Training Objectives

With the increase in Ransomware attacks, fortune companies, and business critical companies have overlooked security controls placement and configuration. This training helps enhance the visibility of Enterprise Based Security Controls.

This training focuses on the tactics, techniques, procedures, and tools of Threat Groups - how stealthily they operate, and how they circumvent the security mechanisms employed in a patched & monitored environment.

Training level: Intermediate; Advanced

Training Outlines

Full Course Abstract :

Day 1 (Red Team Resource Development)

Security Controls
Resource Development
C2 & Server-less Re-director Setup (AWS / Azure)
Working Initial Access Attack Vectors
Bypassing Initial Security Controls (Proxy, DNS, Sandbox)
.NET <3 Serialization with Initial Access TTP [1 Exercise]
End-Point Defender Features (AMSI, CLM, UAC, Applocker, WDAC, WDAG, WDEG (ASR))

Day 2 (Tradecraft Development for Offensive Operations)

APT29 Initial Access [1 Exercise]
CSharp Essentials [4 Hands-on Labs]
Offensive C# Trade-Craft [3 Hands-on Labs]
Windows API Essentials
Utilizing Windows API for Red Team Profit [3 Hands-on Lab]

Day 3 (Utilizing Tradecraft for Red Teaming in Hardened Environment)

AMSI, CLM, ASR Rules
File-less UAC Bypass
Application Whitelisting: Applocker, WDAC
Abusing Windows Features
Introduction to Telemetry Collection
ETW & EDR's
General Evasion Areas [4 Exercises]
Native APIs
Unhooking by Patching
DLL Unhooking
Direct Syscalls
Challenge Lab Scope of Engagement [SOE]

What to Bring?

A system with at least 16GB RAM having a VMWare workstation installed
Attacker Linux Box [Parrot] With Internet Connectivity

(Team will share updated documentation 2 weeks prior to the training date.)

Training Prerequisite

Comfortable with command line environment
Fair knowledge of Penetration Testing Methodology

Who Should Attend?

Penetration Testers / Red Teams
System Administrators
Malware Developers
SOC analysts
Threat Hunting Team
Last but not least, anyone who is interested in strengthening their offensive and detection capabilities

What to Expect?

With the increase in Ransomware attacks, it is widely known that Fortune companies, as well as business critical companies, have overlooked security controls in their placement and configuration. This training helps in enhancing the visibility of Enterprise Based Security Controls in the organization.
Training will brief on the tactics, techniques, procedures, and tools of Threat Groups like how stealthily they operate. OR How they circumvent the security mechanisms employed in a patched & monitored environment.
Candidates will get enhanced threat visibility capabilities in both Host & Network-level on Windows, and Linux Environments.
Candidates will learn effective ways to get initial access & ways to circumvent security controls

What attendees will get

Virtual machine infrastructure provided by trainers, all course material including commands, slides, and enterprise lab walk-through, 10 days full challenge lab access with technical support during and after the training class.
Upon completion of Challenge Lab, Candidates will earn CyberWarFare Labs Digital Badge as well.

What not to expect?

0 Day Exploit or vulnerability disclosure

TRAINING