Topic: Breaking the Blue Team: Techniques to Bypass Modern Detection Systems
Abstract: As cyber defenders deploy increasingly sophisticated SIEM, EDR, XDR, and behavioral detection technologies, attackers are adapting their techniques to evade, deceive, and bypass these controls. Modern adversaries increasingly rely on stealth, living-off-the-land techniques, identity abuse, and manipulation of legitimate tools to operate beneath the radar of traditional security monitoring. The current webinar explores how modern attack techniques challenge conventional blue-team defenses and where detection systems can fall short. It examines the attacker–defender dynamic, focusing on how adversaries identify detection gaps, evade security controls, blend malicious activity with legitimate behavior, and exploit weaknesses in monitoring and response processes. The goal is to turn lessons from red team into stronger defensive strategies—helping security teams build detection systems that are more resilient, adaptive, and capable of identifying sophisticated threats. The session will also highlight how threat-informed detection engineering, behavioral analytics, threat hunting, continuous validation, and purple-team exercises can help organizations identify blind spots before adversaries exploit them. Join us to gain insight into the techniques and patterns defenders should understand when evaluating the effectiveness of their detection capabilities.
Key Takeaways:
- Understanding modern detection and evasion techniques
- Common blind spots in SIEM, EDR, and XDR environments
- Living-off-the-land and abuse of legitimate tools
- Identity-based and behavior-based detection challenges
- Detection engineering and threat-informed defense
- Threat hunting and continuous detection validation
- Using purple teaming to uncover defensive gaps
- Improving SOC resilience against evolving attack techniques
Speaker:
Milton Araújo, Security Researcher
Bio: Milton Araújo is an offensive security specialist with a strong focus on red-team operations, malware development, evasion techniques, and reverse engineering. His work centers on simulating real-world adversaries to help organizations assess and improve their defenses against modern security controls such as EDR, AV, XDR, and sandbox technologies. He regularly conducts advanced penetration tests across infrastructure, web applications, APIs, mobile, and wireless environments, and develops custom implants and stealth execution frameworks. Milton is also an OWASP community contributor, a Certified EC-Council Instructor (CEI), and the host of r19.io, a podcast featuring leading hackers and security researchers from around the world.
