Attackers Aren’t Wizards: How to turn Red Team Lore into Real Controls

Today, we are talking about how attackers are not wizards and how you can turn red team lore into real controls. So real quick, I'm Jake. Been at Semperis for a year and a half as a principal security consultant. Been in the industry for twenty six years this month. Did the typical help desk, sis admin, identity security path. Love making tools for you all to use. And if you wanna have a whiskey with me later, let's do that. Okay. So I'm Nick. Jake and I work on the same team at Semperis. I've been there for about four years now. For me, about thirty years in technology, I kind of started off as systems administrator. More technically, I was shadow IT for a period of time. Then I worked on directory engineering, offensive security, I worked as a pen tester, and you know now I work at Semperis on identity security. A couple of things about me, been a martial arts student for the majority of my life and also RC car nerd. I actually just came from a big RC car race in Las Vegas last week. So kind of off script, this is the first time I'm doing one of these presentations, so I come here. Nick's first talk, yes. Thank So you, I come here and I go to register at the hotel and they tell me, okay, you're on the 13th Floor. I'm like, Okay, that's great, I'm on the 13th Floor. I don't really pay attention to my room until I'm in the elevator, so I'm on the 13th Floor in Room 1313. So if this talk goes off the rails, it's not my fault. Oh, man. ****, attack me like a boxer. Okay. Attack me like a... What do you mean attack you like boxer? What does that mean? So kind of like what I said in my title slide, I've been a martial arts student for a long time and when I graduated college, moved to a new city and I had to find a new place to train, and I had a prior experience, I had about ten years in martial arts, but I was in this class with all new people and the person teaching the class picks one of the students, all new people, and says, attack me like a boxer. And I remember it's always stuck with me, like the look of confusion on her face, like, what do you mean attack me like a boxer? And when I told Jake this story, this is kind of where this talk came from. So if someone says that to you, what do you do? Well, I mean even if you aren't a boxer, you've probably seen boxing, right? You've seen a TV show or a movie where there's boxing, so you know, you'll kind of stand and you'll get in a boxer stance and you'll kind of move around like a boxer and you'll kind of act like a boxer, but that's performative, I mean you can move and you can act and if you're a very good actor, I might actually believe that you are a boxer, but you wouldn't step into the ring with an actual boxer, right? I mean, this is demonstration without fundamentals. Okay, so that's all interesting, but what's that have to do with cybersecurity? Well, this is something you hear in our industry frequently. Right? We think like attackers. We know the attacker. But really, what does that mean? Like... Yeah. Do you know why they targeted you? Well, if I'm telling you I think like the attacker, I know why they targeted you for sure. Absolutely. I know how they're going to attack you and I can tell you what they want. Yeah, attackers, we think like them. We're deep into the mind of the attacker. So this talk kind of came out of that whole we think like attackers and we're going to talk about why we think that is the wrong approach to take and how it really ends up shortchanging defense. I kind of might say, you know, in my experience, even when I was working on offensive security, I might think about attackers more than I'd say I think like attackers and later in the talk we're gonna bring up a couple of things where do you really think like the attacker if you're leaving some of their most effective tactics on the table and you're not going to look at this? We'll come back to that later. So as we move forward, we're going to talk about the things that like attackers will do that we don't do. No matter whether you're offensive security, defensive security, Purple teaming, whatever, GRC, like where that breaks down and the way that I like... Actually, Nick likes to describe it, but he introduced me to Tank Abbott. Who watches MMA here? Anybody? Okay. Who knows Tank Abbott? Okay. Cliff over there. Tank came in. People expected him to act one way. Right? And what did he do? Bar room brawled until he won fights. Right? He broke down the stupid agreement that all these fighters had, and that's what attackers are doing. Thinking like that is essentially impossible. So let's start with one reason why it's impossible. So which attacker? We think like the attacker. Which attacker do we think like? Is it the nation state? China. Yeah. That's attacker, right? Cybercrime. We got the North Koreans, we've got shiny hunters, you know, we got all these people. Right? All of those are attackers. Right? Activists. You