Become a Partner
Add OffSec to your list of training providers
Partner with us
OffSec Wins Seven Global InfoSec Awards during RSA Conference 2024
Read blogSharpen your Red Team skills: Outsmart detection
OffSec Learning Path: Red Teaming
Go beyond penetration testing: learn advanced techniques to emulate real-world adversaries. Master event tracing, obscure Windows event logs, and execute stealthy process injection to refine your Red Team arsenal. Learners will:
Embrace the adversary mindset and master Red Teaming concepts to emulate shrewd threats throughout the attack lifecycle
Obscure malicious activity by manipulating Windows Event Tracing
Develop robust Red Team tooling for evading detection
Enhance your Red Team operations
This Learning Path equips you with the knowledge to conduct sophisticated Red Team engagements. Understand the core differences between penetration testing and Red Team operations, then learn stealthy attack techniques like impairing Event Tracing for Windows (ETW), tampering with event logs, and executing process injection to effectively simulate real-world adversaries and assess your organization's detection capabilities and defense gaps.
Who is this Learning Path for?
- Red Team operators seeking to refine their evasion skills
- Penetration testers aiming to transition into Red Team roles
- Security professionals looking to simulate real-world adversary techniques
Learning objectives
- Understand core Red Teaming concepts and methodologies
- Learn the inner workings of Event Tracing for Windows (ETW) in user and kernel modes
- Learn advanced Windows event log tampering techniques and automate the process
- Develop proficiency in stealthy process injection methods to evade detection
Key modules in the Red Teaming Learning Path
Introduction to Red Teaming
- Introduction to Red Teaming concepts and comparison to Pentesting and Vulnerability assessments
Impairing Event Tracing for Windows (ETW) in User Mode
- Bypassing ETW logging via user mode techniques, while leaving minimal detection footprints
Impairing Event Tracing for Windows (ETW) in Kernel Mode
- Bypassing ETW logging via kernel mode techniques, while leaving minimal detection footprints
Windows Event Log Tampering Techniques
- Discussing and implementing techniques to disrupt the EventLog service or to edit Windows Log files by building tools in C#
Automating Event Log Tampering
- Bundling the techniques introduced in the Module "Windows Event Log Tampering Techniques" into a standalone tool that can be used in real red team assessments to hide the tracks of an operator
Process Injection For Red Teamers
- Performing process injection while evading advanced detection systems such as EDRs
Red Teaming overview
6
modules
50
hours of content (approx.)
77
labs
Earning an OffSec Learning Badge
Showcase your growing Red Team proficiency! Upon completing 80% of the Red Teaming Learning Path, you'll receive an exclusive OffSec badge signifying:
- Red Team expertise: Proven knowledge of stealthy Red Team tactics
- Industry recognition: Adds a powerful OffSec credential to your skillset
- Hands-on skill: Demonstrated ability to execute real-world evasion techniques
Why train your team with OffSec?
Advanced evasion skills
Emulate real-world threats for robust defense testing
Real-world focus
Practical training for obscuring Red Team activity
Ahead of the curve
Learn the latest techniques to bypass security mechanisms
Start learning with OffSec
All
access
Learn
Unlimited
$5799/year*
Unlimited OffSec Learning Library access plus unlimited exam attempts for one year.
Large teams
Learn
Enterprise
Get a quote
Flexible terms and volume discounts available.
Learn Unlimited provides individuals and organizations with unlimited access to the OffSec Learning Library. This includes all courses, content and learning paths. Learners also receive unlimited exam attempts and time in any of our hands-on lab environments.
What’s included
1 year of access to unlimited courses & content
Unlimited exam attempts during your subscription
365 days of lab access
1 year of unlimited access to all fundamental content and OffSec curated Learning Paths
PEN-103 + unlimited KLCP exam attempts
PEN-210 + unlimited OSWP exam attempts
3 downloads of course material
FAQ
- Introduction to Red Teaming
- Impairing Event Tracing for Windows (ETW) in User Mode
- Impairing Event Tracing for Windows (ETW) in Kernel Mode
- Windows Event Log Tampering Techniques
- Automating Event Log Tampering
- Process Injection For Red Teamers
Learners should have completed PEN300 or possess equivalent knowledge before starting this Learning Path.
Learners gain expertise in advanced evasion techniques, including impairing Event Tracing for Windows (ETW), tampering with Windows event logs, and executing stealthy process injection.
Yes! We constantly update our content to reflect the evolving threat landscape, ensuring you learn the most current and effective Red Team techniques.
We emphasize:
- Hands-on, practical exercises to develop real-world skills
- In-depth exploration of evasion techniques used by advanced adversaries
- Offensive mindset cultivation to better simulate genuine threats
Start your journey today
New to cybersecurity want to get educated on fundamental content before signing up?
Check out CyberVersity - our free resource library covering essential cybersecurity topics.
Learn more