Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Red Team Operations: Practical Adversary Emulation

Name: Red Team Operations: Practical Adversary Emulation
Rating: 4.6 (26 reviews)

Execute a full-scope Red Team adversary emulation using modern C2, Active Directory attacks, and real tradecraft.

Created byUday Mittal

Last updated 7/2026

English

What you'll learn

Execute a full-scope adversary emulation exercise against a simulated FinTech target network.
Map real-world threat actor behaviors and TTPs using the MITRE ATT&CK framework.
Navigate the complete Red Team Operations Attack Lifecycle from initial access to exfiltration.
Leverage active and passive OSINT techniques to map out target infrastructure.
Craft and execute highly targeted employee phishing campaigns to bypass perimeter defenses.
Weaponize exploits and deliver payloads to gain an initial foothold into the network.
Bypass perimeter defenses using targeted employee phishing and custom password brute-forcing.
Escalate privileges across both Windows and Linux enterprise systems.
Exploit Active Directory environments and map complex attack paths using BloodHound.
Deploy PoshC2 to establish covert command and control (C2) and maintain persistence.
Translate technical exploitation into actionable engagement reports for management and Blue Teams.
Practice in a self-hosted, cloud lab environment.

Course content

21 sections • 90 lectures • 4h 44m total length

Course Introduction3:14
Introduce learners to adversary emulation by simulating a fintech startup breach, covering active and passive information gathering, gaining a foothold, privilege escalation, and persistence via command-and-control software.
What is Adversary Emulation?0:48
Red Teaming vs Adversary Emulation1:41
Compare red teaming with adversary emulation to show how offensive security assessments reveal weaknesses, test defenses, and simulate incident response with scenarios like ransomware and data theft.
Who are we going to breach?3:31
Explore a fictional startup Tax Labs and its investors' security concerns through an adversary evolution exercise that uses a replica environment with test data to probe the platform.
Attack Methodology & Attack Path3:07
Explore an adversary attack methodology based on the red team operation cycle, starting with zero-knowledge reconnaissance, then initial compromise, persistence, internal recon, and exfiltration.
Introduction to MITRE ATT&CK framework1:25
Summary0:55
Compare reteaming and adversary in relation as red engagements focused on a single scenario; That First Labs, a fintech startup, hires a red team to run a zero-knowledge adversary emulation.
Resources0:01

Overview0:46
Set up the attack machine with essential tools and discuss making those tools accessible via a web server to the target network, and establish a centralized note-taking environment with CherryTree.
Setting up Kali Linux4:56
Set up a kali linux attack machine by downloading a 64-bit vmware image, installing sublime text, and creating scripted logs and folders to record commands during the exercise.
Install / Download Tools8:42
Install and download a suite of adversary emulation tools—mentalist, begats, bloodhound, jawboned, ganon, porche c2—via an automated script, then configure bloodhound and new 4g.
Setup the web server to make tools accessible from the target network3:17
Set up a web server to host tools by copying them to the webroot, adjust ownership and permissions, start the server when needed, and verify access via localhost.
Setup the note taking environment using Cherry Tree2:17
Set up a note taking environment using Cherry Tree, a free, hierarchical note taking application, to store phase information from red team operations and organize subnodes for each site.
Summary0:26
Set up an attack environment by configuring a Linux machine, creating folders, and enabling scripting. Install tools for the exercise and create a node picking environment to centralize collected data.

Red Team Adversary Emulation Lab Access (Tax First Labz)4:53
Learn to self-host the red team lab for adversary emulation by completing eligibility forms, joining the Discord server, provisioning an AWS IAM account with minimal permissions, and understanding hosting costs.
Fetching AWS Account ID0:42
Learn how to fetch your account ID from the IWC management console, copy or paste it into lab prerequisites, and handle hyphenated formats.
Creating AWS IAM Account3:52
Create an AWS IAM user to host Tax First Labs red team network, attach full access, CloudWatch, and EC2 full access policies, and generate an access key and secret key.
Subscribing to Apache Guacamole AMI1:19
Subscribe to the Apache Guacamole AMI from the AMA page, using the account you will use to self-host the from network, and set the prerequisite form answer to yes.
Lab Management via AKSH16:00
learn to manage a self-hosted ex-First Labs 30-minute network using the action Discord bot, deploying, configuring credentials, starting and stopping machines, and monitoring lab status.