know, they want to get their point across. What about the initial access broker? I mean, that's an attacker. Right? Right. I've had it, I'm not gonna take this anymore, right? Insider threat. That's also a real attacker. Loan operator, kid bored on a weekend, I've been that kid, see how far I can go somewhere, right? You know, corporate espionage, that does happen. Know, hey, I'm company age, it's company b, I want to know what he knows, that's an attacker. Extremist groups really, right? They wanted to face your website, get wide wide, disbursement of their messages, etcetera. So ultimately, if you try to apply the attacker mental model to this very disparate group, you're actually defining and talking about none of them. So let's let's bring this to real world stuff that is not necessarily attackers. Right? We have... Nick's a fighter. Nick can talk about the fighters. So we have a whole kind of martial arts fighting theme here, so let's talk about a fighter. So if I'm a fighter, martial artist, whatever, and maybe I know that I'm gonna compete against Jake, I know Jake and I are gonna meet in a match... I'm a lover dude, not a fighter. Well, know, let's just say for the sake of argument, I'm competing against you, so I know who I'm gonna compete against and one of the things that I might do is I might see what he's done in the past, right? I might watch his videos and I might see, oh, you know, this is what Jake usually does. However, Jake's under no obligation to do what he has done in the past, right? And, know, kind of if we build on this, while I'm not claiming to have comprehensive knowledge of every fighting system that exists in the time that I've been doing this, I am not aware of one that is purely offensive or one that is purely defensive. All fighting has a balance of offense and defense, and in defense, it is fair to say there are defensive techniques that are designed to disable the attacker. You will do certain things where you wanna make that person unable to continue, that is a real thing. A couple other things to kind of think about is if I'm a fighter, I don't learn to defend myself by learning every technique from every other fighting system that exists, right, you really can't do that, so I don't have to learn karate to defend myself from someone who knows karate, I don't have to learn how to be a boxer to defend myself from someone who is a boxer. But if you were an undercover cop, certainly you would learn how to be like a criminal, right? No, that's not So Nick and I in research for this talk, we did do research, we're not just up here vibing. We talked to an undercover cop that that Nick knows personally. I I have worked previously when I worked for the city of Bowling Green, Ohio. We supported our police department. They had undercover officers, you know, we had to support some things about that. So I've learned some things. We've learned some things. Ultimately, an undercover police officer is limited by rules of engagement, things that an attacker will never be... Or sorry, that a criminal will never be limited by. Right? The cop is going to imitate the criminal behavior without actually breaking the law. We we learned that they were oftentimes just trying to get information out. Right? Set up situations, that sort of thing. Never, let's go break into this bank together. Yeah. But we also learned they can deceive and coerce legally up to constitutional limits which, yeah, interesting. But we think about this as kind of more of the proactive side of security things than... Or sorry, they are more proactive and that's very similar to how offensive security works, right? You're imitating what the attacker would do. Imitating the attacker. So there's one other model we wanted to get into and that was a psychologist. So my older sister happens to be a psychologist, which is super fun growing up with someone studying psychology by the way. So in this model we're talking about say a psychologist that is an expert in sociopathy, and let's say this person is the expert in sociopathy, So they can explain to you how a sociopath sees the world, they can explain to you motivations or things that may make someone a sociopath, but even though this person understands them very well, they do not have a switch in their brain that they can flip that puts them into sociopath mode, so as deep as their understanding is, they will never experience what it is to be a sociopath, so understanding that doesn't make them that thing. Understanding the behavior is totally different than embodying it. So as we said before, like these are three different people that deeply know their subject, whether that's an enemy, opponent, know, their subject of investigation, etcetera. If you tried to create some sort of mental model that covered fighting someone and undercover cops and psychology, that means it's meaningless. And so yeah, Studying and imitating and understanding... Not the same. Not the same and it does