CERTIFIED RED TEAM PROFESSIONAL
PART I
FROM LEARNERS TO LEADERS
www.securityeagles.com
CRTP
1. Introduction to CRTP
Welcome
Prerequisites
How to Use the Course
Resources & Help
Meet the Instructor
Learning Path Overview
2. PowerShell and .NET Tooling
PowerShell reconnaissance
Tool modification & safe testing
AMSI & script-block awareness
.NET in-memory execution
.NET loaders & assembly injection
2
1. Introduction to CRTP
1- Welcome
Certified Red Team Professional (CRTP) is a hands-on
certification focused on attacking and defending
Active Directory environments.
Throughout this course, you’ll explore modern tactics,
learn real-world practical skills, and prepare for the
CRTP lab and exam.
You’re about to join a global community of learners
dedicated to advancing red team skills and
strengthening cybersecurity defenses.
3
2- Prerequisites
To succeed in this course, you should have:
A foundational understanding of computer networks
and Windows administration
Basic familiarity with command-line tools (PowerShell
preferred)
Some awareness of how Active Directory works,
including user accounts, groups, and authentication
4
3- Meet the Instructor
Your instructor brings deep experience in offensive
security and red teaming
Get insights from their career and real-world
engagements
Benefit from mentorship opportunities and live Q&A
sessions
The instructor’s teaching style is practical,
approachable, and focused on skill growth
About the Instructor:
Certified red teamer
Passionate about knowledge-sharing
Available throughout the course for personalized
feedback and guidance
5
4- Learning Path Overview
Your CRTP course journey is structured around
building core skills in red teaming and Active
Directory security. You will progress through the
following modules:
PowerShell and .NET Tooling : Begin with mastering
PowerShell scripting and .NET-based tools vital for
security automation and red team operations. You’ll
learn how to leverage command-line and automation
interfaces to discover and manipulate Windows
environments.
Active Directory Enumeration : Dive deep into
methods for discovering and mapping Active
Directory objects, permissions, and relationships.
You’ll use PowerShell and specialized enumeration
tools to gather critical intelligence for attack
scenarios.
Local Privilege Escalation : Unlock techniques to
gain elevated privileges on Windows systems starting
from standard user accounts. The course covers key
vulnerabilities, escalation strategies, and live
demonstrations in lab environments.
6
Active Directory Attacks : Explore offensive tactics
targeting AD, including credential hunting,
persistence, domain privilege escalation, and lateral
movement. You’ll gain practical experience through
simulations of real-world attack paths.
Defense & Evasion : Develop skills in bypassing
common defenses and evading detection. You’ll also
learn defensive measures, including monitoring,
hardening, and incident response tactics to counter
red team activity.
7
2. PowerShell and .NET Tooling
1- Powershell Overview
PowerShell is a cross-platform automation tool that
includes a command-line shell, scripting language,
and configuration management framework, and it is
available by default on modern Windows operating
systems
While the command "powershell.exe" is often used,
the core functionality comes from the
System.Management.Automation.dll library .
Windows PowerShell is used on Windows, but there is
also a platform-independent version, PowerShell
Core.
but wait what is a dll ?
DLLs are the Windows form of shared libraries , is a
reusable library of code and data that programs load
on demand, so multiple apps can share the same
functionality without copying it into each executable
Why System.Management.Automation.dll matters :
This assembly implements the public PowerShell API
surface, including classes like PowerShell and
Runspace that let code add commands, execute
them, and read output/error streams
so powershell.exe is just a host; the engine lives in
System.Management.Automation.dll
8
Load a script using dot sourcing :
. C:\USERS\USER\POWERVIEW.PS1
Import a module with :
IMPORT-MODULE C:\USERS\USER\AD.PSD1
List all commands in a module :
GET-COMMAND -MODULE <MODULENAME>
Display help about PowerShell commands :
GET-HELP
List all available commands :
GET-COMMAND
Show running processes :
GET-PROCESS
Retrieve the status of services :
GET-SERVICE
Copie files or folders :
COPY-ITEM
Clear the current console screen :
CLEAR-HOST
9
2- PowerShell Script Execution
In this section , we will use Invoke-CradleCrafter
which is a specialized PowerShell tool designed
to generate and obfuscate remote download
cradles .
