Most Active Directory compromises do not start with a CVE, and no patch cycle closes them. They happen because every link in the attack chain is a feature working as designed.

Sage Getts, the newest adversarial engineer on the Lares bench, is presenting that pattern at Queen City Con on November 14 at 2 PM. His talk, "Weaponizing Active Directory: The Unpatchable Network," covers four Active Directory findings he hits over and over on internal assessments. None have a CVE, and none are getting patched. For each one, he walks through how it ended up in the directory, how he abuses it, how to find it yourself, and what the fix actually looks like in your environment. Then he shows what happens when more than one of them lives in the same network, and how far that goes once the directory is wired to Entra ID. Domain Admin is not the end of that story. It is the middle.

Sage also covers the places he got stopped, which he calls the part most talks leave out. Two controls held, and that was the more useful half of the report. Attendees at Queen City Con will leave with a short list of things to verify in their own environments on Monday.

Session details: https://queencitycon.org/agenda

Sage is the right person to tell that story because he spent years on the other side of it. Before moving fully into offensive security, he built, hardened, and defended the environments he now attacks: systems administration, Tier 3 security operations, Azure engineering, and running an enterprise security program end to end, including Active Directory and Entra ID defenses against privilege escalation techniques like Kerberoasting and DCSync.

Sage holds the OSCP+ certification. His engagements span external and internal network testing, Active Directory, web applications, and cloud and identity attack surfaces. He maps how individual weaknesses connect into full attack paths, and he writes findings so the people fixing them know what to do. Outside of engagements, he builds and publishes open-source offensive tooling and runs a cybersecurity YouTube channel.

Through manual Penetration Testing, Red Teaming, and Purple Teaming, Lares validates how your identity, network, and cloud controls actually hold up against chained tradecraft.

Stop guessing. Start validating: https://www.lares.com/contact