Adversary Tactics - Tradecraft Analysis Training - March 2022

Actions and Detail Panel


Event Information

Share this event

Date and time

Refund policy

Refund policy

Refunds up to 7 days before event

Eventbrite's fee is nonrefundable.

Event description
Hybrid Event - This course will take place onsite in Las Vegas and online, using virtual software to stream live instructors.

About this event

Hybrid Event

This course will take place both In Person in Las Vegas and Live Online (using virtual software to stream live instructors). Course scheduled delivery hours will be 9:00AM to 5:00PM PT.

Limited In Person seating is available on a first-come, first-served basis. If you would like to attend In Person, select the "In Person ticket type" during registration.

Confirmed attendees will receive logistics information one week prior to the event.


Your organization has just implemented the leading detection and response products. Are they configured with default configuration? How much faith should you have in your ability to detect sophisticated attacks? How would you simulate attacks to ensure robust detections are in place? This course will teach the importance of understanding the inner workings of attack techniques and telemetry availability and provide a workflow for developing robust detection analytics or data driven evasion decisions. Focusing on various Windows components and attacker TTPs, you will dive deep into how software abstracts underlying capabilities and how attackers can interact with deeper layers to bypass superficial detection capabilities.

Course Summary

Knowledgeable detection engineers and red team operators know that while there are many effective products, all of them have gaps that can be exploited by a sophisticated adversary. A mature security program must continuously test and enhance product detection configurations to have an effective response capability. Unfortunately, they often run into a number of limitations, primarily in a lack of understanding of the:

  1. attack technique itself
  2. telemetry used for each detection
  3. effectiveness of the detection

The result often leads to blind spots within the detection and response capabilities, ineffective detection strategy, and a false sense of security in the organization's ability to respond to advanced threat actors. When simulating sophisticated attacks, red team operators need to truly understand how a given technique works, the telemetry/artifacts it generates, and the strategies and biases that a defender might use to detect a technique. How organizations may respond to attackers is crucial in red team attack planning, technique selection, and evasion.

In Adversary Tactics: Tradecraft Analysis, we will present and apply a general tradecraft analysis methodology for offensive TTPs, focused on Windows components. We will discuss Windows attack techniques and learn to deconstruct how they work underneath the hood. For various techniques, we will identify the layers of telemetry sources and learn to understand potential detection choke points. Finally, the course will culminate with students creating their own technique evasion and detection strategy. You will be able to use the knowledge gained to both use your telemetry to create robust detection coverage across your organization, and truly assess the efficacy of that coverage.

Whether you are a red team operator or detection engineer, you will have a comprehensive understanding of several attack chains. Red team operators will learn an approach to analyzing their own tools, a better understanding of which techniques to select to evade detection, and how to better describe to defenders why an evasion was successful. Detection engineers will understand how to craft a strategy to create robust detections and better detect families of attacks.

Course Syllabus

Day 1:

  • Attack and Detection Strategies
  • Native PSExec Overview
  • Tradecraft Analysis Process
  • Capability Identification
  • Capability Deconstruction
  • IPC Mechanisms

Day 2:

  • Securable Objects
  • Identifying Choke Points
  • Telemetry Source Identification
  • How EDR Tools Work
  • Organic Logging
  • SACLs
  • Function Hooking
  • Kernel Callback Functions
  • ETW

Day 3:

  • Operationalizing Telemetry
  • Understanding Attacker Controlled Fields
  • Operationalizing Detection Research
  • Operationalizing Evasion Research
  • Understanding the Triage, Investigation, and Remediation Process
  • Evading the Response Process
  • Documentation and Evaluation Metrics
  • Detection Documentation
  • Evasion Documentation

Day 4:

  • Capstone Exercise

Student Requirements

This course is intended for expert blue teamers, detection engineers, and red team operators. Participants should be familiar with detection engineering and/or red team operations, and be generally comfortable with Windows internals, attack technique analysis, offensive tools and techniques

Hardware Requirements

  • Internet Connection
  • 8GBs of RAM
  • Modern Web Browser capable of rendering HTML5


Training will be taking place in Las Vegas, NV. The hotel location will be provided in a future update.


How can I contact the organizer with any questions?

Please email info@specterops.io with any questions.  

What's the refund policy?

Full refunds will be provided up to 7 days before the course start date.

Share with friends

Date and time

Refund policy

Refunds up to 7 days before event

Eventbrite's fee is nonrefundable.

{ _('Organizer Image')}

Organizer SpecterOps

Organizer of Adversary Tactics - Tradecraft Analysis Training - March 2022

Save This Event

Event Saved