Module 11: Situational Awareness and Host Operations
Build a current host-state record using Windows and Linux identity, process, socket, and routing evidence, with a worked snapshot comparison.
Red-Team-Courses
Module 12: User Persistence
Understand user startup triggers, HKCU context, and restoration. Follow a benign Notepad Run-entry lab with evidence and cleanup checks.
Module 13: Local Privilege Escalation
Evaluate Windows privilege escalation paths through service permissions, DLL loading, evidence quality, and a read-only lab exercise.
Module 14: Privileged Persistence and Process Migration
Understand Windows service persistence, process lifetime, architecture, and migration tradeoffs through read-only inspection and a service lifecycle exercise.
Module 15: Persistence Cleanup and Defense Evasion
Restore persistence changes with a precise artifact ledger, correct registry identity, evidence preservation, and independent verification of cleanup.
