Course overview
This course will train your already inquisitive mind how to emulate real world threat actors. It’s fast paced and it’s intense. You will be exposed to an in-depth methodology suitable for operating as a top tier professional red teamer. You will learn not only advanced tactics, techniques, and procedures (TTPs), but also how to run a successful engagement from start to finish, with a focus on operational security and sound risk management.
Our instructors are world class red teamers who spend most of their time on multi month engagements compromising central banks, government, critical national infrastructure, and more.
October 2024
- 22 – 25 October, 2024
- Live Online (BST)
What you will learn
The tactics, techniques and procedures taught in this course are constantly updated and adapted to keep up to date with the latest techniques used by known threat actors in the wild. The latest TTPs used by real-world threat actors will be demonstrated on a practical level. This includes stealthily bypassing defensive security controls (e.g. common EDR and next-gen AV products), which are typically operating within modern enterprise environments, as well as the pitfalls and lessons learned through many engagements and built-up experience across our own red team. The instructors will impart knowledge from the field including wins, losses, improvements, optimizations, and most importantly operational security.
The course includes both a theory element as well as hands on practical exercises, where the techniques learned can be practiced in a lab environment specifically designed to replicate a typical corporate network. While the course focuses heavily on the latest offensive techniques used by a red team, it also covers common defensive techniques that are deployed by the blue team, such as host-based event logging and monitoring, strict egress filtering, application whitelisting and various other endpoint protections.
You’ll be with our expert red team instructors for four days. This is broken down into three days of teaching, with four structured sessions per day mixed with multiple labs and demos after each session. Below you will find an overview of the course, with some highlights detailed for each session. The final day concludes the training and allows you to bring all your accumulated knowledge to the test, as we tackle a real-world assault course.
Day 1
Session 1
Introduction / C2 Proxy and Supporting Infrastructure Setup
- Cyber Kill Chain, Scoping & Pre-Engagement, Legal & Ethics, Reconnaissance & OSINT, Threat Intelligence
- C2 architecture, Rewrite Rules, Controlling Traffic and User Behaviour & Red Team Monitoring
Session 2
Domain Fronting and Proxy Reputation
- Purchasing collateral, Staying Anonymous, Fronting and Domain Reputation
- Certificates, Phishing, Email Security, Information Leakage and Burners
Session 3
C2 Communications / Implant Configurations
- C2 communication, C2 safety and Operational security
- Inner Workings of an Implant, Security Bypasses and Defensive Considerations (AMSI, ETW, Hooking etc)
Session 4
C2 Frameworks & Introduction to PoshC2
- Overview of many C2 Frameworks
- Introduction to PoshC2
Day 2
Session 1
Weaponization
- Weaponization Handlers, Macro Embedded Office Documents / Excel4.0 SLK, OLE (Office 2013 / Office 2016+)
- Windows Script Hosting (JS&HTA), ClickOnce / Java applets and Document and Application Signing
Session 2
Download Cradles
- Downloaders, One Liners and Code snippets
Session 3
Execution
- Bypassing Whitelisting, Custom C++/C# Droppers and AMSI/ETW Bypass Techniques
Session 4
Mac OS X Execution & Delivery
- Phishing, Social Engineering, USB, Network Devices & Physical
- Delivery Evasion (HTML smuggling), Delivery Tracking and Live Experiences
Day 3
Session 1
Situational Awareness & Persistence
-
Understanding your Environment, Finding hidden defensive products
-
Laying Persistence, Advanced Persistence & Custom Droppers
Session 2
Privilege Escalation / Active Directory Attacks
-
Host Based Attacks, Elevating Privileges, Network Attacks
-
Active Directory Attack (Kerb / Deleg etc), ACL Abuse Common Vulnerabilities
Session 3
Active Directory Trusts / Cloud Tenancy and Lateral Movement
-
Understanding Trusts, Attacking Trusts and Hybrid Cloud Environment
-
Common Lateral Movement Techniques, Stealth and Advanced Methods
Session 4
Database Intrusion / Memory Abuse
-
Attacking Databases, Common Weaknesses and Interacting through C2
-
Stealing Data from Memory and other Commonly Found Memory Artefacts
Day 4
Assault course
The training lab is built with realistic defensive security controls and countermeasures deployed, which will require you to use your newly acquired skills to bypass them.