Those are the small scripts or commands that
fetch and execute code from a remote source
This tool is valuable for both Red Teams
(attackers) and Blue Teams (defenders): Red
Teams can use it to create stealthy, hard-todetect downloaders, while Blue Teams can use it
to test and improve their detection capabilities
against a wide variety of cradle techniques
10
Start by setting the execution policy to bypass for
the current process to safely allow the loading of
unsigned scripts (we will see why we are setting
it in the next pages).
Import the CradleCrafter module using its
manifest file (use the link below).
Finally, invoke the main function to execute the
module’s features in a controlled PowerShell
session.
After loading the CradleCrafter tool, a help menu
provides clear, interactive command options for
users.
source : https://github.com/danielbohannon/InvokeCradleCrafter
11
You can view a tutorial, clear the screen, execute
or copy obfuscated cradles, and manage
previous actions using simple keywords.
The tool also offers choices for generating
memory-only or disk-based remote download
cradles, streamlining PowerShell command
obfuscation and delivery workflows.
12
The main difference between memory-only and
disk-based remote download cradles is where
the downloaded code is stored and executed
Memory-only cradles download a script or
payload from a remote server and execute it
directly in memory, without ever saving it to disk
Disk-based cradles, on the other hand, download
the payload and save it as a file on the disk
before executing it
13
The tutorial command guides users to set URLs,
script paths, and post-execution commands
before applying obfuscation and generating
either memory-only or disk-based download
cradles.
Obfuscation options, testing, copying outputs,
and resetting are all menu-driven for flexibility.
14
Set a remote URL for the loader, then select
either memory-only or disk-based remote
download cradle to proceed
in this case , loader can be a binary that
performs initial access
15
Choose from a variety of memory-only download
cradle techniques, including PowerShell, .NET,
COM objects, and Certutil methods
16
we will choose Certutil
Certutil is a built-in Windows command-line
utility primarily designed for managing
certificates and certificate authorities
It allows administrators to display, configure,
back up, restore, and verify certificates
We will leverage Certutil to download payloads
by making network requests outside of
PowerShell's native commands. You can
obfuscate syntax, use Select-Object or IEX, or
combine techniques for stealth
This approach helps evade detection by using
trusted Windows utilities creatively
17
Select from various invoke methods like IEX, GetCommand, or Runspace to trigger payload
execution with Certutil.
Mixing these options increases stealth by
blending with normal system activity.
The output shows the exact command
generated and ready for execution.
18
3- PowerShell Security Logging Features
System-wide transcription : This feature logs all
commands and their outputs from PowerShell
sessions, providing a complete record of what happens
during a session to help with auditing and
investigation. It can be used as a security feature to
translate OS elements like user names into Security
Identifiers (SIDs) to protect against social engineering
attacks that rely on human-readable names .
Script Block logging : It records the actual content of
PowerShell scripts and commands as they run,
including decrypted and de-obfuscated blocks, to
enhance visibility and security monitoring of
potentially malicious activities
AntiMalware Scan Interface (AMSI) : AMSI allows
PowerShell and other applications to integrate with
security products so that scripts and dynamic content
can be scanned for threats before execution,
enhancing malware detection especially for fileless
attacks. So basically it allows applications and services
to send scripts and commands to the security
products to be scanned
19
Constrained Language Mode (CLM) : CLM restricts
the PowerShell language environment, limiting what
commands and scripting features are available, in line
with organizational policies enforced by Applocker or
Windows Defender Application Control to reduce the
risk of unauthorized script execution . Therefore access
to some builtin commands that can be used in a
malformed way in powershell is denied for example :
[System.Convert]::FromBase64String("...")
using this class in a Constrained Language Mode
environment would be blocked .
