#15 Fish Phish Fixe
Details
This year's theme has clearly been all about returning, as we're back at Microsoft Portugal's headquarters for our final event of the year. And we're pulling double duty, as this event also marks our fourth anniversary 🎉
We have two talks lined up for you, which we hope you'll enjoy. And please, don't ignore our feedback emails afterwards. We promise they're legitimate 🥺
Also, the cake is not a lie 🎂
Considering this chapter rose from the ashes in November 2022, hosting 15 events in four years is a pretty decent average ⏱️
This OWASP Lisboa chapter meetup will take place on November 12th, 2026, at 18:30, with the support of Microsoft Portugal and AP2SI 🤝🏻
The venue is the Microsoft Portugal office. Big building, Microsoft logo, can't miss it 🧭
Our tentative schedule:
18:40 - Quick intro by the OWASP Lisboa chapter leadership team
18:50 - “From Image Poisoning to Cluster Compromise: Attacking Docker and Kubernetes” by Sergey Chubarov
19:30 - "Your Adversaries Already Know Your Detection Gaps. Do You?" by Francisco Medeiros
20:00 - Food & Drinks, courtesy of Microsoft Portugal
Although the activities may start later, please try to arrive by 18:00 to allow ample time to settle in ⌚
--------------------------
Talks:
--------------------------
Title: From Image Poisoning to Cluster Compromise: Attacking Docker and Kubernetes
Speaker: Sergey Chubarov
Abstract: A single malicious container image can be enough to compromise an entire cloud-native environment.
This session explores how red teams and threat actors abuse the container supply chain to gain initial access, evade detection, establish persistence, and compromise Kubernetes clusters. Through live demonstrations, we will show how seemingly legitimate Docker and Kubernetes images can be weaponized to execute malicious code, steal secrets, deploy backdoors, and provide a foothold inside production environments.
Attendees will gain a practical understanding of modern container attack techniques and learn how to defend Docker and Kubernetes environments against supply chain threats.
Bio: Sergey Chubarov is a cloud security consultant, red teamer, Microsoft MVP, and Microsoft Certified Trainer with more than 15 years of experience in cybersecurity. His work spans offensive security, cloud security, and AI, helping organizations identify and mitigate real-world threats.
He is a frequent speaker at Black Hat, DEF CON, Hacker Halted, Wild West Hackin' Fest, and other international conferences. Sergey is known for highly practical sessions featuring live demonstrations, real attack scenarios, and actionable defensive guidance.
👉🏻 https://www.linkedin.com/in/schubarov/
--------------------------
Title: Your Adversaries Already Know Your Detection Gaps. Do You?
Speaker: Francisco Medeiros
Abstract: Security teams invest heavily in SIEMs, EDRs, XDRs, threat intelligence, and other defensive technologies. Yet detection gaps remain, and adversaries continuously adapt their techniques to evade the security controls we rely on.
But what if some of the most valuable insights for improving our detection coverage are already sitting in our own environments?
Every incident, penetration test, threat intelligence report, and newly disclosed vulnerability offers an opportunity to understand what we can detect, what we're missing, and how we can improve.
In this talk, we'll explore a practical approach to continuous detection engineering, turning real-world evidence into meaningful improvements in detection coverage.
We'll look at how to:
- Translate newly disclosed vulnerabilities and threat intelligence into actionable detection hypotheses, rather than waiting for vendor-provided content.
- Use penetration testing and purple teaming to identify blind spots, validate existing detections, and continuously improve coverage.
- Reconstruct incident timelines to uncover missed opportunities for earlier detection.
- Analyse available telemetry, validate techniques in controlled environments, and assess existing vendor and custom detection capabilities.
- Balance detection specificity, coverage, and false positives to develop resilient detections that remain operationally useful.
Through practical examples, we'll examine how offensive techniques can expose gaps in widely deployed security products, and how collaboration between offensive and defensive teams can turn those findings into stronger detection capabilities.
The goal isn't to walk away with another collection of detection rules to copy. It's to leave with a repeatable, vendor-neutral framework for continuously learning from the evidence already available to us, challenging our assumptions, and making better detection engineering decisions.
Because the question isn't just whether your adversaries know your detection gaps. It's whether you do, too.
Bio: Francisco Medeiros is a Threat Hunting Professional at Siemens, with over eight years of experience in cybersecurity, specialising in threat hunting, detection engineering, incident response, and purple teaming.
His work focuses on identifying gaps in detection coverage, understanding adversary techniques, and improving defensive capabilities through continuous testing and collaboration between offensive and defensive security teams.
Francisco holds GIAC GCFA and GPEN certifications and enjoys sharing his experience and insights with the cybersecurity community.