevent lateral movement attacks. The session concluded with a detailed breakdown of detection signatures for the demonstrated techniques.
Black Hat Asia 2026 | Graph-Aware LLM for Windows Logon with a Closed-Loop Guarded Detection Agent
A novel Graph-Aware LLM framework transforms massive Windows Event Logs into compact authentication graphs to detect compromised accounts within enterprise-scale Active Directory environments. By filtering for six critical event IDs and converting raw data into user-host relationship graphs, the system reduces dataset volume from 50MB to approximately 1MB while preserving essential attack signals. This approach enables a closed-loop guarded detection agent to analyze authentication patterns without relying on static signatures or exceeding LLM context limits. The method achieves stable, reproducible results for incident response by generating Sigma rules for recurrence prevention and identifying suspicious logons through graph-based feature extraction rather than raw text processing.