{"id":2528,"date":"2016-12-15T18:21:09","date_gmt":"2016-12-15T17:21:09","guid":{"rendered":"http:\/\/securite.intrinsec.com\/?p=2528"},"modified":"2016-12-15T18:21:09","modified_gmt":"2016-12-15T17:21:09","slug":"botconf-2016-premiere-journee","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/botconf-2016-premiere-journee\/","title":{"rendered":"Botconf 2016 \u2013 Day One"},"content":{"rendered":"<p><a href=\"https:\/\/www.botconf.eu\/\"><img fetchpriority=\"high\" decoding=\"async\" class=\"wp-image-2557 size-large aligncenter\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2016\/12\/banniere-botconf2016-En-1024x256.jpg\" width=\"1024\" height=\"256\" \/><\/a><\/p>\n<p>Comme l&rsquo;ann\u00e9e derni\u00e8re, Intrinsec \u00e9tait pr\u00e9sent cette ann\u00e9e \u00e0 la Botconf &#8211;\u00a0 <a href=\"https:\/\/www.botconf.eu\/\">https:\/\/www.botconf.eu\/<\/a><\/p>\n<p>Cette 4\u00e8me \u00e9dition\u00a0 s&rsquo;est d\u00e9roul\u00e9e \u00e0 Lyon, au sein de l&rsquo;universit\u00e9 Lyon 2 du 30 Novembre au 2 D\u00e9cembre.<\/p>\n<h1>JOUR 1<\/h1>\n<p>(Liens vers les comptes-rendus des autres jours : <a href=\"https:\/\/www.intrinsec.com\/2016\/12\/15\/botconf-2016-seconde-journee\/\">jour 2<\/a> &amp; <a href=\"https:\/\/www.intrinsec.com\/2016\/12\/15\/botconf-2016-troisieme-journee\/\">jour 3<\/a>)<\/p>\n<p>&nbsp;<\/p>\n<p><b>Titre: Locky, Dridex, Necurs: the evil triad<\/b><\/p>\n<p>La premi\u00e8re conf\u00e9rence intitul\u00e9e \u00ab\u00a0Locky, Dridex, Recurs: the evil triad\u00a0\u00bb est pr\u00e9sent\u00e9e par Jean-Michel Picot (Google), qui pr\u00e9sente les diff\u00e9rents malware du point de vue de Gmail, en expliquant les difficult\u00e9s \u00e0 les identifier sur la plateforme. En effet, les attaquants utilisent une multitude de vecteurs diff\u00e9rents afin d&rsquo;infecter leurs victimes, tels que les fichiers \u00ab\u00a0doc\u00a0\u00bb, \u00ab\u00a0docx\u00a0\u00bb, \u00ab\u00a0MSO\u00a0\u00bb, \u00ab\u00a0RTF\u00a0\u00bb,\u00a0 etc. De plus, le fait que seuls les droppers (et non les malware entiers) soient transmis par email rendent leur classification difficile. Il est \u00e9galement possible d&rsquo;obfusquer le m\u00eame dropper plusieurs fois ou via diff\u00e9rents outils.<\/p>\n<p>Le conf\u00e9rencier pr\u00e9sente un retour d&rsquo;exp\u00e9rience sur les campagnes de phishing ayant eu lieu vers Mars 2015. Il explique que les attaques ont lieu par vague, avec de fortes mont\u00e9es le weekend. D&rsquo;apr\u00e8s les informations que Google a pu collecter et analyser, il n&rsquo;est pas impossible que Locky et Dridex partagent une m\u00eame infrastructure. Aujourd&rsquo;hui, le botnet Necurs a \u00e9t\u00e9 ferm\u00e9 et l&rsquo;op\u00e9rateur principal arr\u00eat\u00e9.<\/p>\n<p>La derni\u00e8re partie de la pr\u00e9sentation est focalis\u00e9e sur les m\u00e9thodes d&rsquo;\u00e9vasion utilis\u00e9es par les malware, telles que :<\/p>\n<ul>\n<li>l&rsquo;utilisation de commandes JScript en commentaire, afin de provoquer l&rsquo;arr\u00eat des antivirus<\/li>\n<li>l&rsquo;obfuscation de diff\u00e9rents mots-cl\u00e9s (notamment &lsquo;eval&rsquo;)<\/li>\n<li>l&rsquo;utilisation des composants COM, qui ne sont pas sensibles \u00e0 la casse en JScript, mais le sont en Javascript<\/li>\n<li>l&rsquo;utilisation de la commande &lsquo;sleep&rsquo; afin de d\u00e9tecter la pr\u00e9sence de sandbox<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><b>Titre : Visiting the Bear\u2019s Den<\/b><\/p>\n<p>Cette pr\u00e9sentation a pour but d&rsquo;expliquer la m\u00e9thodologie du groupe de hacker Sednit (aussi connu comme APT28, fancy bears, etc). Apr\u00e8s un court rappel de l&rsquo;historique de ce groupe ainsi que de ses cibles classiques (ambassades et minist\u00e8res), Jessy Campos nous pr\u00e9sente la fa\u00e7on d&rsquo;op\u00e9rer de ce groupe.<\/p>\n<p>La phase d&rsquo;infection du groupe est classique, avec l&rsquo;utilisation du spear phishing et l&rsquo;imitation d&rsquo;URL connues afin de diriger la victime vers une page comprenant un Exploit Kit (nomm\u00e9 SEDKIT). L&rsquo;exploit compromet alors le poste via diff\u00e9rentes CVE afin d&rsquo;y d\u00e9poser SEDUPLOADER qui permettra au groupe de pouvoir t\u00e9l\u00e9charger d&rsquo;autres binaires, comme SEDRECO, XAGENT, DOWNDELPH, mimikatz ou autres.