20
4- Execution policy
- The PowerShell Execution Policy is a safety feature that
controls the conditions under which PowerShell loads
configuration files and runs scripts .
- Loading Configuration Files is when powershell process loads
various configuration files to customize the shell's behavior,
define starting parameters and bunch of other functionnalities .
- Running scripts means executing a series of commands stored
in a ps1 file (powershell) .
- PowerShell's execution policy is not intended as a security
feature but exists mainly to help users avoid running scripts by
accident .
-Key Execution Policies :
Restricted : Prevents all scripts from running , only allows
individual commands to be run interactively .
RemoteSigned : Scripts downloaded from the internet must
be digitally signed by a trusted publisher , Scripts created
locally do not need a signature .
AllSigned : All scripts and configuration files, regardless of
where they originated (local or remote), must be digitally
signed by a trusted publisher to run.
Unrestricted : Allows all scripts to run , requires confirmation
before running an unsigned script that was downloaded
from the internet
Bypass : Nothing is blocked and there are no warnings or
prompts , all scripts run automatically .
21
-There are several methods commonly used to bypass the
execution policy, such as:
Using
powershell -ExecutionPolicy bypass
Running commands with
powershell -c <cmd>
Executing encoded scripts via
powershell -encodedcommand
Setting the environment variable:
$env:PSExecutionPolicyPreference="bypass"
or we can use as before :
Set-ExecutionPolicy bypass -scope process
22
5- PowerShell Techniques and Evasion Tactics
Offensive uses of PowerShell remain viable today. The
effectiveness of security detections is influenced by
the specific organization and the customization of any
scripts used , so here it comes the gap that attackers
could benefit from. Multiple bypass techniques exist,
including both simple and obfuscated methods to
evade defenses. Finally, remember that the primary
emphasis of this training is on Active Directory.
To circumvent PowerShell's security controls, InvisiShell is used. This tool manipulates logging by hooking
into .NET assemblies like
System.Management.Automation.dll and
System.Core.dll. The process relies on the CLR Profiler
API, allowing the hook to take place. Essentially, a CLR
profiler is a DLL that communicates with the runtime
through profiling functions, and it is loaded
automatically when the CLR starts.
so this tool is designed to bypass PowerShell's primary
auditing and security features (including AMSI,
ScriptBlock Logging, Module Logging, and
Transcription)
source: https://github.com/OmerYa/Invisi-Shell
23
To bypass PowerShell security features using InvisiShell, run the RunWithPathAsAdmin.bat script if
administrator rights are available
.\RunWithPathAsAdmin.bat
If working with limited permissions, use
RunWithRegistryNonAdmin.bat instead
.\RunWithRegistryNonAdmin.bat
When the new PowerShell session is complete, type
exit to close the session and clean up remnants
24
6- Evading Antivirus Detection for PowerShell
Scripts
Evasing Antivirus solutions is common for both
attackers and red teamers as it is the key to achieve
their objectives .
It is possible to avoid antivirus detection by keeping
PowerShell scripts in memory (no disk write), thus
bypassing AMSI .
Signature-based detection of PowerShell scripts stored
on disk can be addressed using tools like AMSITrigger
or DefenderCheck (see sources below)
AmsiTrigger_x64.exe -i script.ps1
DefenderCheck.exe PowerUp.ps1
these tools helps us as red teamers to detect where
our scripts gets detected by security solutions .
For complete obfuscation to thwart defenses, InvokeObfuscation can be used to disguise both scripts and
AMSI bypass techniques.
source:
https://github.com/RythmStick/AMSITrigger
https://github.com/t3hbb/DefenderCheck
https://github.com/danielbohannon/InvokeObfuscation
25
-AmsiTrigger analyzes and executes a PowerShell script to test
AMSI detection, mimicking interactive user activity and sending
output via streams.
