RED AI TEAMING
NOT FOR STUDENTS • ONLY FOR PROFESSIONALS OR CYBERSECURITY BACKGROUND
Introduction to Red Teaming
Course Overview
Welcome & Goals
Skill Progression Path
Tools & Environment Preview
Rules of Engagement & Ethics
Legal Considerations
Ethical Frameworks
Team Roles & Communication
Safety & Kill-Switches
Metrics & Success Criteria
AI in Use AI-Powered
AI-Assisted Recon Overview
AI Ethics in Red Teaming
Foundations & Lab Setup
Building Your Lab
Virtualization Platforms
Network Segmentation
Deploying Windows & Linux VMs
Cloud Lab (AWS/GCP/Azure)
Core Tools Installation
Kali & Parrot Toolchain
Cobalt Strike & Alternatives
Open-Source C2 (Metasploit, Sliver)
Workflow Automation
Scripting with Python & PowerShell
Infrastructure as Code for Labs
Logging & Snapshot Management
AI in Use AI-Powered
AI-Driven Lab Automation
Containerized AI Toolchains
Recon & OSINT
Passive Recon
WHOIS, DNS Enumeration
Public Records & Data Leaks
Social Media Profiling
OSINT Automation Tools
Active Recon
Network Scanning (nmap)
Web Crawling & Dir-buster
Service & Version Detection
Vulnerability Mapping
Target Modeling
Attack Surface Analysis
Kill-Chain Mapping
Threat Actor TTP Emulation
Prioritization & Reporting
AI in Use AI-Powered
LLM-Powered OSINT
Deepfake Detection & Generation
Generative AI for Social Engineering
Initial Access Techniques
Network-Based Exploits
SMB/LDAP Exploits
RCE via Web Apps
VPN & RDP Attacks
Zero-day vs. Public Exploits
Client-Side Attacks
Phishing Basics & Tooling
Malicious Document Generation
Browser Exploits & JS Injections
Macro & DDE Attack Chains
Next-Gen Bypass Techniques
AMSI/WDLP Evasion
Memory-Only Payloads (Reflective DLL)
Living off the Land Binaries (LOLBins)
Hardware-Based Entry (Thunderbolt, USB)
AI in Use AI-Powered
AI-Generated Malware Polymorphism
Voice-Clone Phishing (Deep Vishing)
Social Engineering & Phishing
Phishing Campaign Build
Email Infrastructure Setup
Template Crafting & Personalization
Domain Shadowing & Lookalikes
Malware vs. Credential Harvesting
Detection & Anti-Phish Testing
Human Manipulation & Pretexting
Psychology of Influence
Voice Phishing (Vishing)
SMS-Based Attacks (SMiShing)
Physical Pretexting Scripts
Hybrid Attacks & Multi-Vector
AI & Future Concepts AI-Powered
Dynamic Phishing with Chatbots
AI-Enhanced Pretext Persona Creation
Network Exploitation & EDR Bypass
EDR/AV Evasion
Signature vs. Behavioral Detection
Packers & Crypters
User-Mode Hooking Evasion
Kernel-Mode Evasion
Advanced Exploitation
Buffer Overflows & ROP Chains
DLL Hijacking & Side-Loading
Return-to-Libc & JIT Spraying
ROP-less Code Reuse
Post-Exploitation Frameworks
Custom C2 Plugin Development
Stealthy Beacon Configuration
Peer-to-Peer C2 Meshes
Automated Cleanup & Anti-Forensics
AI in Use AI-Powered
Adversarial ML for EDR Evasion
Reinforcement-Learning Attack Agents
Windows & Active Directory Attacks
Kerberos & AD Fundamentals
AD Architecture & Trusts
Kerberos Protocol Deep-Dive
AS-REP & Kerberoasting
DC Sync & DCSync Detection
Privilege Escalation
