- This event has passed.
GraphRunner: A Post-Exploitation Toolset for M365 – Beau Bullock & Steve Borosh
October 19, 2023 @ 12:00 pm – 1:00 pm MDT
In the rapidly evolving realm of cloud productivity suites, Microsoft 365 (M365) has solidified its position as a fundamental resource for numerous organizations. While M365 presents a host of opportunities, it equally introduces challenges. By default, M365 offers a range of security measures within its tenant structure. However, it also contains a number of default configurations that hold the potential for exploitation by malicious actors. This talk focuses on a new post-exploitation toolset called GraphRunner, that can be used to exploit certain default M365 configurations.
During this presentation, I will provide an in-depth exploration of GraphRunner’s features, showcasing its role in elevating post-exploitation strategies. Designed to empower both red team professionals and defenders, this toolset equips users with a means to navigate the intricate Graph API at the heart of M365 and manipulate it for offensive purposes. GraphRunner offers functionalities that aid in lateral movement, data exfiltration, privilege escalation, and persistence within M365 accounts. By offering practical demonstrations of the toolset’s capabilities, this talk aims to bridge the gap between theoretical attack concepts and their tangible real-world application.
Beau Bullock is a Senior Security Analyst and Penetration Tester and has been with Black Hills Information Security since 2014. Beau has a multitude of security certifications (OSCP, OSWP, GXPN, GPEN, GWAPT, GCIH, GCIA, GCFA, GSEC) and maintains his extensive skills by routinely taking training, learning as much as he can from his peers, and researching topics that he lacks knowledge in. He is a constant contributor to the infosec community by authoring open-source tools, writing blogs, and frequently speaking at conferences and on webcasts.
Steve Borosh is a proud U.S. Army Infantry veteran and security consultant at Black Hills Information Security. Steve has extensive experience as a penetration tester, red team operator, and instructor since 2014. Steve has instructed courses on penetration testing and red teaming for the public, private, and federal law enforcement sectors. Steve also has experience teaching and speaking at conferences such as Blackhat, various BSides events, Gartner, and others. Steve maintains a blog and GitHub repository to share knowledge and open-source offensive tools with the community. Steve earned a B.S. in Computer and Information Science from ECPI University.