not give us an attacker's motivation. Also, okay, what do they actually want? You know... Nation state, what do they want? Nation state, they want to steal trade secrets. You sure? You sure about that? Right? Organized cybercrime? If I'm organized cybercrime, I'm obviously deploying ransomware because I want the ransom. Hacktivism. What what what do you think a hacktivist does? If I'm a hacktivist, I'm out there, I want to ruin your reputation. I don't want people to do business with you. Okay. Well, what about corporate Jake's my competitor, I want to get his customer list, I want to get his internal data. Now extremist groups, what do they want? You know, maybe if I'm an extremist group I'm just going to do something like I'm going to deface your website, I'm going do something like that. Okay. Now, lone operator, the kid... I'm in it for the thrill of the hunt. How far can I get before you find me? Absolutely. And the insider threat. You know what, if I'm the insider threat, maybe I'm just fed up and I want to ruin your day, right? I want you as is what I want. So, yeah, we look at all this and that kind of brings us to the Joker. So why does that bring us to the Joker? So the thing is the attacker could want any of those things, right, or they could want none of those things. You don't really know. We use the Joker here because if you've seen the movie The Dark Knight, you may recall there is a scene where Alfred talks to Bruce Wayne and basically explains to him, even though you understand criminals, you may not understand this criminal because some men just wanna watch the world burn. Yeah. I mean, we'll we'll never know what some attackers want and ultimately, we're arguing here, it it does not matter. It does not matter. Let's talk about what we do know. Yeah, so I mentioned that I worked as an offensive security person, I was a penetration tester for a period of time and, you know, as a penetration tester, there were things I cared about, there were things that I for sure wanted to do, like I cared about privilege escalation. The majority of the pen tests that I worked on, that was something the customer wanted to see. They wanted to see PrivEsq, they wanted to see me become domain admin, they wanted to see me become global admin. Some other things that were important, if you're pen testing, you have rules of engagement. I cared about following my rules of engagement, there's a target scope. I'm allowed to do XYZ, I'm not allowed to do ABC, I absolutely cared about staying within my rules of engagement. You know, another thing, if you've hired my company and you've hired me, the assumption is you're hiring a professional, so I did care about demonstrating, hey, I have technical expertise here, I know how to flip the bits and get the results and show you, hey, this is what bad can happen because you have these vulnerabilities, I cared about that. So let's compare that with what attackers don't care about. They don't care about getting DA or GA, they do not care about your rules of engagement, and they don't care about demonstrating technical prowess, right? Like, it does not matter. And what they really don't care about, your KPIs, your framework compliance, your vulnerability scanning cadence, your green check marks, they do not matter. Okay? So attackers care about their goal. They're goal driven. What is the reason that they are there? That's what they care about is achieving their goal, and they don't really care how they achieve their goal. They're not here to play a game of chess with you, they are here to get the thing and, again, they don't care about what you expect them to do. They're under no obligation to follow any other predefined pattern. So access, that's what they want, right? Yeah, I mean access is an objective not a goal. If I'm the guy attacking you, I have access you expect me to. If I only need a certain level of access, I'm not gonna go after it. As the defender, this in my mind has always meant that you need to understand your assets. You need to understand what each level of access can do, not what each level of access is supposed to do. And important to me, know, it doesn't matter if you get GA, it doesn't matter if you get DA, it doesn't matter if you've proven anything. If you get what you want and it's dumb, who cares, right, if it's dumb, but it works. It's not dumb. So how did our industry get to this point? Okay. So, you know, when we thought about this, kind of put it in the context of, you know, the attacker influence tends to trickle down. If you work an offensive security group, and at one of my jobs I did create an offensive security team, that team needs to be able to do the techniques, to do the tactics, and if we kind of go back to our martial arts example, I could largely group martial arts into technical martial arts and conceptual martial arts. Now putting that kind of in the cybersecurity framework, okay, I'm pentesting you, I need to be able to demonstrate, hey, I