Red Team Assessments
A focused red-team program for understanding enterprise attack paths, Active Directory weaknesses, initial access methodology, command-and-control planning, and practical assessment execution.
Red Team Assessments training.
Red Team Assessments addresses the gap many teams face around Active Directory and enterprise security. The course is shaped around practical scenarios, poor implementations, complex policy environments, and the operational thinking needed to assess organizations beyond checklist-style testing.
Active Directory attack paths, initial access, command-and-control, domain boundaries, and red-team execution methodology.
The page gives learners a concise executive overview first, then separates detailed coverage and expected outcomes for easier course evaluation.
What the course focuses on.
Each area is presented as part of a practical security workflow, with emphasis on evidence, validation, and professional communication.
Active Directory Foundations
Domain implementation, Kerberos and NTLM behavior, ACLs, sensitive groups, trust boundaries, and enterprise control models.
Initial Access
Practical hacking methodology, exploitation workflow, entry-point validation, and assessment planning around realistic access paths.
Command and Control
C2 concepts, Cobalt Strike and Sliver workflows, redirectors, domain fronting, and profile design considerations.
AD Pentesting
Lab design, attack-path discovery, lateral movement concepts, privilege escalation, and practical enterprise validation.
MITRE Mapping
MITRE ATT&CK context for red-team planning, execution notes, evidence structure, and defender communication.
Operational Reporting
Clear documentation of assumptions, tradecraft, evidence, impact, detection notes, and remediation priorities.
Training modules.
The syllabus below follows the original Codefensive public course outline for this training.
Active Directory Pentesting Foundations
- Active Directory Implementation Overview
- Kerberos and NTLM authentication procedure
- Domain ACL and Sensitive groups overview
- Understanding Domain Trusts and boundaries
- Designing Active Directory Pentesting Lab for Pentesting
- MITRE AT & CT Framework for Pentesters
- Understanding the C & C for active directory pentesting
- Comparison matrix of C2 servers
- Cobalt strike and Sliver-c2 framework
- Designing domain fronting and redirectors
- Designing C2 profiles to avoid detections
Initial Access Methodologies and Exploitation
- Enumerating the organisation for initial access overview
- Common public services insecurities
- OSINT Primer for AD Pentesting
- Windows API Overview
- Process, threads, DLLs, Virtual memory
- Creating payloads with windows API
- Understanding the detection engineering and endpoint detections
- Static and Dynamic analysis to bypass AV
- Understanding the EDR and detections
- Offensive VBA for pentesters
- Developing malicious Doc for initial access
- Stomping the malicious Documents
- Crafting malware with JScript
- Designing a spear phishing campaign for red team engagements
Privilege Escalation and Finding Common Issues
- Automated enumeration of vulnerabilities
- Windows privilege escalation attacks
- Services exploitation
- Credential theft
- Bypassing LSASS protections
- UAC bypassing
- Token impersonation
- Password Spraying attacks
- Pass the hash attacks
- RDP access with Pass the hash
- Accessing LAPS
- Misconfigured Sysvol policies
- Brute forcing hashes
In-Memory Executions and PowerShell Primer
- Basics of PowerShell cmdlets
- File transfer with PowerShell
- WMI and Powershell remoting
- PowerShell Reverse shell and payloads
- Payload execution on the fly
- Fileless attacks process and lifecycle
- Reflective DLL loader with PowerShell
- Obfuscation with PowerShell
- Disabling defences and adding exclusions with PowerShell
- Bypassing Restricted Admin mode
- Understanding the AMSI service
- Bypassing AMSI protections
- Understating In-memory executions
- Executing executable assemblies in memory
- Enumerating users ,computer and groups
- GPO , OU and ACL enumerations
- Automating Domain enumeration with the bloodhound
Active Directory Attacks
- Understanding the Application whitelisting
- Bypassing the Powershell execution restrictions
- Restricting executions with Applocker policies
- Default policies and Custom policies
- Bypassing the app locker policies with common whitelisted locations
- Bypassing CLM with the living off the lands techniques
- Understanding Delegations
- Attacking Unconstraint delegations
- Attacking Constraint delegations
- Attacking Service Principal Names
- Attacking service accounts
- Targeted Kerberosting attacks
- Kerberos double Hope Issues
- Attacking certificate services
- Persistence via certificate services
Advanced Active Directory Attacks
- Distributed COM Model issues
- Pass the ticket and overpass the hash attacks
- Domain certificate service attacks
- NTLM Relay Attacks
- Attacking via sensitive groups to become domain administrator
- Exploiting ACLs in AD
- Understanding domain persistence
- Dcsync attack
- DSRM and DCshadow attacks
- ADCS attacks
- Silver ticket attack
- Golden ticket attack
- Zerologon attack
- Defensive primer for security engineers
- The Principle of (Endpoint) Least Privilege and Just Enough Administration
- Principal of Documenting and monitoring the data.
After this course, learners should be able to:
- Understand enterprise AD attack surface and trust relationships.
- Build assessment plans around realistic initial access and C2 assumptions.
- Map offensive activity to ATT&CK and communicate detection opportunities.
- Document findings in a professional red-team assessment format.
Best suited for:
- red team operators
- Active Directory penetration testers
- security engineers responsible for enterprise hardening
- consultants moving from pentest work into red-team assessments
Built for professional learning.
Training is structured around readable theory, guided walkthrough context, exercises, knowledge checks, and practical decision-making.
Plan enrollment or team delivery.
Contact Codefensive Academy for course access, business training, or help selecting the right path.
