Red Team Operations

Learn to turn a business question into a bounded operation and defend every conclusion with exact evidence. This course uses fictional supplied records: you analyze decisions, compare observations and write reports.

What you will practice

Prerequisite knowledge

Bring basic network-path, principal/resource-permission and log-reading knowledge. If those distinctions are unfamiliar, use RED01 and RED02 readiness questions and record the gap. No extra certificate, purchase or completion of another course is a hidden prerequisite.

How practice works

Read the explanations and worked example, then attempt guided, changed-condition and blind practice. Cite supplied record IDs and preserve your original interpretation before revising. Blind practice remains formative even when completed without hints. RED12 prepares prospective planning and evidence defense; it is not an enabled independent assessment.

Training uses the supplied fictional records; no terminal, installation or external target access is required. A real penetration test requires written permission from the authorized owner covering the target, actions and time window. Fictional training gives no authority over external systems. No live lab, native execution, mastery or certification is established by reading or saved formative responses.

Learning Roadmap

Start with the authority and evidence foundation, build a bounded operational chain, then compare defensive observations and prepare a defensible report. The order explains dependencies; it is a recommendation rather than an enrollment gate.

  1. RED01: Bound business objectives — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  2. RED02: Evaluate exercise authority — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  3. RED03: Evaluate intelligence provenance — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  4. RED04: Model owned infrastructure — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  5. RED05: Compare initial access hypotheses — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  6. RED06: Identify effective context — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  7. RED07: Analyze resource permission paths — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  8. RED08: Analyze bounded routes — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  9. RED09: Select minimum objective proof — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  10. RED10: Interpret defensive observations — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  11. RED11: Join an attack chain — Workbook decisions with exact supplied record IDs; worked, guided, changed-condition and blind formative practice
  12. RED12: Write prospective plans — Prospective plan and evidence-bound report preparation

Readiness route: uncertain authority → RED02; uncertain evidence joins → RED04; uncertain resource permissions → RED07; uncertain path claims → RED08; uncertain retest conclusions → RED10. Choose the gap you can explain, then return to the sequence.

The RED01 engagement-style and RED04 bounded-tool-choice supplements deepen objective and infrastructure decisions without adding operational authority.

Topics in Learning Module

The syllabus below describes the supplied teaching and its observable learning targets.