<\/p>\n<p>Une fois les actions de persistance et les d\u00e9placements lat\u00e9raux effectu\u00e9s, les attaquants extraient les mots de passe des victimes via des keyloggers ou des captures d&rsquo;\u00e9cran.<\/p>\n<p>Slides : <a href=\"https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR01-Visiting-Bears-Den-CAMPOS.pdf\">https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR01-Visiting-Bears-Den-CAMPOS.pdf<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><b>Titre: Lurk: the story about five years of activity<\/b><\/p>\n<p>Reprise des conf\u00e9rences \u00e0 14h00 apr\u00e8s la pause d\u00e9jeuner avec \u00ab\u00a0Lurk: the story about five years of activity\u00a0\u00bb pr\u00e9sent\u00e9 par Vladimir Kropotov et Fyodor Yarochkin (Trendmicro). La conf\u00e9rence fut focalis\u00e9e sur le groupe LURK, dont l&rsquo;activit\u00e9 remonte \u00e0 2011. Les recherches men\u00e9es par Trendmicro sont bas\u00e9es sur des journaux de proxy qui mettent en \u00e9vidence que l&rsquo;infrastructure utilis\u00e9e n&rsquo;a que peu chang\u00e9 depuis le d\u00e9but des op\u00e9rations : URL simplistes \u00ab\u00a0[A-Z0-9]{4}\u00a0\u00bb, noms de fichiers inchang\u00e9s (indexm.html), etc. Certaines de ces sp\u00e9cificit\u00e9s sont similaires \u00e0 celles de l&rsquo;exploit kit Angler (telles que l&rsquo;injection de payloads directement en m\u00e9moire), ce qui laisse penser que les deux groupes sont \u00e9troitement li\u00e9s.<\/p>\n<p>Le groupe LURK se base sur l&rsquo;exploitation directe de sites et l&rsquo;ajout d&rsquo;iframes malveillantes, ou des r\u00e9seaux publicitaires afin de r\u00e9pandre leurs malware en exploitant principalement des vuln\u00e9rabilit\u00e9s Flash et Java. Tout comme Necurs, le groupe avait pour habitude de lancer leurs campagnes le weekend, ou la veille de vacances.<\/p>\n<p>Enfin, la pr\u00e9sentation s&rsquo;est termin\u00e9e par une vid\u00e9o de l&rsquo;arrestation du groupe par les forces de l&rsquo;ordre russes.<\/p>\n<p>Slides: <a href=\"https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR02-LURK-KROPOTOV.pdf\">https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR02-LURK-KROPOTOV.pdf<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><b>Titre : Browser-based Malware: Evolution and Prevention<\/b><\/p>\n<p>Pr\u00e9sent\u00e9e par Yandex Security, cette conf\u00e9rence nous montre les techniques permettant d&rsquo;effectuer des attaques de type MITB (Man-In-The-Browser), d&rsquo;abord via des techniques basiques, puis via de nouvelles techniques utilis\u00e9es par les virus.<\/p>\n<p>Le principe du MITB est donc d&rsquo;injecter du code malveillant directement dans le navigateur du poste infect\u00e9 pour ins\u00e9rer du JavaScript sur les pages int\u00e9ressantes, souvent les pages des banques, de mails ou des r\u00e9seaux sociaux. Cependant, cette technique peut rencontrer des probl\u00e8mes, notamment avec la mise \u00e0 jour des navigateurs qui peut rendre les virus inop\u00e9rants, les &lsquo;app container&rsquo; qui complexifient les injections ou encore le nombre important d&rsquo;IOC pr\u00e9sents sur le poste, etc.<\/p>\n<p>Les chercheurs de Yandex Security nous expliquent donc comment les MITB ont \u00e9volu\u00e9 pour utiliser les extensions des navigateurs, ou les proxies WFP (Windows Filtering Platform) qu&rsquo;ils explicitent \u00e0 travers des exemples.<\/p>\n<p>La conf\u00e9rence se conclut sur quelques moyens de d\u00e9tecter ces MITB ainsi que les r\u00e9sultats obtenus par l&rsquo;\u00e9quipe s\u00e9curit\u00e9 de Yandex.<\/p>\n<p>Slides : <a href=\"https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR03-Browser-based-Malware-Evolution-and-Prevention-KOVALEV-SIDOROV.pdf\">https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR03-Browser-based-Malware-Evolution-and-Prevention-KOVALEV-SIDOROV.pdf<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><b>Titre : Language Agnostic Botnet Detection Based on ESOM and DNS<\/b><\/p>\n<p>Deux chercheurs de Ruag nous proposent dans cette conf\u00e9rence une fa\u00e7on de d\u00e9tecter les Botnet via une m\u00e9thode agnostique. Pour cela, les chercheurs ont d\u00e9velopp\u00e9 ESOM (Emergent Self-organizing Maps), qui est un r\u00e9seau de neurones artificiel.