A joint Active Directory training experience built around real-world attack and detection scenarios, combining CYBER RANGES’ high-fidelity simulation platform with Cyber Helmets’ expert-led offensive and defensive instruction, in a unified purple teaming methodology.
Fill in the following form to get course updates & enrollment info.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
In collaboration with:
This training is delivered through custom-built, guided instruction by Cyber Helmets, enriched with CYBER RANGES’ high-fidelity lab environments and enterprise-grade infrastructure.
What you’ll gain:
Intermediate
Duration:
2 days
(6h/day)
Who this course is designed for
This workshop supports professionals aiming to develop strong, real-world Active Directory exploitation and detection skills through guided practice, telemetry analysis, and advanced lab work. It’s ideal for those seeking to bridge the gap between offensive and defensive security, expanding their understanding of enterprise identity security, or preparing for high-level infrastructure security roles.
Penetration Testers & Red Teamers transitioning into Purple Teaming who need a structured methodology for validating detections against modern AD attack techniques.
SOC Analysts & Blue Teamers (Tier 1 & 2) who want to stop “alert fatigue” by understanding the attacker’s logic and the deep-level artifacts left in Windows Events and Wazuh.
System Administrators & Security Engineers looking to harden their environments, identify hidden attack paths in BloodHound, and implement resilient GPO and PKI defenses.
> Understand the full Active Directory attack lifecycle, from enumeration to domain dominance, and validate detections against real attack scenarios.
> Map attack paths and misconfigurations using BloodHound and LDAP across complex AD environments.
> Exploit Kerberos (roasting, delegation, tickets) and NTLM/SMB authentication weaknesses.
> Chain abuse paths through misconfigured GPOs, object permissions, and ACLs.
> Leverage ADCS and PKI misconfigurations (ESC1, ESC8) for certificate-based attacks.
> Validate findings with Wireshark by inspecting Kerberos and NTLM traffic.
> Build detections using Windows Event logs and Wazuh rules.
> Prioritize remediation to harden environments and reduce attack paths.
> Instructor-led sessions guide you through the full purple teaming lifecycle, from identifying attack paths to exploiting, detecting, and defending against them.
> Hands-on labs run in a CYBER RANGES environment, providing access to a realistic Active Directory infrastructure for continuous practice.
> You work within an integrated detection stack using tools like Wazuh, BloodHound, and Wireshark to validate attacks and build detections.
> Training materials include guided labs, slides, and detection rules to support both the exercises and post-training reference.
> The focus is on practical application, ensuring you can translate techniques directly into real-world security operations.
> Participants receive a certificate of completion upon finishing the training.
Accordion Content
Yes, provided you have a foundational understanding of networking and Windows environments. While the workshop is classified as Intermediate, it is designed to guide learners through the “Purple Loop” step-by-step. We start with fundamental enumeration and gradually build up to complex, multi-stage attacks like ADCS exploitation and Kerberos Delegation. If you understand what a Domain Controller is and how to use a command line, you will be able to follow the curriculum effectively.
Participants have access to a dedicated support team for any technical issues, as well as access to instructors during designated office hours for questions related to the course material. Additionally, you can reach out to your instructor during office hours for personalized assistance.
The course includes simulated real-world scenarios in a controlled lab environment. You will not be conducting tests on live, unauthorized systems, but you will gain the skills needed to perform real-world penetration tests in a professional setting.
Unfortunately we don’t record our sessions therefore you’ll need to catch up with the rest of the group. The support team can help you to catch up with the previous sessions and guide you on the materials that you need to read.
Syllabus:
Intro to GCP
Exploitation of GCP Services
Methodologies
Security Services
Syllabus:
Intro to AWS
Exploitation of AWS Services
Methologies
Common Detection Mechanisms
Syllabus:
Azure Basics
Exploitation of Azure Services
Methologies
Common Detection Mechanisms
Fundamentals and Setup
Advanced Techniques and Practical Application
Advanced Techniques and Practical Application
Fundamentals & Setup