EXPERIENCE
Oddvar Moe has worked in the IT industry since 1999. Initially, he began as a Microsoft consultant, helping a variety of public and private clients to implement Microsoft technology, before he sharpened his focused on security in 2012 as a malware reverser at a Security Operations Center. Since 2013, Oddvar has worked dedicatedly with offensive security either doing penetration tests or red teams.
Oddvar has also taught many different courses and has been an active Microsoft Certified Trainer for many years. Within the setup of Microsoft technologies, Oddvar has expertise in products such as Advanced Threat Analytics, Windows Defender Advanced Threat Protection, AppLocker, System Center Configuration Manager, Deployment Toolkit, Active Directory, Group Policy, Exchange, Windows operating systems, and Remote Desktop Services. Oddvar currently works as a red teamer in the Targeted Operations Group at TrustedSec. While red teaming for Fortune 100 companies, Oddvar has gained a lot of experience from some of the most secure customers in the world. In total, he has more than 20 years of working experience in the IT industry and is passionate about Windows Security—so passionate, in fact, that Microsoft has awarded him the Most Valuable Professional Award for eight (8) years in row.
EDUCATION & CERTIFICATIONS
- Microsoft MVP
- GIAC Penetration Tester (GPEN)
- Microsoft Certified Professional (MSCP)
- Microsoft Certified Technology Specialist (MCTS)
- Microsoft Certified Solutions Associate (MCSA)
- Microsoft Certified Systems Engineer (MCSE)
- Microsoft Certified Systems Administrator (MCSA)
INDUSTRY CONTRIBUTIONS
As a speaker, Oddvar has delivered top-notch sessions at conferences such as DerbyCon, IT Dev Connections, Paranoia, MVP Day, HackCon, Microsoft Security Week, and the Nordic Infrastructure Conference.
Oddvar actively contributes to the security community and is most known for his contributions around the LOLBins/LOLBAS and the Ultimate AppLocker Bypasslist. He also loves to research stuff and has uncovered many different persistence and code execution techniques, UAC bypasses, and AWL bypasses over the years that have since been used by APT groups. Oddvar also has a few CVEs to his record, such as CVE-2017-8625 and CVE-2022-24696.
Featured Blogs And Resources
Discover the blogs, analysis, webinars, and podcasts by this team member.
Creative Process Enumeration
Very often in engagements, you'll want to list out processes running on a host. One thing that is beneficial is to know is if the processes is a 64-bit or…
Critical Outlook Vulnerability: In-Depth Technical Analysis and Recommendations (CVE-2023-23397)
Threat Overview Earlier this week, Microsoft released a patch for Outlook vulnerability CVE-2023-23397, which has been actively exploited for almost an entire…
Diving into Pre-Created Computer Accounts
I was on an engagement where I simply could not elevate privileges, so I had to become creative and look deep into my old bucket (bucket being my head) of…
CVE-2022-24696 - Glance by Mirametrix Privilege Escalation
When investigating my laptop, I stumbled upon something interesting that resulted in privilege escalation. I use a Lenovo ThinkPad X1 Extreme Gen 1, which has…
Unleashing the Power of AppLocker: How to Get Started and Go Beyond the Basics
Join Senior Security Consultant and Microsoft MVP Oddvar Moe in a two-part webinar series as he walks through how to get started with AppLocker, go beyond the…
The Lost Underground
Join TrustedSec Principal Security Consultant Mike Felch for an eye-opening journey into the lost underground, where ingenuity, disobedience, and complexity…
BEC Basics: Your First Step to Thwarting Email Scams
Join Senior Security Consultant Steven Erwin and Security Consultant Caroline Fenstermacher as they cover the basics of BEC analysis, providing participants…
Discovering a Deserialization Vulnerability in LINQPad
Like most red teamers, I spend quite a lot of time looking for novel vulnerabilities that could be used for initial access or lateral movement. Recently, my…
A 5-Minute Guide to HTTP Response Codes
If you've done any network scanning or application testing, you've run into your fair share of HTTP response codes. If not, these codes will show up in most…
WiCyS Ransomware Panel & Networking Event
Join us for an insightful discussion with the Women in Cyber Security (WiCyS) Northeast Ohio Affiliate members!
Empower your business through better security design.
Talk directly with our experienced advisory consultants to learn how we can help.