<\/p>\n<p>Les chercheurs nous pr\u00e9sentent donc cet outil, l&rsquo;architecture utilis\u00e9e, mais aussi les botnets utilis\u00e9s pour &lsquo;entrainer&rsquo; l&rsquo;algorithme. Ainsi la m\u00e9thode permet de cat\u00e9goriser les botnets en fonction du DNS utilis\u00e9.<\/p>\n<p>Slides : <a href=\"https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR04-ESOM-DNS-MANDRYSCH.pdf\">https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR04-ESOM-DNS-MANDRYSCH.pdf<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><b>Titre : Vawtrak Banking Trojan : A Threat to the Banking Ecosystem<\/b><\/p>\n<p>Pour cette pr\u00e9sentation, deux chercheurs de Blueliv, Raashid Bhat et Victor Acin nous pr\u00e9sentent le cheval de Troie Vawtrak. Anciennement connu sous le nom de Neverquest, ce cheval de Troie est apparu en novembre 2013 et fait maintenant partie du top 5 des chevaux de Troie \u00e0 vis\u00e9e financi\u00e8re.<\/p>\n<p>Apr\u00e8s une pr\u00e9sentation sur les sp\u00e9cifications techniques de Vawtrak, comme son packer ou la configuration des bots, les deux chercheurs nous montrent les communications avec le serveur de Command &amp; Control, notamment le chiffrement employ\u00e9.<\/p>\n<p>Les chiffres du botnet sont aussi explicit\u00e9s, comme le nombre d&rsquo;infections, les pays les plus touch\u00e9s ou encore le nombre d&rsquo;IOC d\u00e9tect\u00e9s, et l&rsquo;infrastructure des deux groupes op\u00e9rant ce botnet : Moskalvzapoe et Vawtrak Group.<\/p>\n<p>Slides : <a href=\"https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR05-Vawtrak-ACIN-BHAT.pdf\">https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR05-Vawtrak-ACIN-BHAT.pdf<\/a><\/p>\n<p>&nbsp;<\/p>\n<p><b>Titre : Snoring Is Optional: The Metrics and Economics of Cyber Insurance for Malware Related Claims<\/b><\/p>\n<p>Wayne Crowder nous pr\u00e9sente dans cette conf\u00e9rence les assurances ayant pour but de couvrir les risques num\u00e9riques. Il remarque que les co\u00fbts des fuites de donn\u00e9es augmentent radicalement d&rsquo;ann\u00e9e en ann\u00e9e. Ainsi, il liste ce que les assurances peuvent couvrir sur les risques num\u00e9riques :<\/p>\n<ul>\n<li>Fuite de donn\u00e9es<\/li>\n<li>Virus<\/li>\n<li>DDoS<\/li>\n<li>Etc.<\/li>\n<\/ul>\n<p>La suite de la pr\u00e9sentation vise \u00e0 expliquer quels sont les avantages des assurances ainsi que les points \u00e0 v\u00e9rifier afin d&rsquo;\u00eatre s\u00fbr d&rsquo;avoir une bonne couverture en cas de compromission.<\/p>\n<p>En conclusion, il nous explique que les assurances dans le domaine du num\u00e9rique vont se d\u00e9velopper pour compl\u00e9menter la s\u00e9curit\u00e9 op\u00e9rationnelle.<\/p>\n<p>Slides : <a href=\"https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR06-SnoringOptional-WC-Botconf2016.pdf\">https:\/\/www.botconf.eu\/wp-content\/uploads\/2016\/11\/PR06-SnoringOptional-WC-Botconf2016.pdf<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>(Liens vers les comptes-rendus des autres jours : <a href=\"https:\/\/www.intrinsec.com\/2016\/12\/15\/botconf-2016-seconde-journee\/\">jour 2<\/a> &amp; <a href=\"https:\/\/www.intrinsec.com\/2016\/12\/15\/botconf-2016-troisieme-journee\/\">jour 3<\/a>)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Comme l&rsquo;ann\u00e9e derni\u00e8re, Intrinsec \u00e9tait pr\u00e9sent cette ann\u00e9e \u00e0 la Botconf &#8211;\u00a0 https:\/\/www.botconf.eu\/ Cette 4\u00e8me [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2599,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,19,22],"tags":[],"class_list":["post-2528","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-evaluation-securite","category-soc-securite-operationnelle","category-veille-securite"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.0 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Botconf 2016 - premi\u00e8re journ\u00e9e - INTRINSEC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/botconf-2016-premiere-journee\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Botconf 2016 - premi\u00e8re journ\u00e9e\" \/>\n<meta property=\"og:description\" content=\"Comme l&rsquo;ann\u00e9e derni\u00e8re, Intrinsec \u00e9tait pr\u00e9sent cette ann\u00e9e \u00e0 la Botconf &#8211;\u00a0 