Advanced Red Teaming: Adversary Emulation & Identity Attacks_

Overview

Organizations face increasingly sophisticated targeted attacks and ransomware. To improve their security posture, teams need to be able to emulate real adversaries and put their defensive capabilities to a genuine test.

This hands-on training focuses on the tradecraft behind advanced targeted attacks and how defenders can measure and improve their resilience against it. You will study how modern campaigns are built and operated, and practice the same techniques inside a controlled, cloud-based lab so that every lesson maps back to a defensive takeaway.

Across four days you will stand up red team infrastructure on AWS with Terraform and Caldera, work through phishing and initial access, develop custom tooling, and study evasion, credential access, and lateral movement, all mapped to the MITRE ATT&CK framework. The emphasis is on understanding how each technique works so you can detect and defend against it.

This is an advanced course. It assumes a solid Windows and cybersecurity background and comfortable C++ programming skills, and everything is taught strictly for authorized testing and defensive improvement.

What you will learn

Day 1 starts with real APT attack analysis and infrastructure deployment. You will set up a full red team environment in AWS using Terraform, deploy Caldera as your C2, and then work through phishing and initial access: building phishing pages with GoPhish and Evilginx2, bypassing two-factor authentication, and executing spear-phishing attacks with malicious documents, LNK files, and COM objects.

Day 2 is about building your own tools. You will develop a custom HTTP implant in C++ that communicates with Caldera, implement a plugin framework, build persistence mechanisms, and develop privilege escalation techniques including UAC bypasses and service-based escalation to SYSTEM.

Day 3 covers the evasion techniques that make the difference between getting caught and staying in. You will implement string encryption, dynamic API loading, steganography, and anti-analysis methods. On the network side, you will build HTML smuggling, HTTPS communication, and DNS/ICMP channels. The day closes with EDR bypass techniques: process injection, API unhooking, invisible injection, and AppLocker bypasses.

Day 4 focuses on credential access and lateral movement, the final stages of a real engagement. You will dump LSASS, impersonate tokens, hijack RDP sessions, and implement the full Kerberos attack chain: Pass-the-Hash, Golden Ticket, and domain takeover. The module closes with automating lateral movement across an enterprise.

How the training is structured

Everything is implementation-first. You will not just learn what a technique does, you will write the code that does it. Every tool and framework you use during the training is something you build yourself, and you leave with the full source code.

The training maps every technique to the MITRE ATT&CK framework, so every attack you build comes with the context of where it fits in a real campaign and how defenders can detect it. This is an offensive course taught with a defensive mindset.