-We run it with the input script "Invoke-PowerShellTcp.ps1" to
test how AMSI scans and responds to its contents
-The output highlights the section of "InvokePowerShellTcp.ps1" that AMSI identifies as malicious or
potentially harmful
-Opening the script with any editor , we used String reversal
here to obfuscate "computername", making it harder for AMSI
to detect and flag the script as malicious
-Running AmsiTrigger on the modified script now returns
"AMSI_RESULT_NOT_DETECTED"
This confirms that AMSI no longer flags the obfuscated
content as malicious.
26
-DefenderCheck is used here to scan PowerUp.ps1
and identify which parts match antivirus detection
signatures
-The tool reveals the offset of flagged bytes and
reports the specific signature hit
-The scan finds a match at offset 0xCA65 and
reports it as
"HackTool:Win32/PowersploitHijack!pz"
-byteToLineNumber.ps1 converts the flagged byte
offset from DefenderCheck to the exact line number
in PowerUp.ps1
27
- When we opened the script with a text editor and
scrolled to the line number found on the previous
page, we saw the Base64 encoded text that was
detected .
- We removed the Base64 payload from $B64Binary
to prevent AV signature detection on this section of
the script
- Here the optimal solution is not to remove parts of
the script that gets detected, but we remove them
just to show you how these tools work .
- DefenderCheck confirms that PowerUp.ps1 is no
longer flagged by Defender after removing the
Base64 section.
28
2. PowerShell and .NET Tooling
6- .Net Overview
.NET is a powerful, versatile software framework
developed by Microsoft for building and running
applications on Windows. It supports multiple
programming languages and is widely used for both
enterprise and security tooling due to its flexibility
and integration with the Windows environment
Unlike PowerShell’s
System.Management.Automation.dll, standard .NET
assemblies do not have built-in security features such
as advanced logging or command restrictions
As a result, Red Teams and attackers often prefer .NET
for crafting custom tools and payloads that bypass
common security controls.
The security community has contributed a vast
collection of open-source offensive .NET utilities,
which we will selectively use to match our
engagement goals and methodologies.
source : A repo of popular Offensive C# tools https://github.com/Flangvik/SharpCollection
29
7- Offensive .NET – Operational Techniques
- When working with .NET or similar compiled languages
for red team engagements, you must overcome several
common defenses:
Security products like antivirus (AV) and endpoint
detection & response (EDR) can recognize and block
malicious .NET payloads.
Delivering your tools often requires creative methods,
as straightforward download-and-run approaches
may be flagged or stopped
Security logs , such as process creation and
command-line activity, can capture evidence of your
activity for later investigation
- Throughout this course, we tackle AV evasion and
payload delivery challenges together, offering guidance
as obstacles arise
30
8- Defeating AV Detection with Offensive .NET
Our main goal is to bypass signature-based scanning
by Windows Defender that targets common attack
patterns
We’ll leverage methods like obfuscation and
manipulating strings to disguise our code and
payloads.
DefenderCheck will help highlight risky parts of the
source, guiding us to tweak and conceal flagged
segments.
This lets us refine our binaries for better evasion,
using practical code changes or source-level
obfuscation when needed.We focus on evading
Windows Defender’s pattern-based scans using code
obfuscation and string tricks.
DefenderCheck pinpoints flagged code, guiding
minimal adjustments or source code obfuscation for
smoother AV bypass.
31
- Our first tool to defeat AV detection is Codeception , a
tool that will help us obfuscate source code (in this case
C#)
- To obfuscate source code means to intentionally make
the code difficult for humans to understand while
keeping it functional for the computer.
- here is the GitHub repository for Codecepticon, an
open-source .NET tool from Accenture.
- You can clone the repository using the provided HTTPS
URL or download the ZIP directly
source: https://github.com/Accenture/Codecepticon
32
- After building the project , start by reviewing the
Codecepticon directory to find the main executable,
config files, and related documentation (\bin\Debug\
or \bin\Release\ depends on how you built the
project) .
