SpecterOps - Tradecraft Analysis (VIRTUAL)

May 15th to 18th

Course Abstract

Organizations often make the mistake of trusting default configurations in detection and response products to provide robust protection from even the most sophisticated of attacks. Knowledgeable detection engineers and red team operators know that while there are many effective products, all of them have gaps that can be exploited by a sophisticated adversary. A mature security program must continuously test and enhance product detection configurations to have an effective response capability. Unfortunately, they often run into a number of limitations, primarily in a lack of understanding of the:

  • attack technique itself
  • telemetry used for each detection
  • effectiveness of the detection

The result often leads to blind spots within the detection and response capabilities, ineffective detection strategy, and a false sense of security in the organization’s ability to respond to advanced threat actors. When simulating sophisticated attacks, red team operators need to truly understand how a given technique works, the telemetry/artifacts it generates, and the strategies and biases that a defender might use to detect a technique. How organizations may respond to attackers is crucial in red team attack planning, technique selection, and evasion.

In Adversary Tactics: Tradecraft Analysis, we will present and apply a general tradecraft analysis methodology for offensive TTPs, focused on Windows components. We will discuss Windows attack techniques and learn to deconstruct how they work underneath the hood. For various techniques, we will identify the layers of telemetry sources and learn to understand potential detection choke points. Finally, the course will culminate with students creating their own technique evasion and detection strategy. You will be able to use the knowledge gained to both use your telemetry to create robust detection coverage across your organization, and truly assess the efficacy of that coverage.

Whether you are a red team operator or detection engineer, you will have a comprehensive understanding of several attack chains. Red team operators will learn an approach to analyzing their own tools, a better understanding of which techniques to select to evade detection, and how to better describe to defenders why an evasion was successful. Detection engineers will understand how to craft a strategy to create robust detections and better detect families of attacks.



Understanding Abstraction

  • Attack and Detection Strategies
  • Naive PSExec Overview
  • Tradecraft Analysis Process
  • Capability Identification
  • Capability Deconstruction
  • IPC Mechanisms


Understanding Telemetry

  • Securable Objects
  • Identifying Choke Points
  • Telemetry Source Identification
  • How EDR Tools Work
  • Organic Logging
  • SACLs
  • Function Hooking
  • Kernel Callback Functions
  • ETW


Operationalizing Detection and Evasion Concepts

  • Operationalizing Telemetry
  • Understanding Attacker Controlled Fields
  • Operationalizing Detection Research
  • Operationalizing Evasion Research
  • Understanding the Triage, Investigation, and Remediation Process
  • Evading the Response Process
  • Documentation and Evaluation Metrics
  • Detection Documentation
  • Evasion Documentation

###DAY 4


  • Defensive Capstone
  • Offensive Capstone

Who Should Attend

What You Need


SpecterOps ,

Specific instructors will be determined soon. The SpecterOps team consists of sought-after experts, who bring years of breach assessment (hunt) and red team experience from both commercial and government sectors.

Return to training sessions