BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.romhack.io//romhack-camp-2026//talk//8QEJPW
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-romhack-camp-2026-8QEJPW@cfp.romhack.io
DTSTART;TZID=CET:20261002T182000
DTEND;TZID=CET:20261002T190000
DESCRIPTION:"You need local admin for that." It's one of the most repeated 
 assumptions in offensive Windows tradecraft\, and it's mostly wrong.\nMost
  of these techniques are gated by a specific set of access-mask and DACL p
 ermissions\, not by group membership\, so the real question isn't "am I ad
 min?" but "what do I actually need?" This talk answers that systematically
 : what each lateral-movement technique truly requires\, instead of what fo
 lklore and our tooling assume.\nWe'll walk through the true minimum rights
  behind service creation and reconfiguration\, DCOM\, WinRM\, WMI (over bo
 th DCOM and WSMAN)\, Remote Registry\, Remote GhostTask\, Remote Network P
 rovider hijack\, RDP and RDP Shadowing\, SSH\, and User Right Assignments.
  Along the way we'll hit the under-documented Microsoft policy that silent
 ly breaks "non-admin service creation\," the granular access masks that ma
 ke these paths work (0x0003 on the SCM\, 0x00011 for shadowing\, and frien
 ds)\, and why those same minimal rights double as quiet persistence.\nThe 
 uncomfortable part cuts both ways. BloodHound edges\, NetExec's "Pwned!"\,
  and group-membership checks systematically miss these configurations\, so
  attackers slip through and defenders never see it. I'll cover MovementHou
 nd\, a PowerShell minimal-rights enumerator that surfaces these overlooked
  paths and feeds the missing edges straight into BloodHound\, with a recor
 ded demo of it in action.\nExpect granular access-mask details and honest 
 caveats.
DTSTAMP:20260921T191337Z
LOCATION:STAGE 2 (Ghost in the Shellcode)
SUMMARY:MovementHound: You might be missing something\, move it! - Umberto 
 Micillo (polair)
URL:https://cfp.romhack.io/romhack-camp-2026/talk/8QEJPW/
END:VEVENT
END:VCALENDAR