Red Team¶
Notes from red team operations study (e.g. CRTO) and related material. Like the rest of this handbook, each topic is kept useful for the defender: what the operator does, and what it leaves behind to detect.
Pages in this section are listed in the sidebar.
Post-Exploitation¶
Open the Post-Exploitation learning section →
Study 19 topics across five pages, with command explanations, comparison tables and execution diagrams. Each page includes modern defensive context.
| Page | Topics |
|---|---|
| Architecture and command behavior | Client, Team Server, Beacon, awareness, APIs, BOFs, fork & run |
| Sessions and file systems | spawn/spawnas, paths, downloads and Sync Files |
| Processes and collection | PID/JID, registry, keystrokes, screenshots, VNC |
| Execution and external tools | shell/run, PowerShell, .NET, Aggressor |
| Modern defense and review | Versions, logging, Credential Guard, SMB, review questions |