  1. RED01: BEST BCID and objective driven operations
    • Turn a fictional business question into a bounded objective, a testable hypothesis and an explicit evidence requirement.
    • Check identity, target, action, time and current controller authority separately; distinguish a proposal from recorded execution.
    • Build a BCID comparison with a named change, held conditions and a legitimate-use control; identify a comparison that changes too much.
    • Separate technique coverage, execution evidence, objective proof and defensive effectiveness; classify supported, blocked and inconclusive claims.
    • Produce a concise record-linked conclusion, limitations, safe next step and cleanup status without inventing activity.
  2. RED02: Rules of engagement deconfliction and controlled resumption
    • Extract a concrete business objective, roles, scope, action limits, time window, contacts and stop/resume rules from a charter.
    • Evaluate five independent authority checks and report all conflicts or unknown facts.
    • Normalize supplied time offsets and distinguish message creation, receipt and effective times.
    • Maintain incident-specific stop state; distinguish recovery, unverified messages and partial clearance from valid resumption.
    • Handle an unknown route without probing beyond scope, then write a precise decision and controller handoff.
    • Preserve plans, permission decisions, actual supplied observations and immutable review history as different records.
  3. RED03: Threat intelligence and emulation design
    • Assess a specific claim's provenance, support, independence, recency and uncertainty without using publisher reputation as a substitute for evidence.
    • Select a behavior relevant to a supplied business objective and justify omitted alternatives.
    • Use a behavior mapping with a reason and limitation; never equate a label with permission, execution or a defensive result.
    • Build a sequenced plan with prerequisites, bounded actions and explicit evidence requirements.
    • Design positive and negative comparisons and honest supported, blocked and inconclusive outcome branches.
    • Adapt to an unavailable prerequisite with a conditional hold or labeled approximation, then communicate the resulting limits.
  4. RED04: Operator infrastructure and command and control
    • Convert a supplied charter into an owned-asset and allowed-flow diagram with explicit actor, principal, path, time and resource limits.
    • Compare the observed setup with the approved tool/version/configuration and identify unresolved identity, credential-reference or protection-state differences.
    • Correlate supplied operator, relay and receiver records without confusing transport reachability, session authentication, message acceptance and application receipt.
    • Account for attempts, bytes, session lifetime and resource observations using the charter's exact counting rules.
    • Decide whether a bounded recovery is permitted, held or outside scope after an interruption; preserve controller authority and retry limits.
    • Reconcile local/remote session closure, temporary-artifact handling and retained evidence, then report a bounded conclusion.
  5. RED05: Reconnaissance and initial access selection
    • convert a business purpose and supplied asset information into a bounded, testable entry hypothesis.
    • compare entry candidates using relevance, permission, prerequisites and evidence quality, rather than apparent ease alone.
    • trace a supplied session to its exact principal, target, route and event time; distinguish an authentication result, authorization decision and session receipt.
    • respond to a blocked route or STOP without inventing a retry, alternate target or permission to resume.
    • explain how a supplied foothold changes the starting point and the claim of achievement.
    • report local simulation results without treating automated artifacts as measurements of people.
  6. RED06: Foothold operations identity and access lifecycle
    • identify the exact host, session and effective principal in supplied context evidence, without substituting an account label or presumed role.
    • choose a minimum, owner-permitted context action and evaluate the counters and conditions it actually consumes.
    • build a lifecycle ledger that distinguishes the owner grant, temporary technical permission, session, marker artifact, credential reference and retained evidence.
    • stop normal tasking when owner authority, lease validity or controller release is lost, even if a display or target still reports a live session.
    • distinguish cleanup request, acknowledgement, target state and independent verification, preserving exact scope and remaining unknowns.
    • explain when fresh owner authority and an exact controller release permit a new bounded action, without reviving an old lease or erasing its history.
  7. RED07: Privilege paths and directory based lateral movement
    • Construct an objective and copy the exact starting identity, source host, target resource and owner boundary.
    • Test each proposed graph relationship against its conditions, authority and current observations.
    • Separate a credential reference, authentication, effective context, resource permission and completed objective.
    • Compare a denied hardened path with an alternate result without overstating causation.
    • Use only then-available clocks, counts and STOP/release evidence for each decision.
    • Write a narrow source-linked report, including unresolved evidence and native-performance limits.
  8. RED08: Enterprise pivoting and tunneling
    • Draw the exact source, intermediate hosts, destination and permitted direction for a bounded objective.
    • Explain what each observed hop proves about transport and what remains to be established at the application.
    • Compare fixed local and dynamic forwarding concepts against an explicit allowlist without creating either.
    • Locate the supported failed layer, preserve unknowns and justify a separately permitted alternate vantage.
    • Reconcile owner authority, STOP/release, complete time intervals and every applicable limit at the decision checkpoint.
    • Close each named temporary-item row only from matching request, actor, action, result and verification evidence.
  9. RED09: Objective collection and bounded impact demonstration
    • Define an exact objective asset and choose the minimum synthetic fields or bytes needed to answer the question.
    • Distinguish permission, observed access, collection, local staging, a movement attempt and independent receipt.
    • Correlate the source, object version, principal, action and receiver, then compare reproducible byte lengths and integrity evidence.
    • Apply the current charter, STOP/release, full time intervals and each applicable attempt, object and byte limit.
    • Interpret positive and denied controls without turning missing evidence into a denial or a success.
    • Write a bounded business-impact statement and reconcile each temporary copy and retained evidence item.
  10. RED10: Defensive observations operational decisions and retest
    • Turn the business question into expected evidence at each observation stage without treating the expectation as a fact.
    • Correlate the exact action, host, principal, event, run and control profile across independent records.
    • Normalize source clocks with an explicit offset convention and uncertainty, while preserving availability at the actual decision time.
    • Distinguish a collection gap, a specifically tested detection miss, an alert and an observed response or block.
    • Explain false positives and a noise tradeoff using a fully labeled small corpus with honest denominators and limits.
    • Apply STOP/release and action-specific budgets, then compare the objective path and a real supplied legitimate-workflow result after an authorized correction.
  11. RED11: Full attack chain capstone and unfamiliar practice
    • Construct an objective-led plan whose required links and alternative paths are explicit.
    • Separate intelligence, authority, supplied starting state and performed story evidence.
    • Trace exact identities, sessions, resources and conditions without widening one local result into domain-wide control.
    • Evaluate a failed route, approved alternative and mission interruption using current owner scope, counters and controller state.
    • Separate technical objective proof, compliance and defensive effectiveness.
    • Explain a concrete cause and priority, compare a corrective retest on both the objective and legitimate workflow, and preserve regression or missing evidence.
    • Reconcile each session/artifact/lease and write distinct technical and executive findings.
  12. RED12: Independent operation report and remediation retest
    • Write a prospective bounded plan from assigned starting facts and distinguish it from retrospective interpretation.
    • Explain permitted materials, prohibited assistance and why blind formative practice does not establish independent performance.
    • Assemble record-linked claims, limitations, remediation comparisons and genuine ordinary-workflow evidence for later assessor review.

Career Path and workforce alignment

Objective design and authority checks support supervised red-team planning. Record joins and uncertainty analysis support security analysis and detection validation. Evidence-led reporting and retest planning support consulting and remediation coordination.

These are practice connections, not a job qualification, certification or demonstration of operational performance. This course does not assess live tool execution, production engagement leadership or workplace readiness.