Red Teaming
Certified Red Team Operations Specialist
Full-spectrum offensive operations: MITRE ATT&CK tradecraft across all fourteen tactics, from reconnaissance and initial access to lateral movement, command and control, Active Directory abuse and the final assessment report.
Red teaming is a discipline, not a technique
A penetration test answers a question: can I get in? A red team engagement answers a different
one: **given the controls this organisation actually has, can an adversary with these objectives
reach them, and what would the defenders see along the way?**
That is why red teaming is expensive and slow. You are not optimising for access — you already
know how to get in. You are testing whether the detection and response capability exists,
whether the alerts fire, whether anyone triages them, and whether the containment actually works.
Every action is a question asked of the blue team.
The two rules that define the engagement
- Objectives, not access. You are not given a vulnerability to exploit. You are given a
business objective ("access the finance server", "obtain a domain admin session") and you
decide the path. This is what makes it a simulation of a real adversary rather than a checklist.
- Detection is a deliverable. A red team engagement that gains access and leaves quietly has
half failed. If nothing fired, the finding is "the adversary would have been invisible", and
that is usually the most valuable thing in the report.
What you will be able to do
- Build tradecraft infrastructure that survives contact with a competent SOC
- Plan and run a full-spectrum operation mapped to MITRE ATT&CK across all fourteen tactics
- Compromise an Active Directory environment using realistic attack paths, not shortcuts
- Escalate privileges on both Windows and Linux using the techniques defenders actually watch for
- Move laterally and exfiltrate in a way that is technically successful and operationally risky
- Write the purple report: what happened, what the defenders saw, what to fix first
Assumed knowledge
Networking and Windows/Linux administration at a professional level, the offensive material from
the Ethical Hacking course, and a clear understanding of that everything here happens only in
authorised environments.
Syllabus
-
1
Red team fundamentals and rules of engagement
How red teaming differs from pentesting, and the document that defines the whole engagement.
Locked -
2
Tradecraft infrastructure
Building and maintaining the infrastructure a real adversary would need, without being one.
Locked -
3
Initial access: exploiting the perimeter
Getting the first authenticated execution inside, the way real adversaries do it.
Locked -
4
Credential access and Active Directory abuse
Harvesting and reusing credentials, then turning them into domain compromise.
Locked -
5
Lateral movement, discovery and privilege escalation
Moving through the environment, mapping it, and escalating on both operating systems.
Locked -
6
Command and control, defence evasion and exfiltration
Staying connected, staying hidden, and getting data out.
Locked
Final exam
Locked. Enrol in the course to unlock the final exam.