SEC665: Advanced Red Team Operations

Overview

As it stands, getting initial access is among the most challenging domains of red teaming. Organizations are investing hundreds of thousands, if not millions, into their security programs, aiming to prevent the very thing we are trying to achieve. This may seem daunting at first, but still, red teaming is here to stay. There are no perfect systems, and our job as red teamers is to find and exploit the weaknesses in the organization's defenses to gain access. In this chapter, we’ll look into the steps necessary to ultimately gain access to even mature organizations. Covering aspects of unattributable infrastructure, designing and building evasive payloads, techniques to smuggle the payload through advanced defenses, and designing effective phishing campaigns for an initial foothold. We’ll also cover how to enumerate the environment. After all, we want to keep our access for a while.

Focus then lies on creating convincing social engineering and phishing campaigns, bringing home the sought after access. The module is concluded with a deep dive into reconnaissance technique avoid losing that well-deserved access

Full Lab Details

• Understand and execute infrastructure as code to create a fully automated C2 and redirector setup in the cloud
• Build a DLL sideloading initial access payload using Shhhloader and bundle it with an execution harness
• Understanding how WebAssembly smuggling improves on the classic HTML smuggling technique for evasive payload delivery
• Executing a full initial access kill chain by abusing Microsoft Direct Send endpoints for sender spoofing and performing covert enumeration once initial access is achieved

Full Topic Details

• Introducing the course itself and nuances of advanced red teaming, the lab, and working with Elastic Security
• Designing infrastructure that withstands attribution in spite of analysis and scrutiny, working with cloud-based services to mask traffic
• Weaponizing DLL sideloading, ClickOnce and AppDomain Manager hijacking
• Diving deep into delivering payloads, with HTML Smuggling, WebAssembly Smuggling, and third-party services
• Writing pretexts, optimizing e-mail deliverability, and emerging phishing trends
• Avoiding detection by identity-aware security tools when performing LDAP reconnaissance

Overview

Students will explore advanced lateral movement techniques with a focus on OPSEC awareness. Topics include credential attacks in hardened environments, relaying credentials over C2, authentication and ticketing attacks in Windows, including cross-forest trusts, advanced lateral movement techniques with COM/DCOM/WMI, modifying existing tool functionality to enhance stealth, and OPSEC-enhanced approaches to working with known methods such as SCM. Additionally, students will learn about different types of DLL injection, Windows access tokens, bypassing UAC, EDR architecture, telemetry sources, and user-mode security product evasion.

Full Lab Details

• Understand the mechanisms in place to protect credentials in Windows, such as Protected Processes and Credential Guard and how to evade them
• Explore the limitations of relaying credentials over command-and-control channels and how to overcome them
• Understand the OPSEC implications of common tools such as Impacket for lateral movement, and modify these tools to laterally move in a hardened environment with stealth
• Exploit COM object hijacking and DCOM from end-to-end, starting with identification and moving to exploitation through developing implants with custom code
• Utilize a debugger to explore user-mode EDR hooking and evade these controls with unhooking and direct system calls

Full Topic Details

• Credential attacks in hardened environments with endpoint protection, protected processes, and credential guard
• Review of authentication protocols in Windows, Kerberos ticket attacks and relaying credentials over C2
• Advanced lateral movement tradecraft, including COM, DCOM, WMI, and DLL Injection with OPSEC awareness
• Windows access tokens, User Account Control (UAC) and bypass methods
• EDR architecture, telemetry sources, and user-mode evasion

Overview

This section covers different methods of persistence. While we expose parts of our toolkit by dropping it to disk to establish persistence, it is a necessary evil to keep our access even across reboot. With this section, students learn which techniques work to limit the chance of detection and, therefore, potential exposure of dropped payloads. Next, students will be introduced to Microsoft Entra ID and the underlying authentication mechanisms. As a popular cloud-based identity provider, Entra ID is a high-value target potentially providing access to critical business applications. The sections cover the foundations of authentication and tokens in Entra ID, different attacks to gain initial access and escalate privileges, as well as vectors to pivot from cloud back to on-premise systems. The last two modules of the day cover both Active Directory Certificate Services and Configuration Manager (ConfigMgr, a.k.a SCCM). The section is concluded with a closer on how the red team can take advantage of improperly secured CI/CD pipelines.

Full Lab Details

• Gaining access to Entra ID through dynamic device code phishing, escalating privileges, and compromising an Intune-managed endpoint
• Performing a Shadow Credential attack to escalate privileges and abuse new attack path in AD CS
• Perform different attacks against Configuration Manager for domain dominance

Full Topic Details

• GhostTasks, AMSI Provider persistence and TypeLib hijacking
• Microsoft Entra Tokens and conditional access policies
• (Dynamic) Device code phishing
• Microsoft Entra enumeration
• Pivoting from on-premise to Microsoft Entra
• Pivoting from Microsoft Entra to on-premise
• Configuration Manager enumeration and exploitation
• AD CS enumeration and exploitation, PKINIT, and Shadow Credentials
• Extracting secrets from and backdooring CI/CD pipelines

Overview

This section empowers seasoned red team operators with structured research and development capabilities essential for staying ahead of evolving defenses. Students gain deep insight into modern defensive stacks, master advanced .NET techniques for evasion, obfuscation pipelines (including cutting-edge LLM-based methods), and develop custom Beacon Object Files (BOFs) from basic proofs-of-concept to highly stealthy implementations. The section also covers systematic discovery of novel persistence mechanisms using tools like ProcMon, COM hijacking, and UAC bypass research, fostering an independent R&D mindset critical for long-term operational success.

Full Lab Details

• Create, improve, and test BOFs, including stealth enhancements, proper testing frameworks, and safe launching techniques before live deployment.
• Finding novel vectors using ProcMon to analyze Windows boot and runtime processes, identifying hijack opportunities for persistence, privilege escalation, or evasion.
• Apply research findings to implement real-world COM object hijacking for stealthy persistence or escalation.

Full Topic Details

• Advanced .NET tradecraft and obfuscation
• BOF development
• Hunting new persistence mechanisms
• Structured research methodology for Red Teaming

Overview

This advanced section dives into the Windows kernel, equipping experienced red team operators with the knowledge and skills to understand, analyze, and responsibly interact with kernel-level components. Students explore how modern EDR solutions hook into the kernel for monitoring and protection, identify callback registrations and communication mechanisms, reverse engineer driver behavior, discover blind spots, and learn techniques for evading or bypassing these defenses. The focus is on research-driven tradecraft, including kernel debugging, symbol analysis, and practical exploitation of drivers—all while emphasizing ethical, controlled approaches essential for simulating sophisticated adversaries.

Full Lab Details

• Intercepting filter communication port traffic
• Discovering callback registrations
• REing EDR minifilter
• Driver Exploitation

Full Topic Details

• The Windows kernel (offline symbols, remote kernel debugging, AI assistance with undocumented structures and APIs)
• How EDR kernel components communicate (traditional drivers and IOCTLs, file system minifilters, and communication ports)
• EDR kernel callbacks (processes, image loads, objects, registry, ETWi)
• How to discover EDR kernel components (Fltmc, WinDbg)
• Reverse engineering EDR components
• Driver exploitation techniques (pros/cons, testing, fuzzing, loading)

For the In-person and Live Online formats, the CTF will start at the end of day 1 and conclude at the end of the last day of class, allowing students to keep momentum in applying lessons learned from each day.

For the OnDemand format, the student already has the option to start the CTF anytime throughout the course.