Red Team vs. Blue Team Exercises

Module 1: Red Team and Blue Team Fundamentals

• Red team vs. penetration testing vs. vulnerability assessment
• Blue team: SOC, IR, threat hunting roles
• Purple team collaboration model
• TIBER-EU framework for financial sector
• Building an internal red/blue team capability

Module 2: Red Team Planning and Scoping

• Rules of engagement (ROE)
• Threat intelligence-led red teaming
• Adversary selection: APT emulation
• Red team infrastructure setup: C2, redirectors, domains
• OPSEC planning for red team operations

Module 3: Red Team Initial Access

• Phishing campaigns: GoPhish, Evilginx2
• Malicious macro and document delivery
• Initial access brokers: Concepts
• Watering hole attacks
• Physical access simulation

Module 4: Red Team Post-Exploitation

• C2 frameworks: Cobalt Strike, Havoc, Sliver
• Lateral movement: SMB, WMI, RDP, DCOM
• Credential access: Mimikatz, LSASS dumping
• AD persistence: Golden ticket, skeleton key
• Exfiltration techniques and data staging

Module 5: Blue Team Detection Capabilities

• Building a detection engineering practice
• SIEM rule writing for red team TTPs
• EDR tuning: CrowdStrike, Defender for Endpoint
• Network detection: Zeek, Suricata
• Windows event log analysis for attacks

Module 6: Threat Hunting

• Hypothesis-driven threat hunting
• Threat hunting with Splunk and Elastic
• Hunting with Velociraptor and OSQuery
• IOC-based vs. TTP-based hunting
• Building a threat hunting playbook library

Module 7: Digital Forensics for Blue Teams

• Memory forensics: Volatility 3
• Disk forensics: Autopsy, FTK Imager
• Network forensics: Wireshark, NetworkMiner
• Timeline analysis with Plaso/log2timeline
• Forensic artefacts: Prefetch, registry, LNK files

Module 8: Incident Response

• NIST SP 800-61 IR lifecycle
• Containment strategies: Isolate, block, remediate
• Malware triage: Static and dynamic analysis
• IR communication: Internal and external
• Post-incident review and lessons learned

Module 9: Deception Technologies

• Honeypots: T-Pot, Cowrie, Dionaea
• Honeytokens: Canarytokens, Active Directory honeypots
• Deception in network environments
• Deception data analysis
• Integrating deception with SIEM

Module 10: Purple Team Exercises

• SCYTHE adversary emulation platform
• AttackIQ and Atomic Red Team
• Detection gap analysis and remediation
• Purple team exercise facilitation
• Measuring detection coverage improvement

Module 11: Metrics and Reporting

• Red team report writing: Narrative and technical
• Blue team detection coverage metrics
• Purple team gap analysis report
• Executive briefing on red/blue findings
• Continuous improvement roadmap

Module 12: Capstone Exercise

• 3-day red vs. blue simulation in a dedicated lab
• Red team: Full attack chain from phishing to domain dominance
• Blue team: Detection, response, and containment
• Purple team debrief with ATT&CK coverage mapping
• Certification roadmap: CRTO, BTL1, GCFA, GCIA

Experience in the Industry Learn from offensive and defensive security professionals who have conducted and defended against real red team operations in enterprise environments.

Backgrounds at the Top Our instructors hold CRTO, OSCP, GCIH, and BTL1 certifications, with backgrounds running red team operations and building SOC detection capabilities at enterprise organisations.

Clear & Effective Teaching Each attack technique is paired with corresponding detection and response guidance, giving students an integrated understanding of offensive and defensive security operations.

Hands-On Learning Focus Students participate in a structured red vs. blue simulation, writing detections for each TTP, conducting threat hunts, and performing digital forensics on simulated incidents.

Up-to-Date Knowledge Instructors stay current with MITRE ATT&CK updates, new C2 frameworks, updated SCYTHE and AttackIQ content, and evolving EDR detection capabilities.