Session Abstract

Join me for a thrilling deep dive into a real-world Purple Team exercise where a Red Team started with nothing more than a cloud-only user—and ended up with Domain Admin. This session unpacks the full attack chain, revealing the clever techniques and lateral movements that made it possible. We’ll dissect each step of the journey through Microsoft Entra ID, Azure, Defender for Cloud, Defender for Endpoint, and Defender for Identity, showing not just how the attack unfolded, but how it was detected and hunted in real time using Microsoft’s security stack. Expect war stories, technical insights, and actionable detection and prevention strategies you can take back to your own environment.

Robbe Van den Daele

I'm Robbe, an information security professional driven by a genuine passion for my work. My focus lies in Cloud Security, Purple Teaming, Microsoft Security Solutions, and the powerful MITRE ATT&CK framework. With a strong foundation in computer science, I've delved into the intricacies of information security, mastering technical aspects and procedural complexities. Cloud security became my niche, where I secure data, design resilient architectures, and implement robust measures. As a purple teamer, I excel at detecting and mitigating cybersecurity threats, identifying vulnerabilities, and fortifying defenses. I've embraced the invaluable MITRE ATT&CK framework, consulting organizations on understanding adversaries and strengthening their security posture. I'm driven by a thirst for knowledge, constantly staying ahead of industry trends through engagement with information security communities, conferences, and continuous learning.