Lunch & Learn Menu

At Push, our research-led team has published community resources to help organizations to defend against these threats. Since a rising tide lifts all boats, we're offering the opportunity to run a tailored lunch and learn session for your team. This session will focus on the most prevalent and impactful identity attack techniques we're observing in the wild, the telemetry needed to detect them, and the controls that can be deployed to stop them.

Option #1: Identity attacks briefing

Attackers don’t hack in, they log in. Attacker TTPs are rapidly evolving as they continue to prey on vulnerable and

poorly monitored identity attack surfaces. The result? Compromised identities are now the #1 cause of breaches.

We’ll explore how and why attackers have their focus to identities and demonstrate some of the techniques they use to bypass controls and evade detection:

Stealing session cookies using infostealers and then hijacking user sessions.
Exploiting shadow identities and ghost logins by targeting SaaS apps at scale with stolen credentials.
Using AitM and BitM toolkits to bypass traditional phishing prevention controls such as MFA, EDR, and email content filtering.
Maintaining persistence and laterally moving in a SaaS environment without touching the network or endpoint.

Option #2: Threat hunting in the browser

With the shift away from endpoint and network attacks toward identity-based techniques, attacks are happening

entirely in the browser, over the internet, with no local malware deployment – leading to a significant detection gap.

We’ll cover various attacker techniques and tools that can be detected in the browser, with video demos of:

Detecting web-based obfuscation techniques like HTML smuggling and tracking dynamic malicious links.
Building security alerts and scripts to detect malicious activity or proactively flag identity vulnerabilities.
Taking auto-screenshots when certain events are triggered to enrich SIEM tickets.
Preventing users from creating and accessing accounts using weak, reused, or previously breached passwords to reduce the risk of identity compromise.