The aim of the assault course is to run a red team engagement with the objective of penetrating the BLOREBANK network, including its defenses, via phishing. Then, you will abuse typical weaknesses, such as those highlighted throughout the course, with the ultimate objective of gaining access to a critical non-domain joined and segregated database server, to retrieve credit card information.
Key objectives
-
Perform a simulated phishing attack against a typical corporate environment with standard defenses, such as EDR (Microsoft Defender and Kaspersky), mail filtering and AppLocker restrictions, using the knowledge you have gained through the course to obtain a foothold.
-
Perform situational awareness and lay persistence to secure your initial foothold. Users are simulated and may reboot their workstations from time to time to ensure they have the latest updates.
-
Perform reconnaissance against a multi-domain environment and attempt to enumerate Active Directory and find any vulnerabilities that may exist within the environment, keeping opsec in mind at all times.
-
Attempt privilege escalation on-host and against the environment using your C2 framework of choice and aim to perform multi-layered network pivoting to access multiple targets in a highly monitored network.
-
Enumerate the target objective and attempt to compromise the critical system in scope for the red team. This will include multiple levels of privilege escalation and lateral movement in order to gain access to the objective system.
How is the training conducted?
This training is currently conducted remotely utilising cloud based infrastructure to support the deployment of a complex and realistic lab environment. The course comprises of a fast paced and comprehensive syllabus delivered by multiple instructors and supported by many labs that will build on each phase of a red team engagement, from preparation to execution.
Each student will be presented with a copy of the training materials, lab guides and scripts. The training sessions will be conducted over Microsoft Teams while utilising Slack for comms, questions, polls, and chatting – before, during and after the training.
Prerequisites
The following are prerequisites for the course:
- Stable internet access (Your internet connection should ideally be over 5Mb download speed).
- Outbound SSH (TCP/22) and RDP Access (TCP/3389).
You must have administrative rights over your laptop in order to install any software that may be required, e.g. putty or an RDP client. You should have a webcam and microphone; we will use audio dial in via MS Teams and group participation is encouraged. You must have working speakers so that you can hear the instructor.
Frequently Asked Questions (FAQs)
Can I contact you before the start date to check I have all the prerequisites in place?
Yes of course. Please direct all enquiries to labs@nettitude.com and include the word ‘training’ in the subject field.
Will I receive a copy of the slides and handouts for the course?
There is a watermarked PDF provided with every purchase of the course that will be electronically delivered before thew course starts. Each PDF handbook will be watermarked with the delegate’s full name and email address.
How do I access the labs for this course?
The labs for this course are all hosted online and will be accessible from any unfiltered internet connection. You will each be provided with your own Virtual Private Servers (VPS) in the cloud to perform the exercises and corresponding final labs (1 x Windows and 1 x Linux).
Will the labs be online after the course has finished?
The labs will only be available for the duration of the course and then they will be shutdown.
Can I use my own C2 framework for the labs?
This course is C2 framework agnostic and it’s possible to use any tool that you wish to undertake the challenges and exercises. However, if the C2 framework is not known to the trainers they may not be able to provide support for the labs. The most common frameworks used for this training are PoshC2, Cobalt Strike, Empire & Covenant.
What software do I need for this course?
Please see the prerequisites above for more information. For any additional enquiries please contact us via labs@nettitude.com and include the word ‘training’ in the subject field.
Will we get a certificate of completion at the end of this course?
We will send a digital certificate to all delegates who complete the training course.
Is there a minimum number of delegates required in order for this course to go ahead?
Yes. It’s rare that we have low numbers, but if they’re exceptionally low, we will cancel. In this unlikely event, we will let you know as far in advance as possible and we will offer you a full refund or a seat on a future course, at your discretion.
The training team provided unprecedented access to lessons from the front line that cannot be extracted from books, blogs and training materials or other courses.”
“Great course content delivered by extremely knowledgeable red teamers. The practical lab was a great environment where newly learned techniques can be applied”
Offers excellent value for penetration testing consultants. It taught real-world effective simulated attack strategies, tools and techniques which I now use to conduct simulated attacks against our clients”