know how to Kerberos do, I need to be able to demonstrate, I know how to do relay attack, I know how to exploit these vulnerabilities that you have, and in that sense, it's very technique oriented. These are techniques and tools that I need to cover for the purposes of this test. If we think about it from a conceptual point of view, if we go back to martial arts for a second, if I'm competing against Jake, a concept could be, I want Jake to always feel like time is on my side, I don't wanna ever do anything that he doesn't have to address, and in that sense, the technique becomes arbitrary. It doesn't really matter what technique I use because I can do them all, the point is make him feel like he is always one step behind in the cybersecurity space, I want whatever I want, the technique that I use to get there doesn't really matter that much. So then when we, as defenders, we look at the offensive security folks like, that's a cool technique, I'm going to block against that. That's a cool technique, I'm going to block against that. That's a cool technique, I'm going to block against that. And what you end up with, narrow remediations for those attacks, right? You're not getting at the conceptual level of what that technique actually implies. A technique, just evidence, not the lesson, right? So, you know, something you kind of... Before we go on is I ran an offsec team and I'd say offensive security is cool, but I don't think offensive security is for everyone, and what I mean by that is not that you can't learn it, that it's so there's some kind of magic DNA you have to have to learn offensive security, meaning that that team is gonna be small by design and there's just not going to be a position for everyone and also there are some people that probably shouldn't do it because A, maybe they're technically not there yet or B, they might not have the right mindset for it, so when I was managing an off sec team there was a lot of interest in my team, There were definitely some people who I thought had the wrong motivation, they wanted to be punitive in using offensive security to say, hey, you know what, I compromised your database, you're not doing a good job. That's not the thing you from your off sec team, right? You're supposed to look at them as an advisor, not an adversary. As I mentioned, others want to get cool, they want to be cool. They want to be cool. They want to be cool. I mean, offensive security is sexy, I mean, we're not going to lie, you know? So when I got into this, when I first started pen testing, I met solemn people that were incredibly good at what they do and you in the audience may know folks who are amazing at what they do that we've never heard of. Show show of hands, who has a friend, acquaintance, etcetera, who is scary good, defensive security, and I saw... No online presence, right? Nothing. Right. Yeah. It's only the millionaire next door, right? This person has no obvious signs of wealth. So, alright, we talked about that, but what do we do? And there's a couple of things that I'll say here before we move on. Nothing that I think we're going to show you here is revolutionary or some sage like wisdom that you haven't heard before. Don't let Nick's beard fool you, this is not sage stuff, this is stuff. The thing is, you may be sitting there saying, Well, these guys are just telling me about the basics and the basics are simple, right? But because something is simple doesn't mean that it is easy and if it was easy, we would not be here right now, we would all be somewhere else doing something else. So let... Let's talk with what we're not gonna do today. Okay. This... We're not gonna attempt to catalog and defend against everything because much like it requires an infinite amount of energy to accelerate particles to the speed of light, It takes an infinite amount of energy to catalog and defend every technique that's going to attack you. Any of y'all have infinite energy? Wait. I know what industries you work in. No, you do not. So what we're going to look at is what can we do to make compromise brittle, time bounded, short lived, and strategically uninteresting to the attacker? So one of the ways that we might say to think a little differently is instead of thinking of these attackers as an intellectual adversary that you're locked in some kind of game of chess with, look at them more from a financial aspect. What can you do to make it cost them more, More time, more resources spent, more risk. Think about just one quick example, gold mining. Gold is highly valuable, not a lot of people are gold mining because it is very resource intensive and the payoff is not guaranteed. So how do we do that? And these are the things that you should be doing already, maybe not all of them, but some of them, right? Make some things brittle. Gia is awesome, right? Only allowing small amounts of authorized activity, etc. Make it ephemeral, right? Just in time access, PIM, we love PIM. But these are things