Overview0:38
Analyze a website to identify its technology stack with red dot com, use tech-specific tools to prepare a report, and inspect the web server for accessible files.
Recon (OSINT)6:53
Perform OSINT recon on a target organization by examining the website, social profiles, and technology stack, identifying potential exploits from outdated WordPress plugins and exposed contact details.
Recon (Dirbuster)3:42
Perform a DirBuster reconnaissance to enumerate server files using a default wordlist, reveal exposed resources such as Outlook Web Access, and assess foothold potential.
Summary1:13
Perform open-source intelligence on a target organization using tools like moved with dot com, WP scan, and eye buster to uncover Lingnan data, three users, and exposed outlook web access.

Overview0:30
Utilize recon insights to identify a vulnerability in the taxpayers lab's website and establish an initial foothold, returning to the attacker machine for the next phase.
Gaining foothold6:04
Identify vulnerable WordPress plugins via scan and exploit unauthenticated file upload to gain remote code execution; demonstrate uploading a reverse shell to compromise a web server.
Summary1:06
Analyze how an unauthenticated vulnerability yielded a foothold and limited shell on a target website, then use an uploaded file to gain remote shell access in a simulated breach.

Overview0:23
Build on the initial foothold in the target network by compromising S01 01 Ripsaw One, which hosts the first lab's website, and escalate from the compromised machine to root.
Privilege Escalation Recon2:42
Perform basic information gathering on the attack machine, identifying hostname, current user, IP address, and operating system details, then assess kernel vulnerabilities for privilege escalation via available exploits.
Dirty Cow Exploit 1011:03
Examine the dirty cow exploit and how a malicious binary, run by any user, can override NATO protections and escalate privileges on a compromised machine.
Escalating Privileges3:00
Explore how an attacker escalates privileges by deploying a 64-bit exploit, replacing the user password, compiling and running as root, and disabling cache write-backs to seize control of a server.
Summary1:37
Explore a web server breach on the first labs network, perform recon insight attacks and privilege escalation using an old Linux kernel, and practice automation with a Linux machine script.

Overview0:39
Explore how adversaries maintain access after losing initial entry by using persistence and command-and-control techniques to re-enter networks and add a local user on a web server.
Establishing persistence via PoshC26:27
Execute persistence techniques using posh c2 to deploy a command-and-control agent, create a new user, configure the server, and interact with compromised machines.
The Three Command and Control Tiers1:18
Summary0:44
Establish persistence on the target server using Poche Command and Control Center software. Add a local user on the target web server to enable future module tools and seamless interaction.

Overview0:24
Learn to download a binary on a compromised web server and use it to discover live hosts and what's available on those hosts.
Internal Recon (Host Discovery and Port Scanning)5:25
Map the target network to discover live hosts and scan ports through internal reconnaissance, identifying a domain controller, exchange server, and user workstations.
Summary1:10
Identify three hosts and a domain controller from internal recon, then download and map the static binary on compromised server with nmap to discover live hosts and their open ports.

Overview0:28
Explore how to analyze gathered information from conferences to identify an exploit vector in a vehicle network and move it in the network to compromise another machine.
Generating custom username and password lists8:57
Generate custom username and password lists to brute-force the Outlook Web App, using patterns like first name plus last name or initials, and month, season, and object-based passwords.
Brute-forcing Outlook Web App3:54
Emulate a real-world cyber attack by brute-forcing the Outlook Web App with an auxiliary scanner to test logins and reveal a credential, then explore a phishing vector for payload delivery.
Phishing an employee (Social Engineering)7:51
Summary1:43
attackers partially compromise Mukherjee by forcing credentials and phish Pavlin to access the machine, then use password lists and brute-force login to deploy a malicious payload.

