Red Team Tool Development: Implants and C2
When every vendor tool you own is already signatured, you have to build your own. This course teaches red team tool development from the ground up: Windows implants, shellcode, and writing a command and control, or C2, framework that defenders have never seen.
You program against the Windows platform, work through detection and its evasion in the academy lab, and finish with custom capability you understand completely because you wrote it.
- Duration
- 12 weeks
- Format
- Live online, instructor-led
- Prerequisites
- Advanced Red Team Operations
- Class size
- Capped at 12 learners
What you will be able to do
- Program against the Windows API for offensive tooling
- Write and test shellcode and a working loader
- Build a custom Windows implant with beaconing and tasking
- Design and implement your own command and control framework
- Test your tooling against EDR sensors in the lab
- Reason about the trade-off between stealth and reliability
- Document and maintain custom tooling for an operator team
Course outline
6 modules
- Choosing a language and toolchain
- The Windows API for offensive work
- Process, thread and memory concepts
- A safe build and test workflow
What you need before you start
- Completion of Advanced Red Team Operations
- Solid programming ability, ideally in C, C++ or a systems language
- Comfort with Windows internals and debugging
- Patience for low-level, iterative development
Who this course is for
- Red teamers whose vendor tooling is widely detected
- Operators who want to build and own their capability
- Security engineers moving into offensive development
- Researchers studying implant and C2 design
Questions about this course
More in offensive security
CoreHacker Tools, Techniques and Incident Handling
Learn attacker tools and techniques from the defender's chair, then run a structured incident handling process, in a live online course from Toronto.
8 weeks · live online
Contact for pricingView outline
CoreWeb Application Penetration Testing
Hands-on web application penetration testing course that takes you from reconnaissance through exploitation and reporting, using the OWASP Top 10 and beyond.
8 weeks · live online
Contact for pricingView outline
CoreIoT Penetration Testing
An IoT penetration testing course covering firmware extraction and analysis, radio protocols, and the cloud and mobile backends behind connected devices.
8 weeks · live online
Contact for pricingView outline
Ready to launch your cyber security career?
Join the next live online cohort. No experience required, just bring the curiosity.