Offensive Security for Defenders

What Offensive Security for Defenders teaches: learn the attacker's full campaign from the inside, recon, infrastructure, access, credentials, lateral movement, evasion, objectives, so you can build detection at every stage and turn real TTPs into production Sentinel and Defender XDR detections. The campaign you'll learn to read, the detections you walk away with, and how the course is structured. Start here.

The offensive lifecycle from the attacker's perspective. Target selection, objective mapping, constraint analysis, reconnaissance, the decision matrix, timing strategies, team structures, and documented campaign patterns, the operational planning that determines every technique choice the attacker makes.

How attackers build and manage C2 infrastructure: team servers, redirectors, domain fronting, CDN abuse, cloud-hosted C2, and disposable infrastructure. The infrastructure lifecycle from build through burn, and what each phase looks like to your network monitoring.

How attackers build, obfuscate, and deliver payloads. Multi-stage dropper architecture, runtime evasion (AMSI/ETW bypass), Mark-of-the-Web defeat, delivery method selection, and the full delivery-to-execution chain, from the attacker's engineering decisions to what each stage produces in your telemetry.

How attackers choose their initial access method based on the target's visible defenses. AiTM phishing, device code phishing, OAuth consent abuse, application exploitation, and trusted relationship compromise. The attacker's choice reveals their capability, resources, and timeline, intelligence that changes your response before the first lateral movement.

What the attacker does immediately after landing and why they do it in a specific order. Discovery commands reveal the environment. Credential harvesting determines how far they can move. Persistence survives your containment. C2 establishment makes everything that follows possible. The first 30 minutes are the noisiest, and your best detection window.

How attackers think about credentials as operational resources, not individual passwords to steal, but an inventory of keys with different values, lifespans, and reuse potential. Which credentials to harvest depends on the objective. How to use them depends on the environment. When to use them depends on the campaign timing. The credential inventory is the campaign's fuel, it determines how far the attacker can move, how long they can stay, and what they can access.

Not just 'T1021', how attackers decide WHERE to move, WHAT credentials to use, WHEN to move, and HOW FAST to move. The operational logic: high-value target identification, trust relationship mapping, movement timing relative to business hours and monitoring cadence, and protocol selection based on the detection surface. The credential inventory from M6 is the fuel. The movement decisions from this module are the route. Together, they form the campaign's movement narrative.

How attackers think about your defenses, not as impenetrable barriers but as a landscape of controls to navigate. They bypass the controls in their path and accept the ones that merely log. They test whether they've been detected before escalating. They adapt when a tool is blocked. They clear evidence when they think the investigation is getting close. Every evasion action leaves its own trace, the meta-signals of an attacker who knows they're being watched.

The endgame. Modules 4–8 taught the operational journey, initial access, post-compromise, credentials, lateral movement, evasion. Module 9 covers what happens when the attacker reaches the objective. Ransomware deploys through a specific operational sequence: backup destruction, shadow copy deletion, encryption staging, GPO push, ransom note deployment. Data theft follows a pipeline: identification, staging, compression, channel selection, transfer.

The capstone defensive skill. Three alerts arrive across three systems over six hours: a suspicious PowerShell execution, an unusual logon, and a new scheduled task. Each triggers a rule. Each is triaged independently. Each is closed as low-severity. Together, they're a credential-access campaign that culminated in persistent access and data staging.

The final module. Modules 0–10 taught you how attackers think, plan, execute, evade, and achieve their objectives, and how defenders detect, correlate, and reconstruct campaigns. Module 11 translates that understanding into program-level decisions.

Detection sheets organized by attacker stage, each rule carrying how durable it is against the operator adapting.

Seven procedures for converting attacker understanding into detection capability, each with a state to reach.

An isolated lab for running attacker techniques safely, and the telemetry to observe them from the defender's side.

Worked cases where understanding the operator's constraints changes the answer, including the wrong turns.

Seven events that arrive with an offensive question attached, each with prerequisites, a pre-flight, a numbered sequence and a worked handoff.

Where to practice reading attacker telemetry, and which half of this course a simulator cannot teach.

The consolidated lookup and the step-by-step procedures from this course, in one place.

External sources this course draws on: vendor documentation, frameworks, standards, and research.

Offensive Security for Defenders end-of-course exam: a three-phase simulation testing whether you can apply the method to a situation the course did not walk through.