- Check the included HTML for the command-line
generator and the DLL files required for .NET
compatibility.
33
- Open the CommandLineGenerator.html in any
browser
- Set up your Codecepticon command with options
for obfuscation, module selection, and verbosity in
the generator interface.
- Choose the output format, either Console or XML,
for customizing how results appear.
- Select the module type, such as C#, to target
specific code for obfuscation and transformation
34
- Or we can use the command line tool to run
Codecepticon directly with customizable options for
obfuscation, renaming, profile selection, and string
rewriting.
- This gives us full control over how the source code
(Rubeus projet source below) is transformed and
processed.
- Many advanced features, such as markov renaming
and XOR string rewriting, can be activated in one
flexible command like so :
.\CODECEPTICON.EXE --ACTION OBFUSCATE --MODULE CSHARP -VERBOSE --PATH "C:\AD\TOOLS\RUBEUS-MASTER\RUBEUS.SLN" --MAPFILE " C:\AD\TOOLS\RUBEUS-MASTER\MAPPING.HTML" --PROFILE
RUBEUS --RENAME NCEFPAVS --RENAME-METHOD MARKOV --MARKOV-MINLENGTH 3 --MARKOV-MAX-LENGTH 10 - MARKOV-MIN-WORDS 3 -MARKOV-MAX-WORDS 5 --STRING-REWRITE --STRING-REWRITE METHOD
XOR
source: https://github.com/GhostPack/Rubeus
35
- You can see the command executing, Visual Studio
environment detection, and progress as functions,
variables, and strings are obfuscated
- The entire process finishes with “Obfuscation
complete,” confirming that the protections and
transformations have all been applied
36
- Here’s how the Rubeus project looks after
Codecepticon obfuscation. All classes, methods, and
variable names have become unreadable and
randomized
- You can see the difference with altered identifiers
and rewritten code structures that increase evasion
37
- This is ConfuserEx, another .NET obfuscation tool
available on GitHub
- ConfuserEx provides strong obfuscation features
for protecting .NET applications against reverse
engineering .
- You can download pre-built releases or source
code, and choose between CLI and GUI versions for
your workflow .
38
- This is the GUI for ConfuserEx, where you adjust
obfuscation rules and global settings for .NET
assemblies .
- Here’s the rule editor in ConfuserEx, letting you
set protection patterns and choose the
obfuscation preset level .
39
- Begin by downloading the CsWhispers repository
and opening it in Visual Studio, as shown in this
image
- Right-click the CsWhispers project and select
Properties from the menu
40
- In the Build section of your project properties,
ensure the "Allow unsafe code" checkbox is enabled
- This setting permits code that uses pointers and
low-level memory operations, which are often
required when working directly with NT API or
system structures.
41
- Here you can see the file called CsWhispers.txt has
been created under the CsWhispers.Sample project
in Solution Explorer.
- This text file is where you’ll append NT API and
struct equivalents
42
- Here is the content of the file
- Adding these entries is crucial for swapping out
standard WinAPI calls in NetLoader, enabling you to
leverage NT equivalents
43
- Select Build Solution or Build CsWhispers.Sample
to compile all your modifications
44
- Using nimble.exe, install docopt, nimcrypto, and
winim by running install commands in sequence
- This step sets up all dependencies before
obfuscating your .NET assembly
45
- The Nimcrypt project is being compiled using
the Nim compiler f rom the command line.
- After installing all dependencies, running this
command generates the obfuscated Nimcrypt
executable, which can later be used to obfuscate
your .NET assembly
46
- After compilation , launching nimcrypt.exe -h
displays the tool's help menu
- Run nimcrypt.exe with the compiled assembly
(CsWhispers.sample.exe) as input and specify the
output filename.
- The tool processes the file by applying obfuscation
and encryption layers.
- Once complete, you get an obfuscated executable
with reduced detection risk
47
FROM LEARNERS TO LEADERS
www.securityeagles.com
STAY TUNED
FOR MORE