SEC665: Advanced Red Team Operations

This module covers various topics required to build a successful initial access campaign for covert red team operations. From creating the infrastructure to building evasive payloads and delivery techniques, students will learn how to properly weaponize payloads for initial access.

This section covers advanced lateral movement techniques in modern environments as a follow-on from topics covered in intermediate red team operations courses. Focus areas include credential attacks against hardened systems, Windows authentication protocols, relays over C2, OPSEC-focused stealth lateral movement, EDR architecture, telemetry, and evasion.

Section 3 introduces lesser-known techniques to achieve persistence on a compromised endpoint, cloud initial access, and lateral movement and attacks on AD CS and Configuration Manager (formerly known as SCCM). Students will understand how to leverage CI/CD pipelines to reach their objectives.

This section focuses on advanced red team engineering and R&D, teaching operators to research defenses, master .NET tradecraft, obfuscation, develop BOFs, and discover novel persistence mechanisms.

Explore Windows kernel internals from a red team perspective, including EDR drivers, kernel callbacks, minifilters, and driver exploitation, to understand how modern defenses operate below user mode and where blind spots and evasion opportunities exist.

Rogue One is a self-paced Capture the Flag (CTF) operation that will force you to put into place what you learned during training. You are the rebellion red team now and you must make your way through a labyrinth of networks as you try to gain access, persist, move, and exploit weaknesses along the way. Only a few will recover and escape with the plans.