Specter Bash 2026

Upgrade your Red Team engagements with bleeding-edge Tactics, Techniques, and Procedures (TTPs) used by attackers in real-world breaches. This course will teach participants how to infiltrate networks, gather intelligence, and covertly persist in a network like an advanced adversary. Participants will use the skillsets taught in Adversary Tactics: Red Team Operations to go up against live incident responders in an enterprise lab environment designed to mimic a mature real-world network. Participants will learn to adapt and overcome Blue Team response through collaborative feedback as the course progresses.

As modern architecture increasingly shifts services and data from on-premises infrastructure to the cloud, Identity becomes the thread that ties everything together.

Our Adversary Tactics: Identity-driven Offensive Tradecraft course is a follow-on to our Adversary Tactics: Red Team Operations course and offers an in-depth look at identity-driven attacks, targeting both on-premises and hybrid identities. Participants will learn how to abuse the intricacies of different authentication and authorization mechanisms to traverse on-premises and cloud environments, gain access to integrated systems, and even cross tenants. Participants will also be equipped with a practical approach to identifying known attack paths and forging new ones within complex operational environments and across people, processes, and technology.

Bought every detection tool on the market but still can’t catch mimikatz? IT is complaining about the resource drain from a dozen agents on every endpoint, your analysts are drowning in the data those tools generate, and the latest red team report says your response actions fell flat again. If this sounds like your organization, this course is for you.

We start with detection engineering strategy, then move into methodologies for building robust alerting, so you leave with stronger detection and response across security operations. You’ll learn the why and the technical how of detecting threat actor activity, and you’ll be able to apply these methodologies regardless of the toolsets deployed in your environment.

Adversary Tactics: Detection builds on standard network defense and incident response, which often centers on alerting for known malware signatures, by focusing instead on abnormal behavior and adversary Tactics, Techniques, and Procedures (TTPs). We’ll teach you to engineer detections from attacker TTPs, using free and open source tools like Sysmon, Windows Event Logs, and ELK to analyze large volumes of host data. You’ll build threat hunting hypotheses and robust detections in a simulated enterprise network under active compromise from a range of threat actors.

Organizations have their heads in the clouds, or at least their infrastructure. Gone are the days of on-premises domain controllers and Exchange servers. Microsoft’s Azure provides organizations with the ability to deploy cloud hosts and services to augment, or in some cases, replace existing functionality completely. All of these new cloud assets need protection, both through traditional defensive security measures, and offensive security assessments. For new and veteran security professionals alike, understanding how these new technologies work and the nuances of securing them can quickly become complicated.

Adversary Perspectives: Azure provides participants without previous Azure experience with a solid understanding of how attackers look at Microsoft Azure and Entra ID, its authentication mechanisms, and how they commonly attack Azure-based environments.