that you should be already doing. So let's talk about things that you may not be doing. I bet a lot of you being at this conference are already doing these things, but hey, it's never bad to have another reminder. So number one, get a lab. Who's got a lab that is just a like FAFO lab? Right? Okay, we've got some labs. If you don't, Hack the Box, they're one of our community sponsors for HIP, right? Awesome company, I've been a member of them, a paying member of them off and on for the last five years of my life. If you don't like them, try hack me. It's out there too. As an Active Directory person myself, game of Active Directory makes standing up a vulnerable AD lab so simple. If you are an Entra person, I'm scared of you, but you can stand up EntraGoat which Semperis released a couple years ago and creates a vulnerable Entra ID. And then if you already have something and you just want to mess it up real bad, bad blood screws everything up, right? So all of these are cheap or free resources that you can use. So once you've got your lab stood up, try some techniques. So Nick, the offensive security professional, is going to tell us about one of them. Yeah, let's talk about some techniques here. Now like I said, this is not sage like wisdom, right? This is not stuff you haven't heard about. Raise your hand if you've heard of Responder. Have you used Responder? Raise your hand if you've used Responder. Okay, so this is not a new thing. I've used Responder many times, I did a lot of network pen tests and this worked on the vast majority of networks that I tested. And as a rhyme writer, what does Responder do? So what Responder is gonna do is essentially exploit older protocols and allow me to receive or essentially get the authentication data from servers and then I can either take that data away or I can relay it to another target. So why does this work? Well, on a lot of networks you have protocols like LLMNR or MDNS or NetBIOS. If I went into your network right now and I fired up Responder, would it work? Do you know? I'm willing to take a a bet that it would and like I said, I don't have to do the full relay, mean this is a noisy attack but I don't have to do the whole thing, I can just take the hashes and try to recover them. So, you know, what do you do about this? Well, do you need these protocols? On a lot of networks that I tested, you didn't really need them but they were still enabled. If you don't need them, turn them off. Or, you know, we recommend quite frequently in our assessments, require signing. That is something you can do. They're not magic fixes. Like I said, these are simple, right? But are they easy? Well, yeah. All right, admin count equals one. Who has gone through their environment and reset admin count to be deleted or set to zero? Okay, why is it important? Nick taught me this. It means if admin count equals one on something, it's probably interesting. You know, maybe it's not actually an admin anymore, but it's still interesting. I would always search for this when I was pen testing and it doesn't mean I get an admin but there are accounts I want to look at. Yeah. What it actually means though is that there was an insufficient understanding at some point in this Active Directory's life of how tiering worked, right? And ultimately weak identity governance. So unfortunately the solution for this one is go back in twenty years, twenty years in time and fix your tiering, but we've yet to discover the time machine. Yeah, I haven't created the time displacement engine yet. Yet. Easier, replace all your admin count equals one principles that are not actually admins with new principles. Why a full replacement? Because of those lingering interesting things that little filthy red teamers want to get. They whine these things and they are hanging out there. And and I know how to look up replication metadata. All right, so yeah, this is kind of like another fan favorite, Kerberositing. Now, I'll grant you that I haven't been an active pentester for a number of years now, but I don't think I've tested a network where this didn't get me something interesting. It didn't necessarily give me the whole environment, but I got somewhere and, you know, we all know why it works, right? Any user can request a service ticket and you can't stop me from taking those service tickets offline and trying to recover the ClearTax password for the account. That's literally how Kerberos works, you? No. It's just the protocol, yeah. You can detect it, I mean, it's logged, are you looking? I've seen lots of places that collect everything but don't actually look at any of the stuff they collect. So I mean, what can you do here? Well, encryption can help you but it doesn't really completely solve the problem. Like if you're using AES, it is more work for me to recover the password but if your password is Password, I'm still going to get it, it's just going to take a little bit longer. Yeah, the difference of time is like zero