● INSTRUCTOR-LED TRAINING
Active Directory Purple Teaming: Operational Exploitation & Detection
A joint Active Directory training experience built around real-world attack and detection scenarios, combining CYBER RANGES’ high-fidelity simulation platform with Cyber Helmets’ expert-led offensive and defensive instruction, in a unified purple teaming methodology.
Key takeaways:
- Holistic Active Directory visibility across modern enterprise environments
- Apply the attacker-to-defender loop by exploiting, detecting, investigating, and validating attacks
- Build a structured methodology for identifying attack paths and validating detection logic
- Gain practical experience in Active Directory security assessments, hardening, and incident response
- Work with enterprise-grade detection and analysis tooling including BloodHound, Wazuh, and Wireshark
- Learn how to prioritize remediation efforts that meaningfully reduce attack paths and exposure
Built inside a realistic Active Directory environment.
In collaboration with CYBER RANGES, this training combines Cyber Helmets’ guided offensive and defensive instruction with enterprise-grade Active Directory lab environments designed to replicate real-world attack and detection scenarios.
Participants work through realistic infrastructures, attack paths, telemetry, and detection workflows inside a high-fidelity environment built for practical security validation.
Book your seat
What's included:
- 2 instructor-led live training days (6h/day)
- Full CYBER RANGES lab access
- Guided exploitation & detection exercises
- Training materials and detection content
- Certificate of Completion
Training full syllabus and preparation details will be sent to all registered participants prior to the training.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
● INSIDE THE LAB
What you'll practice
Attack Path Discovery & Analysis
Map Active Directory attack paths using BloodHound, LDAP enumeration, and graph-based analysis techniques.
Kerberos & Credential Attacks
Perform Kerberoasting, delegation abuse, ticket attacks, and credential-focused Active Directory exploitation techniques.
Active Directory Certificate Services (ADCS)
Identify and exploit certificate-based attack paths, including common ADCS misconfigurations such as ESC1 and ESC8.
ACL Abuse & Privilege Escalation
Analyze permissions, object relationships, and privilege escalation opportunities hidden within Active Directory.
Detection Engineering & Telemetry Analysis
Investigate attack activity through Windows Event Logs, Wazuh detections, and network telemetry.
Detection Validation & Remediation
Validate defensive controls, identify detection gaps, and prioritize remediation actions that reduce attacker pathways.
Meet the instructor
Marios Pappas
Cyber Helmets instructor and expert in penetration testing, red teaming, and Active Directory security.
