Adversary Village — DEF CON 2026

Commodity infostealers account for a significant share of initial access in enterprise breaches. Their TTPs are documented, their tooling is public, and most detection stacks still miss them. This workshop emulates the full infostealer playbook against a live target and measures exactly where the gaps are.

Attendees execute an eight-stage adversary emulation scenario replicating documented commodity threat actor TTPs: HTA phishing delivery, in-memory C2 via Meterpreter, browser credential theft from Chrome and Edge using DPAPI and the SQLite Login Data file, in-memory keylogging via process migration to explorer.exe, UAC bypass using the fodhelper registry hijack documented across multiple threat actor profiles, and LSASS credential dumping via Kiwi/Mimikatz recovering NTLM hashes, SAM contents, and the DPAPI_SYSTEM master key. Every technique is drawn from documented threat actor behavior and mapped to MITRE ATT&CK before execution begins.

The second half of the workshop shifts to validation. Attendees enable Sysmon64 telemetry and replay the emulation, stage by stage, identifying which techniques generated detectable events and which did not. Each gap maps to a concrete control recommendation. The keylogging stage writes nothing to disk. The Meterpreter session exists only in memory. The DPAPI_SYSTEM extraction is not anomalous to most SIEMs by default. Attendees document all three as validated findings, not assumptions.

Key Takeaways

1. Adversary emulation with real TTPs produces validated detection gaps, not theoretical ones. Running the actual technique against your stack tells you whether the control works. Running it in this workshop tells you before an attacker does.

2. In-memory execution breaks file-based detection entirely. Meterpreter leaves no binary on disk. The only detection path is behavioral: process injection signals, memory scanning, or network correlation between a user-context process and an external C2 session.

3. DPAPI_SYSTEM recovery after LSASS access retroactively compromises all protected data on the machine. Most SIEMs do not alert on this extraction by default. Attendees leave with the specific Event IDs and Sysmon rule configuration that catch it.

ResearchersFilipi Pires BR

In this talk, we introduce Haetae, an agent designed to profile, identify, and exploit C2 frameworks used by North Korean malware.

Haetae supports both automated and interactive modes, allowing analysts to map and understand adversary infrastructure with different levels of control. It is built around a flexible rule-based system, enabling users to extend and refine detections as new patterns and frameworks emerge.

In this first release, we will walk through real-world cases where Haetae was used to identify and take down infrastructure associated with Mach-O Man and POWerful Armadillo.

We will also release a safe emulator of both malware C2 servers, allowing researchers and newcomers to experiment with Haetae in realistic, controlled environments without risk.

This is a highly technical talk but can be enjoyed by both beginners and seasoned threat hunters.

ResearchersMauro Eldritch AR·Nelson Rafael Colón Merán DO