point one seconds to one second, it's fine. So yeah, this helps. It for sure helps, but something else you could do here, strong passwords, make sure that if you have these accounts that are service accounts or whatever, I usually tell customers use 24 characters, that's gonna be really hard for me to recover, especially if you're using AES. Another thing that you could have on the table, move to manage accounts if you can. Again, that's simple, right? Is it easy? It's a different story. I couldn't stand on stage and not talk about ADCS for the people that know me, ESC so one templates, how many people have had their environment pop from an ESC one template in a pen test? Yeah. Yeah. Yeah. We got we got some hands. Right? And why do offsec people look for it? Because it works. That's really it. I mean, there were so much bad guidance. You know, there were people at, Netrix, InspectorOps, and a few other companies, you know, talking about all of the bad documentation that walks you right into these ESC one attacks. But ultimately what this means is that people don't treat their PKI like tier tier zero, that it truly is. We've had customers in the last couple year... In the last year that have said like my PKI admins don't want to be considered tier zero. It's like, thank you. Yeah, okay. And I hate to admit it, I mean, I don't hate to admit it. That's really the only solution. PKI is a source of trust. It needs to be treated as tier zero. Right. So we've given you four techniques that are pretty common, you know, red team pen test Yeah. Techniques. You go practice those. You hack that lab. And then this is gonna be a little little spicy. Hack prod. Serious. Get in there. Feel what it's like to run these attacks in your production environment and see what you get from your various detections. Purple teaming, right? Do it in a controlled fashion, right? But still do it. We can go quickly back to our fighting example there. You don't want the first time that you have to use what you've been training to win its life or death, right? You want to have practiced that in your lab which is your school so you actually know you can do it. And not half ass it, right? I mean, when you're in a fight and you're sparring, you want to go 95%, So do the same, safe, controlled, full power. So one of the things we talked about was the Sesame Street effect. I'm gonna kinda date myself a little bit. When I used to come home from kindergarten, I used to watch Sesame Street and they'd play this song about one of these things is not like the others and they'd show you some pictures of chickens and one of them had a hat and the others didn't. I found when I started pen testing, I was singing this song to myself in my head looking for the thing that didn't fit for some reason, and I can quickly tell you I was testing an organization and I was striking out and then I was scanning and I was looking for Java RMI, you all remember Java RMI, right? I found Java RMI on a weird port, default port if I remember correctly, it's ten ninety nine, I found it on a different port. One of these things was not like the others, compromised the entire organization from a single endpoint. So how do you get away from this? Well, I worked at a company for a long time that had the concept of copy exactly, put in standardizations, change the game from me looking for a needle in a haystack to me looking for the weird needle in a stack of needles. That's a lot harder to do. And then information gathering, recon yourself. Look around, if you have some identity system where you have different, you know, level of roles or what have you with different entitlements, take each one of those roles and see what is this supposed to do, what can it do? If I have a standard user, I'm supposed to see certain things, what can I see? And you may be surprised that you can find data you're not supposed to find, that is the vast majority of what I did during network pen testing. I'd love to tell you I was doing all kinds of elite black hat stuff, That's not the case. Most of it is just looking around and seeing what you can find. You mean I shouldn't store passwords in passwords. Txt? I mean, if you want me to find them, that's fine, but expect that's going to be found. Oh man. Alright, so I didn't even skip through all these bullets. Look at that, you're just talking. What what should we do going forward? So we have... Those are some things you could do right now. Start looking around, hack yourself. Right? I do wanna shout out Brandon here who did a talk at PancakesCon three a few years ago about hacking yourself. Very good talk. And, yeah, really kind of intro to hacking yourself. So thanks, Brandon. We need to move to an even more realistic assume breach model. So Mickey at his keynote did talk about assume breach being the standard, but we assume a few things, a few too many things I think. Yeah. We do these things. We do zero trust, we do least privilege, we do defense in-depth, we