GIAC Red Team Professional

Infrastructure is what lets an operation last. You build and manage adversary infrastructure, including domains, DNS, redirection and pivoting, designed to resemble real infrastructure and to survive scrutiny.

• Domain acquisition and categorization
• DNS configuration for operational infrastructure
• Redirectors and traffic filtering
• Pivoting infrastructure through multiple hops
• Operational security for infrastructure
• Tearing down infrastructure safely after use

You build A staged attack infrastructure with domains, redirectors and DNS, documented for reuse.

C2 is the backbone that keeps an operation connected. You study deployment patterns, use cases and channels, and work with frameworks including Empire and Cobalt Strike to run realistic command and control.

• C2 deployment patterns and use cases
• Channel types and their detection trade-offs
• Empire: setup and operational use
• Cobalt Strike: setup and operational use
• Profiles and malleable configuration
• Choosing a framework for the engagement’s goals

You build A configured C2 deployment using one framework, with a profile tailored to the engagement.

Access has to be earned the way a real adversary earns it. You research the target, build and test a payload that fits the pretext, and deliver it in a way that matches the threat being emulated.

• Target research for a credible pretext
• Payload design and testing before delivery
• Delivery mechanisms and their trade-offs
• Avoiding detection during delivery
• Confirming successful access
• Documenting the access vector for the report

You build A tested payload and delivery plan matched to a chosen pretext, with a confirmed access result.

Once inside, an operator needs to see the terrain. You perform network and Active Directory discovery and enumeration, and acquire the credentials available in the target environment without raising alarms.

• Network discovery from a compromised host
• Active Directory enumeration techniques
• Credential discovery on hosts and in shares
• Low-noise enumeration practices
• Mapping the environment as you learn it
• Deciding what to enumerate next

You build An environment map built from discovery and enumeration, with credentials catalogued.

Active Directory is usually the fastest way to broad access. You study AD objects, the authentication methods used in AD environments, and the techniques for attacking them to move from a foothold toward domain control.

• AD objects, trusts and group structures
• Authentication methods in AD environments
• Common attack techniques against AD
• Finding and exploiting misconfigurations
• Avoiding techniques that are easily detected
• Recording the AD attack path

You build A documented Active Directory attack path from initial foothold to elevated access.

Escalation is rarely one technique repeated. You identify the privileges present in an environment and escalate them to meet objectives, including Linux-specific attacks and remote privilege reconnaissance.

• Enumerating privileges on Windows and Linux hosts
• Local privilege escalation techniques
• Linux-specific escalation attacks
• Remote privilege reconnaissance
• Escalating through service and configuration flaws
• Choosing escalation paths that fit the objective

You build A privilege escalation chain across a mixed Windows and Linux environment, with each step justified.

Access only matters if it moves the engagement toward its goal. You move through the target environment, using domain access to reach the systems and data the engagement was designed to reach.

• Translating domain access into objective access
• Lateral movement patterns within a domain
• Identifying systems that hold the objective
• Staying aligned with the engagement’s scope
• Coordinating movement with the rest of the team
• Recording the path to the objective

You build A movement plan and record that uses domain access to reach a defined engagement objective.

Red teams show what a patient adversary could sustain. You establish persistence and use it to reach objectives such as database access, stage data for exfiltration, and emulate ransomware to demonstrate impact.

• Persistence techniques appropriate to the engagement
• Reaching database and application access through persistence
• Staging data for exfiltration
• Exfiltration channels and their detectability
• Emulating ransomware behavior to show impact
• Cleaning up persistence mechanisms after the engagement

You build A persistence and staged-exfiltration exercise, including a ransomware emulation that demonstrates impact without causing damage.

An engagement closes with a report someone can act on. You consolidate data from the whole operation, write the engagement report, and work with the client to decide what warrants a retest.

• Consolidating data from a long engagement
• Writing findings that map to the adversary emulated
• Separating technical detail from executive summary
• Recommending remediation by root cause
• Deciding what to retest and when
• Closing out infrastructure and access

You build A consolidated red team engagement report with findings, recommendations and a retest plan.

Run a complete emulation against a lab environment. You plan against a chosen adversary, build infrastructure, gain access, move through the domain, persist and exfiltrate, then report what the engagement showed.

• Planning against a chosen adversary
• Building infrastructure and gaining access
• Discovery, domain attacks and privilege escalation
• Persistence and exfiltration staging
• Reporting and retest planning

You build A full red team engagement report for a lab environment, from planning to retest decision.