This talk will demonstrate how to use Crystal Palace to rapidly develop novel PIC tradecraft/capabilities and immediately deploy them in Cobalt Strike. It will cover novel UDRLs, async BOFs, and async BOF-PEs, and show how Crystal Palace has dramatically lowered the bar for developing novel evasive tradecraft.

Presenter: William Burgess

While common macOS applications are protected by the hardened runtime, shellcode execution is often still possible because of various entitlements permitting unsigned executable memory. As more applications transition to using the more-restrictive “allow-jit” entitlement, previous execution techniques are rendered ineffective. This presentation discusses the internals of macOS JIT memory and demonstrates methods to execute shellcode within affected applications.

Presenter: Kyle Avery

This talk explains how C2 frameworks can move beyond unstructured operator logs by giving teamserver data a queryable, machine-readable model. It then shows how exposing that structured data through the Model Context Protocol lets LLM-based tools better interpret findings, identify opportunities, and suggest next steps without relying on raw logs.

Presenter: Max Grim

This talk traces the progression of post-exploitation tradecraft, examining how operators moved from basic remote control capabilities to flexible and stealthy in-memory execution. Attendees will gain an understanding of key drivers that shaped modern post-exploitation, insights into future developments and a peek under the hood of the newly released Cobalt Strike Interpreter.

Presenter: Pieter Ceelen

This talk explores how attackers can enable Chromium DevTools Protocol from within a running browser process, bypassing the usual command-line flags and policy protections. Once CDP is unlocked, the attack moves beyond stealing cookies to fully controlling the victim’s live browser session, including remote browsing into services such as Microsoft 365.

Presenter: Cedric Van Bockhaven