Getting a foothold is the first step in a successful breach—be it in the form of user credentials, email access, or code execution on a target system. This course will provide students with the fundamental skills and know-how to perform the most common attacks used to get an initial foothold during a red team exercise.
Since Microsoft products and services are the most widespread platform in use by organizations, Office 365 and Microsoft Windows will be the primary targets of student exercises. Core concepts will also be discussed so that students can apply the lessons learned to other platforms in the future.
KEY TAKEAWAYS

Students will learn OPSEC considerations when performing each step from reconnaissance to initial foothold.
Students will learn how to counter modern defenses that can interfere with each attack.
Students will learn how to set up an environment for testing each attack before running it against targets.
Students will get hands-on practice:
Performing reconnaissance to support each attack.
Setting up their own "botnet" with ProxyCannon to spread traffic across multiple source IP addresses.
Executing password guessing attacks such as credential stuffing and password spraying.
Phishing for credentials and sessions to bypass multi-factor authentication.
Setting up and using Azure Information Protection (AIP) to deliver encrypted phishing emails.
Creating "MalDocs"—Microsoft Office documents with embedded executable payloads.
Delivering executable payloads during a phishing campaign.