Token Impersonation & ACL Abuse
COM & Service Misconfigurations
PSC (Print Spooler) Exploits
Zero-Point PrivEsc Chains
AD Persistence & Forest Attacks
Golden & Silver Tickets
Skeleton Key & DCSync
Forest Trust Exploitation
Shadow Credentials & Backdoors
AI in Use AI-Powered
ML-Based Anomaly Detection Bypass
AI-Automated Ticket Forging
Linux & Cloud Attacks
Linux Exploitation
SUID/SGID Binary Abuse
Linux Kernel Exploits
Container Escape (Docker, Kubernetes)
Systemd & Cron Hijacking
SSH & Key-Based Attacks
Cloud-Native Attacks
IAM Misconfigurations (AWS/GCP/Azure)
Serverless Function Abuse
Metadata API & Token Theft
Cloud C2 (Droplet, Lambda)
CI/CD Pipeline Attacks
AI in Use AI-Powered
AI-Driven Cloud Misconfig Discovery
Container-AI Escape Techniques
Lateral Movement & Persistence
Lateral Tactics
WMI & PSExec
SMB Relay & NTLM-Relay
RDP Tunneling & Proxying
Pass-the-Hash / Pass-the-Ticket
DCOM & RPC Abuse
Scheduled Task & Service Hijack
Persistence Mechanisms
Registry Run Keys & WMI Events
Bootkits & Firmware Malware
Application Shimming
User-Level & Kernel-Level Rootkits
Cloud Persistence (Function Triggers)
Automated Recon & Re-Entry Scripts
AI in Use AI-Powered
Autonomous Lateral-Movement Bots
Predictive Persistence Placement
C2 Frameworks & Data Exfiltration
Data Exfiltration Techniques
HTTP(S)/SMB Exfil
Cloud Storage Abuse (S3, Blob)
Covert Channels (ICMP, DNS)
Live Data Staging & Compression
Exfiltration Detection Evasion
AI in Use AI-Powered
AI-Optimized Exfiltration Scheduling
Steganography with GANs
Physical Security & Red Team Tools
Physical Entry & Surveillance
Lock Picking Basics
RFID/NFC Badge Cloning
Camera & Sensor Bypass
Tailgating & Social Pretext
Safe-Cracking Simulation
Portable Toolkits & Gadgets
Raspberry Pi Dropboxes
USB Rubber Ducky & BadUSB
Wi-Fi Pineapple Attacks
Signal Jamming & Recon
Wearable Tech for Ops
AI in Use AI-Powered
Drone-Based Recon with Computer Vision
AI-Guided Lock-picking Simulators
Advanced APT & Next-Gen Bypass
Emulating Nation-State TTPs
Supply-Chain Attacks
Firmware & BIOS Implants
DeepFake & AI-Driven Social Eng.
5G / IoT Attack Surfaces
AI/ML Evasion & Automation
Adversarial ML for AV Bypass
Automated Campaign Orchestration
AI-Generated Phishing Content
Defensive AI Counter-Tactics
Zero-Trust & Micro-Segmentation Bypass
Identity-Based Exploits
Software-Defined Perimeter Attacks
Service Mesh & API Gateway Abuse
Quantum-Resistant Crypto Attacks
AI in Use AI-Powered
Quantum-AI Hybrid Attacks
Autonomous Supply-Chain Attack Agents
AI-Driven Zero-Trust Breach Orchestration
Reporting, Analysis & Remediation
Debrief & Reporting
Executive Summary Writing
TTP Mapping & Evidence
Risk Scoring & Prioritization
Remediation Recommendations
Metrics Dashboard Creation
Client-Facing Presentation Tips
Lessons Learned & Blue Team Handover
Blue Team Collaboration
Purple Team Exercises
Patch & Harden Playbooks
Post-Engagement Monitoring
Continuous Improvement Loop
AI in Use AI-Powered
Automated SLA-Driven Report Generation
AI-Powered Remediation Playbooks