Training Objectives

Most enterprises deal with misconfigured security controls in their infrastructure. It is well known that attackers have evaded, circumvented, and even abused these controls with the intention to gain access to critical assets. The training is designed for red teams, penetration testers, system administrators, and Blue Team members to understand different tactics, techniques, and attacks used by adversaries. The major portion includes identifying misconfigurations in controls, developing offensive trade-craft & then stealthily evading it following the latest attack vectors.

Candidates will gain enough knowledge of the enterprise-grade security controls and how they can be evaded in Host, Network, and Cloud synced devices. The class will go through various security controls, writing custom scripts in C#, abusing windows internals/features and monitoring solutions, writing custom bypasses for evading host, network, and cloud security (EDR) controls and bypassing cross-forest restrictions in Active Directory Environment, etc. Training is focused on Windows & Linux platforms in order to better refine detection in an enterprise.

Training level: Intermediate; Basic

Training Preview

Apex Threat Actors having advanced capabilities like leveraging in-memory implants, writing custom codes to evade AVs & EDR, moving laterally with custom made Tools, evading host and network-level security solutions for stealthiness, etc are constantly consolidating their attack techniques (and Tactics) against Defensive Teams. To strengthen enterprise-grade security, the training is designed for penetration testers, system administrators, and Blue Team members to understand different tactics, techniques, and attacks used by adversaries.

Training Outline

Day 1 (Introduction to Enterprise Security Controls)

• Anti-Virus
• End-Point Detection and Response (EDR)
• End-Point Defender Features (AMSI, CLM, UAC, Applocker, WDAC, WDAG, WDEG (ASR), Sandbox)
• Directory-Level Controls (JEA, JIT, PAW, PAM, Credential Guard, Remote Credential Guard, GPO, LAPS, Constrained Delegation, Resource-Based Constrained Delegation, etc)
• Linux Environment (AppArmor, SELinux)
• EDR, XDR Demonstration

Day 2 (Offensive C# Tradecraft, Windows API & Bypasses)

• CSharp Essentials
• CSharp Beginner [10 Hands-on Labs]
• Offensive C# Trade-Craft [6 Hands-on Labs]
• Windows API Essentials
• Utilizing Windows API for Red Team Profit [9 Hands-on Lab]
• AMSI, CLM, Script Block Logging, ASR Rules, UAC Bypass
• Application Whitelisting: Applocker, WDAC

Day 3 (Abusing / Evading Security Controls - Feature Abuse)

• Abusing Windows Features (PowerShell, LOLBAS, Sandbox, WSL)
• Constrained Delegation & Resource-based constrained delegation
• SCCM & SCOM Abuse
• GPO Abuse
• Bypassing Credential Guard
• Credential Access in Windows & Linux
• Cross Forest Abuse Scenarios [5 Different Techniques]
• Bypassing Enterprise Endpoint Detection & Response Solutions in Real-Time