Daniel Schell - How Attackers Play the Endpoint - and How to Break the Game

What if you looked at your endpoint the way an attacker does—not as a system to defend, but as a game to win? This talk reframes modern endpoint compromise as a series of repeatable strategies drawn from a well-understood playbook. Despite the apparent complexity of malware, ransomware, and post-exploitation frameworks, most attacks rely on a small set of foundational techniques: gaining code execution, evading controls through in-memory and "living off the land" methods, and chaining these primitives to achieve persistence and impact. Through a structured breakdown of these core "moves," this session deconstructs real-world attack patterns and shows how attackers consistently succeed—now increasingly accelerated by AI-assisted tooling. By understanding the strategy guide attackers implicitly follow, defenders can stop reacting to individual threats and instead target the underlying mechanics that make compromise possible. The session provides concrete defensive approaches, including deny-by-default and application control strategies, that materially limit attacker options at the endpoint. The goal is simple: if you understand the rules of the game, you can start to change them.