https:\/\/www.botconf.eu\/ Cette 4\u00e8me [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/botconf-2016-premiere-journee\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2016-12-15T17:21:09+00:00\" \/>\n<meta name=\"author\" content=\"Intrinsec\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Intrinsec\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/\"},\"author\":{\"name\":\"Intrinsec\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/ade590fbc7ad6f413727bae7cd3fb799\"},\"headline\":\"Botconf 2016 &#8211; premi\u00e8re journ\u00e9e\",\"datePublished\":\"2016-12-15T17:21:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/\"},\"wordCount\":1336,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"articleSection\":[\"S\u00e9curit\u00e9 offensive &amp; Audit\",\"SOC S\u00e9curit\u00e9 Op\u00e9rationnelle\",\"Veille S\u00e9curit\u00e9\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/\",\"name\":\"Botconf 2016 - premi\u00e8re journ\u00e9e - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"datePublished\":\"2016-12-15T17:21:09+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/#primaryimage\",\"url\":\"\",\"contentUrl\":\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/botconf-2016-premiere-journee\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Botconf 2016 &#8211; premi\u00e8re journ\u00e9e\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/ade590fbc7ad6f413727bae7cd3fb799\",\"name\":\"Intrinsec\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g\",\"caption\":\"Intrinsec\"},\"sameAs\":[\"https:\\\/\\\/www.intrinsec.com\"],\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/ufhtbqccsz\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Botconf 2016 - Day 1 - INTRINSEC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/botconf-2016-premiere-journee\/","og_locale":"en_US","og_type":"article","og_title":"Botconf 2016 - premi\u00e8re journ\u00e9e","og_description":"Comme l&rsquo;ann\u00e9e derni\u00e8re, Intrinsec \u00e9tait pr\u00e9sent cette ann\u00e9e \u00e0 la Botconf &#8211;\u00a0 https:\/\/www.botconf.eu\/ Cette 4\u00e8me [&hellip;]","og_url":"https:\/\/www.intrinsec.com\/en\/botconf-2016-premiere-journee\/","og_site_name":"INTRINSEC","article_published_time":"2016-12-15T17:21:09+00:00","author":"Intrinsec","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Intrinsec","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/"},"author":{"name":"Intrinsec","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/ade590fbc7ad6f413727bae7cd3fb799"},"headline":"Botconf 2016 &#8211; premi\u00e8re journ\u00e9e","datePublished":"2016-12-15T17:21:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/"},"wordCount":1336,"commentCount":0,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/#primaryimage"},"thumbnailUrl":"","articleSection":["S\u00e9curit\u00e9 offensive &amp; Audit","SOC S\u00e9curit\u00e9 Op\u00e9rationnelle","Veille S\u00e9curit\u00e9"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/","url":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/","name":"Botconf 2016 - Day 1 - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/#primaryimage"},"thumbnailUrl":"","datePublished":"2016-12-15T17:21:09+00:00","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/#primaryimage","url":"","contentUrl":""},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/botconf-2016-premiere-journee\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"Botconf 2016 &#8211; premi\u00e8re journ\u00e9e"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/ade590fbc7ad6f413727bae7cd3fb799","name":"Intrinsic","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fde6ed961c7078765b03a213927b5c4001b1cef4787255188f5b502a99e6ddd6?s=96&d=retro&r=g","caption":"Intrinsec"},"sameAs":["https:\/\/www.intrinsec.com"],"url":"https:\/\/www.intrinsec.com\/en\/author\/ufhtbqccsz\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/2528","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=2528"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/2528\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=2528"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=2528"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=2528"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}