do continuous monitoring, we currently do DevSecOps, we do secure by default, we do single pane of glass. Bingo! Did you guys get bingo? I got bingo. So yeah, I mean, when we hear these things, like that's kind of what it's become, you're expected to say all those terms and they're supposed to be in your presentation, but do you do them? Like assume breach, if you're doing it, means your network is no longer trusted, right? The operational condition is breached, there is an attacker on your network. You can't really just say zero trust, that's a term that I have some pet peeves with or, you know, principle of least privilege or buzzword of the day, right? You have to be doing these things and again, that's where I would say change the way you're looking at the attacker, go from intellectual adversary to economic adversary and you know, there's one thing here that we didn't talk about because in my experience, it's almost like pseudoscience in information security. Very real. And if you bring it up, it's like, what's that guy talking about? We don't do that. That's not a thing that we would even consider. It's deception. Why do we tell our attackers the truth? So I've heard in the time I've been doing this and I bring up deception deception and usually you'll hear something like, Oh, know, the deceptive technologies are very easy to identify, right? You can fingerprint these things, they're simple. Okay, that's true. But there's a buzzword we haven't mentioned yet once in this talk. Not even once, we are forty minutes in. And I would just ask you to maybe think about this differently, is that all still true if the attacker is not a human? Right? I don't know. We don't know yet. And honestly, we're already talking about it in our next talk, is going to be does deceptive technology work against LLMs and AI assisted stuff? So yeah. But we do want to mention leaving deceptive technologies off the table I think is doing Defenders a huge disservice, right? Setting up simple things like canary tokens and canary machines or honey tokens or honey machines or however you want to do it, right? Somebody stumbles across your account that should never be touched, it doesn't matter if they can tell that it's fake, it still sets off an alarm. Yeah. Let's use it. So not to mention, you know, nature, police activity, law enforcement, warfare, right, all use deception. If you're not using them, you're going to... If you're a World War two history person, you know, remember... Oh man, just... Operation Operation Mincemeat, that was deception. Ultimately, right, this is what we want. We want the attacker to not be able to trust what they are getting from their environment, again, the cost that it is for an attacker to remain in your environment. So the kind of theme here is resiliency and when we were talking about this, if you are a resilient organization, you stop trying to predict who the attacker is, what the technique is going to be, you know, what do they even want, you don't necessarily care about that, you care about building systems that can detect, withstand, adapt, recover, operate under failure. So, you know, inject this into your organizations, put this assumed breach into practice And if there was a thing that I could say here that maybe you kind of keep in mind, you can have confidence in your environment, but confidence is not resilience. Validated capability is resilience. So as we, close things up here, takeaways we want you to go away with. Specific techniques should never be your focus. Right? What is the underlying thing that is being abused by a specific technique? There's no single attacker. It's pointless to talk about, right? There's no one attacker. You rarely know the attacker's true motivation, right? It doesn't matter just because it's a nation state attacker and you are, you know, regularly attacked by nation states doesn't mean that your... Their end goal is not just to get the name of your secretary for whatever reason. Prevention will eventually fail. Right? Prevention is an endurance test with no foreseeable end. If you're the defender, you always have to be right. If I'm the bad guy, I don't even have to play. And really, living in compromise is the true true operating condition. We all live in compromise in our lives, bring that to our networks as well. So real quick before we go on to the contact slide, any questions that we have? We got like two minutes left. Yes, I saw two minutes. I have a timer up here, Nara. Thank you. Cool. Well, yeah, we're done. If you want to connect with us, you could do that here. This takes us to your link... Our LinkedIns. Nick's may or may not have some payload in it. No, I'm joking. I I created both of them. I didn't make it. I... I'm too stupid to know how to do that that stuff. So... Yeah. Please, we would love to connect with you and talk to you more about stuff if you wanna get into Nick's red team mind. It's fascinating in there. So... Yeah. Thank you. Thank you all.