Skills

Study notes

• Red Team Engagementslearning

  Core ideas for planning and executing an authorized red-team engagement.

  red-team · adversary-emulation · engagement-planning · threat-intelligence

• Credential Accesslearning

  Windows credential material, Kerberos fundamentals, and authorized-lab techniques for understanding how credentials are stored and reused.

  red-team · crto · credential-access · kerberos · credential-dumping

• User Impersonationlearning

  How Windows logon sessions, access tokens, and cached credential material determine what a Beacon can do as another user.

  red-team · crto · user-impersonation · access-tokens · kerberos · ntlm

• Discoverylearning

  Domain and host discovery through LDAP, efficient query design, BOFHound, BloodHound, and restricted-group analysis.

  red-team · crto · discovery · ldap · bloodhound · bofhound

• Lateral Movementlearning

  Moving from one authorized lab host to another with Cobalt Strike, while choosing the remote execution method, identity context, and evidence carefully.

  red-team · crto · lateral-movement · winrm · psexec · scshell · lolbas

• CRTO: Pivotingstudy

  How to use a Beacon as a network pivot, configure SOCKS clients, and separate connectivity from authentication.

  cybersecurity · crto · pivoting · socks · kerberos

• Kerberos Basics and Unconstrained Delegationlearning

  Kerberos ticket flow and the authorized unconstrained-delegation lab, with ticket identity, prerequisites, OPSEC, and cleanup.

  red-team · crto · kerberos · delegation

• Kerberos - Constrained Delegationlearning

  S4U2proxy first, then S4U2self when protocol transition must supply the front-end ticket; authorized CRTO lab branches and evidence.

  red-team · crto · kerberos · constrained-delegation · s4u

• Kerberos - Service Name Substitutionlearning

  When and why a delegated TIME service ticket can be relabelled for CIFS on the same service-account key, plus the CRTO lab evidence and checks.

  red-team · crto · kerberos · constrained-delegation · s4u

• Kerberos S4U2self Computer Takeoverlearning

  Explains the target-computer-TGT S4U2self path and records the CRTO lab commands, checks, and prerequisites.

  red-team · crto · kerberos · s4u · service-name-substitution · unconstrained-delegation

• Kerberos Resource-Based Constrained Delegationlearning

  Explains how a target resource controls which delegating principals may act for users, and how a verified write right, controlled principal, S4U flow, and cleanup fit together.

  red-team · crto · kerberos · rbcd · s4u

• MSSQL Serverlearning

  Open-book map for MSSQL discovery, authentication, linked servers, SQL-to-Windows boundaries, and local privilege checks.

  red-team · crto · mssql · linked-servers · privilege-escalation

• Domain Dominancelearning

  Separates secret acquisition from ticket use and maps DCSync, Golden, Silver, Diamond, and DPAPI backup-key branches.

  red-team · crto · active-directory · kerberos · domain-dominance

• Active Directory Certificate Services (AD CS)learning

  Study map for certificate authentication and the course's ESC1, ESC2, ESC3, ESC4, ESC8, and Golden Certificate branches.

  red-team · crto · active-directory · adcs · certificates

• Forest and Domain Trustslearning

  Ryan's CRTO notes on trust direction, inter-realm Kerberos, parent-child and inbound/outbound trust labs, with evidence limits and secret handling.

  red-team · crto · active-directory · trusts · authorized-lab

• Malware Essentials for Windows Payloadslearning

  Plain-language models for Windows PE files, memory, tokens, threads, and process-injection families, with CRTO-relevant caveats.

  red-team · windows · malware · pe · process-injection

• CRTO Reportinglearning

  How to turn engagement evidence into accurate business-facing findings, recommendations, and useful out-briefs.

  red-team · crto · reporting · authorized-lab

• AppLocker Policy Enumeration and Bypass Studylearning

  CRTO study notes on reading local and GPO-delivered AppLocker policy, interpreting rule conditions, and assessing lab-specific execution-control gaps.

  red-team · crto · applocker · application-control · authorized-lab

• Cobalt Strike Primerlearning

  A mental model for Cobalt Strike's architecture, listeners, Beacon payloads, staging, and operator interaction.

  cybersecurity · offensive-security · red-team · cobalt-strike · crto

• AV and EDR Defence Evasionlearning

  A practical mental model for understanding how AV and EDR observe payloads, memory, process injection, scripts, and post-exploitation behavior in an authorized lab.

  cybersecurity · offensive-security · red-team · cobalt-strike · crto

• Initial Accesslearning

  CRTO study notes on phishing taxonomies, payloads, triggers, containers, and initial-access delivery methods.

  red-team · crto · initial-access · phishing · payloads · delivery

• Persistencelearning

  CRTO study notes on Windows persistence through autostart locations, logon scripts, PowerShell profiles, scheduled tasks, and COM hijacking.

  red-team · crto · persistence · windows · registry · scheduled-tasks · com

• Post-Exploitationlearning

  A practical model for post-exploitation situational awareness, Beacon execution choices, session passing, collection, and PowerShell execution in an authorized CRTO lab.

  cybersecurity · red-team · crto · post-exploitation

• Privilege Escalationlearning

  A practical model for assessing Windows privilege boundaries and identifying authorized-lab escalation paths through services, execution hijacking, software vulnerabilities, and UAC.

  cybersecurity · red-team · crto · privilege-escalation · windows

• Elevated Persistencelearning

  Persistence techniques that retain elevated access after an initial privilege escalation, with a focus on scheduled tasks, services, and WMI event subscriptions.

  red-team · crto · elevated-persistence · scheduled-tasks · services · wmi