Overview0:35
This lecture demonstrates privileged escalation on a compromised machine using Ballot Up, a power script to identify Windows services and escalate privileges.
Privilege Escalation Recon using PowerUp2:37
Load power up into the target machine's memory using IEX, then enumerate vulnerable services to identify restart rights and manually generate a malicious binary for exploitation.
Unquoted Service Path Vulnerability 1011:03
Learn how unquoted service path vulnerabilities in Windows enable attackers with service control rights to trigger a malicious executable by writing to the service path.
Checking Permissions4:12
Explore how an attacker assesses folder permissions using icacls, identifies write access for authenticated users, and backs up a service file before replacing it with a malicious variant.
Escalating Privileges6:45
Explore adversary emulation techniques by using venom to generate payloads, deploy a malicious binary on a target Windows system, and escalate privileges to administrator.
Establishing persistence via PoshC23:20
Examine how adversaries establish persistence with poshC2 and escalate privileges to administrator, then deploy a command-and-control agent using a C# drop payload.
Summary1:30
Trace the attack path as we escalate privileges on a compromised machine, gaining access to services and domain, then enumerate the network with PowerUp scripts to deploy a malicious binary.

Requirements

Familiarity with basic Kali Linux terminal navigation and commands.
Familiarity with running basic scripts in Windows PowerShell (no advanced scripting required).
A fundamental understanding of networking concepts (IP addresses, subnets, ports).
No prior experience in exploit development or advanced malware writing is required.

Description

Welcome to a simulated live Red Team Operation.

You aren't just learning isolated tools—you are stepping into a live Adversary Emulation exercise. Hired by a FinTech startup, your objective is strictly defined: assuming zero prior knowledge of the target network, you must mimic a real-world cyber attack and successfully exfiltrate customer data before actual threat actors do.

Forget academic fluff. This is a practical, low-drag engagement that follows the professional Red Team Operations Attack Lifecycle. Instead of a disjointed list of exploits, we build a cohesive attack path step-by-step, executed in a safe, local lab environment so you can practice without expensive cloud overhead.

We will cover the installation and tactical deployment of industry-standard tools like PoshC2, BloodHound, Mimikatz, Metasploit, and PowerUp, mapping our techniques across the attack phases:

Recon & Initial Access: Active and passive information gathering, weaponizing exploits, and executing targeted employee phishing.
Execution & Escalation: Bypassing defenses and escalating privileges across both Linux and Windows systems (utilizing icacls and PowerShell).
Discovery & Lateral Movement: Automated Active Directory domain enumeration, password brute-forcing with custom lists (Mentalist), and executing modern AD attacks.
Command & Control (C2): Establishing covert persistence and managing infrastructure.
Action on Objectives: Completing the mission and preparing an actionable engagement report for the organization's management.

Who this course is for:

Beginners in Offensive Security: If you are just starting your career or preparing for penetration testing exams, this beginner-friendly course provides a clear introduction to real-world attack paths.
Blue Teamers & SOC Analysts: To catch an attacker, you need to understand their methodology. Witnessing a live emulation exercise provides invaluable perspective on how adversaries string techniques together.
Current Pentesters: If you already know individual exploits, this exercise connects the dots, showing how isolated vulnerabilities are chained into a full-scope campaign.

This is a beginner friendly course. If you have just started your career in offensive cybersecurity or are preparing for penetration testing exams then this course is for you. If you are interested in witnessing a live adversary emulation exercise, please feel free to follow along.

Who this course is for:

Beginners in offensive security seeking a practical, step-by-step introduction to real-world attack paths.
Penetration testers looking to transition from isolated vulnerability scanning to full-scope adversary emulation.
SOC Analysts, Incident Responders, and Threat Hunters wanting to witness attacker methodology to build better detections.
Cybersecurity students preparing for practical Red Team and advanced penetration testing certifications.
Security Managers needing to understand exactly how threat actors actively compromise and navigate enterprise networks.

Red Team Operations: Practical Adversary Emulation

What you'll learn

Explore related topics

Course content

Introduction8 lectures • 15min

Setting up the attacker machine and tools6 lectures • 20min

Lab Setup5 lectures • 27min

Recon4 lectures • 12min

Initial compromise3 lectures • 8min

Escalate Privileges5 lectures • 9min

Persistence4 lectures • 9min

Internal Recon3 lectures • 7min

Lateral Movement5 lectures • 23min

Lateral Movement – Privilege Escalation7 lectures • 20min

Requirements

Description

Who this course is for: