← Return to the Red Team Course

Network reachability, authentication, and authorization answer different questions. A reachable server does not prove an account is valid, and a successful login does not grant every permission. This module connects web transports, directory services, DNS, and group membership so you diagnose the right layer before choosing a tool.

Allow 25 minutes for reading and 20 minutes for a small domain-lab exercise. You need basic IP addressing and access to your own Windows lab.

Learning Outcomes #

• Distinguish layers: separate an application protocol from its transport and encryption.
• Explain the domain: identify the roles of DNS, a domain controller, and a resource server.
• Trace permissions: follow a group-membership path to an explicit resource permission.
• Interpret failure: distinguish name resolution, connection, authentication, and access denial.
• Create an evidence map: connect observations without assuming a complete attack path.

Protocols Have Different Jobs #

TCP provides an ordered byte stream with mechanisms for acknowledging and retransmitting data. UDP sends datagrams without TCP’s connection and delivery mechanisms. An application using U
Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/a-plus/hardware-components-cpu-ram-storage-motherboards/Wed, 01 Jan 2025 00:00:00 +0000https://simeononsecurity.com/a-plus/hardware-components-cpu-ram-storage-motherboards/Master hardware for the CompTIA A+ 220-1201 Core 1 exam. Learn cables and connectors, RAM, storage devices, motherboards and CPUs, power supplies, and printers.
Read the full article at https://simeononsecurity.com/

Click Here to Return To the CompTIA A+ Course Page

Hardware is 25% of the CompTIA A+ 220-1201 Core 1 exam, the largest Core 1 domain. This module covers cables, RAM, storage, motherboards, CPUs, power supplies, and printers. This domain is the hands-on heart of A+, so learn the parts by sight and by spec.

Hardware is the physical foundation of every system you support. You pick the right RAM, install the correct drive, seat a CPU without bending pins, and size a power supply that will not fail under load. This module covers the components you touch every day.

Cables and Connectors #

You match each cable to its job.

Single-mode fiber carries one light path over long distances. Multimode fiber carries many paths over short runs inside a building.

Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/foundations-windows-internals-and-authentication/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/foundations-windows-internals-and-authentication/How Windows stores configuration and credentials: the registry and hives, registry paths, NTLM hashes, and the difference between domain and local authentication.
Read the full article at https://simeononsecurity.com/

← Return to the Red Team Course

Windows security context determines which account a process represents, which objects it is permitted to access, and which user profile it reads. This module connects registry paths, security identifiers, access tokens, and authentication. You will inspect a disposable Windows VM and produce an identity record before changing anything.

Allow 25 minutes for reading and 20 minutes for the optional lab. Complete the networking and Active Directory module first.

Learning Outcomes #

• Identify registry context: distinguish predefined keys from the loaded hives behind them.
• Read a token: separate account identity, group membership, and enabled privileges.
• Explain authentication artifacts: distinguish an NT password hash from a network challenge response and a Kerberos ticket.
• Check an observation: use account authority, SID, process context, and timestamps together.
• Create a context record: document the identity and registry view behind each lab observation.

The Registry Model #

The registry organizes operating-system and application configuration into keys and named values. A key contains subkeys and values, while each value has a name, a type, and data. A path identifies a location, but the process context and registry view d
Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/a-plus/virtualization-cloud-computing-concepts/Wed, 01 Jan 2025 00:00:00 +0000https://simeononsecurity.com/a-plus/virtualization-cloud-computing-concepts/Master virtualization and cloud computing for the CompTIA A+ 220-1201 Core 1 exam. Learn virtual machines, hypervisors, VDI, containers, cloud models, and cloud characteristics.
Read the full article at https://simeononsecurity.com/

Click Here to Return To the CompTIA A+ Course Page

Virtualization and Cloud Computing is 11% of the CompTIA A+ 220-1201 Core 1 exam. This module covers virtual machines, hypervisor types, VDI, containers, cloud models, and cloud characteristics. This is the smallest Core 1 domain, but the concepts appear across modern IT support.

Virtualization runs many systems on one machine. Cloud computing rents that capacity from a provider so you pay only for what you use. Together they power most of the infrastructure you support today. This module gives you the vocabulary and the models.

Virtualization Concepts #

You run software-defined computers on physical hardware.

• A virtual machine (VM) emulates a full computer with its own OS, isolated from the host.
• A sandbox restricts untrusted code and reduces host exposure. Escapes, shared folders, network access, and management mistakes remain possible.
• Test and development environments let you try changes without risking production.
• Snapshots capture a VM state so you roll back after a failed change.

Virtualization saves money by packing many workloads onto fewer physical servers.

Hypervisor Types #

You pick the hypervisor that fits the workload.

Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/command-and-control-operations/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/command-and-control-operations/Follow C2 task delivery, polling latency, uncertain outcomes, and operator handovers through worked examples and a task-ledger exercise.
Read the full article at https://simeononsecurity.com/

← Return to the Red Team Course

Command and control (C2) connects an operator’s decisions to an agent running in a test environment. A useful operator distinguishes a submitted task from a delivered task, a completed action, and a returned result. Those states explain delays, prevent duplicate changes, and support an accurate activity record.

Allow about 18 minutes, plus time to complete the timing exercise. The exercise uses invented timestamps and requires no deployed agent.

What You Will Learn #

• Identify the client, team server, agent, listener, and redirector roles.
• Explain how polling affects task latency without treating it as a stealth guarantee.
• Calculate delivery delay from a short event timeline.
• Compare evidence from the console, network, and endpoint.
• Produce a task ledger with ownership, deadlines, and recovery decisions.

Term	Meaning
Client	Operator interface connected to the shared backend
Team server	Backend coordinating sessions, tasks, and operation records
Beacon	Cobalt Strike’s agent on an assessment endpoint
Listener	Named configuration for an agent’s communication channel
Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/a-plus/hardware-network-troubleshooting-core1/Wed, 01 Jan 2025 00:00:00 +0000https://simeononsecurity.com/a-plus/hardware-network-troubleshooting-core1/Master hardware and network troubleshooting for the CompTIA A+ 220-1201 Core 1 exam. Diagnose motherboards, RAM, CPUs, power, drives, displays, mobile devices, printers, and networks. Read the full article at https://simeononsecurity.com/ Click Here to Return To the CompTIA A+ Course Page Hardware and Network Troubleshooting is 28% of the CompTIA A+ 220-1201 Core 1 exam, tied with two Core 2 domains for the largest listed percentage across the two exams. This module covers the troubleshooting methodology and how to diagnose hardware, displays, mobile devices, printers, and networks. The exam tests process as much as parts, so learn the methodology in order. Troubleshooting is the skill that defines a good technician. You follow a repeatable process, read the symptoms, form a theory, and prove it before you replace anything. This module turns scattered symptoms into a reliable diagnosis. The CompTIA Troubleshooting Methodology # You follow these steps in order on every problem. The exam expects this exact sequence. Identify the problem. Gather information, question the user, and back up data before changes. Establish a theory of probable cause. Question the obvious. Test the theory to confirm it. If it fails, form a new theory or escalate. Establish a plan of action and identify potential effects. Implement the solution or escalate as needed. Verify full functionality and apply preventive measures. Document findings, actions, and outcomes. Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/beacon-execution-and-beacon-object-files/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/beacon-execution-and-beacon-object-files/Understand BOF file formats, architecture compatibility, client integration, runtime limits, and failure boundaries through a benign test design. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course A Beacon Object File (BOF) extends an agent with compiled code executed inside its process. Understanding the file format is only the starting point. You also need to reason about compatibility, dependencies, input handling, runtime behavior, and the consequences of a failure. Allow about 18 minutes, plus time to build the compatibility record. The examples are illustrative and do not require running an offensive payload. What You Will Learn # Distinguish object files, executable images, scripts, and runtime code. Explain how execution location changes the failure boundary. Inspect architecture metadata without executing an object file. Evaluate compatibility and evidence before selecting an execution method. Create a test record covering valid input, invalid input, and failure handling. Term Meaning COFF Common Object File Format used for compiled object modules BOF Object code following a loader’s expected entry and API conventions ABI Application binary interface governing how compiled components interact Aggressor Script Cobalt Strike client scripting and integration layer Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/a-plus/operating-systems-windows-linux-macos/Wed, 01 Jan 2025 00:00:00 +0000https://simeononsecurity.com/a-plus/operating-systems-windows-linux-macos/Master operating systems for the CompTIA A+ 220-1202 Core 2 exam. Learn OS types, installations, Windows editions, tools, command line, settings, networking, macOS, and Linux. Read the full article at https://simeononsecurity.com/ Click Here to Return To the CompTIA A+ Course Page Operating Systems is 28% of the CompTIA A+ 220-1202 Core 2 exam, the largest Core 2 domain. This module covers OS types, installations, Windows editions, tools, the command line, settings, and macOS and Linux. Core 2 is software-focused, and this domain rewards hands-on practice in real systems. The operating system is where users and hardware meet. You install it, configure it, fix it, and secure it. This module covers the three desktop platforms and the Windows tools and commands you will use every shift. OS Types and Filesystems # You match the OS and filesystem to the device. OS Common filesystem Windows NTFS, ReFS, FAT32, exFAT macOS APFS, HFS+ Linux ext4, XFS, Btrfs Chrome OS Cloud-centric, ext4 underneath Mobile (Android/iOS) Sandboxed app storage NTFS supports permissions, encryption, and large files. FAT32 is universal but caps files at 4 GB. exFAT removes that cap for large external drives. Install Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/malleable-c2-and-communication-evasion/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/malleable-c2-and-communication-evasion/Separate profile validity, working communication, telemetry, and detection with a local HTTP exercise and controlled comparison record. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course A Malleable C2 profile describes configurable aspects of Cobalt Strike communication and related behavior. It changes indicators, but a changed indicator is insufficient evidence of a bypass. This module teaches you to separate configuration validity, successful communication, collected telemetry, and detection outcomes. Allow about 20 minutes, plus time for the local HTTP exercise. The exercise sends harmless requests to your own loopback interface and does not deploy an agent. What You Will Learn # Define profiles, transforms, polling, jitter, and observation points. Explain which parts of an HTTP exchange different sensors observe. Inspect two local requests and compare their records. Evaluate the evidence behind a claim of reduced detection. Create a controlled comparison with explicit assumptions and limits. Term Meaning Profile Configuration describing selected communication and runtime behavior Transform Reversible operation used to encode and recover exchanged data Polling Checking periodically for work or results Jitter Variation applied to a timing interval Telemetr Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/a-plus/security-threats-vulnerabilities-best-practices/Wed, 01 Jan 2025 00:00:00 +0000https://simeononsecurity.com/a-plus/security-threats-vulnerabilities-best-practices/Master security for the CompTIA A+ 220-1202 Core 2 exam. Learn physical and logical security, Windows security settings, wireless protocols, malware, social engineering, and hardening. Read the full article at https://simeononsecurity.com/ Click Here to Return To the CompTIA A+ Course Page Security is 28% of the CompTIA A+ 220-1202 Core 2 exam, tied for the largest Core 2 domain. This module covers physical and logical security, Windows settings, wireless protocols, malware, social engineering, hardening, and data destruction. Security knowledge protects every system you support, so master these controls. Security is everyone’s job, and the technician is the first line of defense. You lock down access, configure permissions, recognize attacks, and remove malware. This module builds the practical security skills the exam demands. Physical and Logical Security # You combine physical barriers with logical access controls. Physical Logical Bollards, fences, mantraps Access Control Lists (ACLs) Badge readers, key fobs Least privilege Biometrics (fingerprint, face) Zero Trust Locks, cameras, lighting Multifactor authentication (MFA) MFA combines factors: something you know (password), something you have (token), and something you are (biometric). Least privilege gives each user only the access the job requires. Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/open-source-intelligence/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/open-source-intelligence/Evaluate public sources, RDAP, DNS, certificate logs, and scan data. Build a traceable OSINT brief with worked examples and source-quality checks. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course Open-source intelligence (OSINT) turns publicly available information into an answer to a defined question. Collection alone produces observations. Useful intelligence adds provenance, context, corroboration, uncertainty, and a decision the assessment team is authorized to make. Allow about 25 minutes, plus time to complete the evidence-ledger exercise. All organizations, observations, and assessment decisions in the worked case are fictional. What You Will Learn # Distinguish a source observation from an inference and a confirmed finding. Explain the limits of registration, DNS, certificate, and scan-index data. Apply search operators and normalize a synthetic list of names. Compare evidence freshness and independent corroboration. Create a research brief which supports a bounded next action. Term Meaning Provenance Where information originated and how you obtained it Observation A specific item recorded from a source Inference A conclusion drawn from one or more observations Corroboration Additional evidence supporting or challenging a claim RDAP Regi Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/a-plus/software-troubleshooting-windows-apps-malware/Wed, 01 Jan 2025 00:00:00 +0000https://simeononsecurity.com/a-plus/software-troubleshooting-windows-apps-malware/Master software troubleshooting for the CompTIA A+ 220-1202 Core 2 exam. Diagnose Windows OS issues, mobile OS and application problems, security symptoms, and malware removal. Read the full article at https://simeononsecurity.com/ Click Here to Return To the CompTIA A+ Course Page Software Troubleshooting is 23% of the CompTIA A+ 220-1202 Core 2 exam. This module covers Windows OS issues, mobile OS and application problems, security symptoms, and malware removal. Pair this domain with the Core 1 troubleshooting methodology because the same process applies to software. Software problems frustrate users and fill the ticket queue. You read the symptoms, match them to a cause, and apply the fix that solves the problem without losing data. This module covers the software faults you will see most. Windows OS Troubleshooting # You diagnose the common Windows failures. Symptom Likely cause Fix BSOD / stop error Bad driver, RAM, or hardware Check driver, run memory test Boot failure Corrupt boot files Startup Repair, bootrec Frequent shutdowns Overheating or PSU Check temps and power Services not starting Dependency or corruption Check Services and Event Viewer Slow performance Startup bloat, low disk, malware Trim startup, free space, scan Time dri Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/active-reconnaissance-and-scanning/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/active-reconnaissance-and-scanning/Interpret Nmap port states, scan methods, and vantage points through a loopback exercise, segmentation case, and evidence-based scan plan. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course Active reconnaissance sends requests to a system to answer a defined question about its current behavior. A scan result describes what the scanner observed from a particular location at a particular time. It becomes useful when you preserve the method, interpret the limits, and connect the result to an approved next action. Allow about 20 minutes, plus time for the loopback exercise. The exercise uses one port on your own machine. What You Will Learn # Distinguish host discovery, port state, service identification, and vulnerability validation. Explain the differences between TCP SYN and connect scans. Run a bounded local scan and preserve its output. Analyze conflicting observations from different vantage points. Create a scan plan with evidence requirements and stopping conditions. Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/a-plus/operational-procedures-documentation-communication/Wed, 01 Jan 2025 00:00:00 +0000https://simeononsecurity.com/a-plus/operational-procedures-documentation-communication/Master operational procedures for the CompTIA A+ 220-1202 Core 2 exam. Learn documentation, change management, backups, safety, environmental controls, communication, scripting, and AI basics. Read the full article at https://simeononsecurity.com/ Click Here to Return To the CompTIA A+ Course Page Operational Procedures is 21% of the CompTIA A+ 220-1202 Core 2 exam. This module covers documentation, change management, backups, safety, environment, professionalism, scripting, remote access, and AI basics. This domain is about doing the job correctly and professionally, not just technically. A great technician follows process. You document your work, manage change safely, back up before you break things, stay safe, and treat customers well. This module covers the professional habits that keep IT running and keep you employed. Documentation Best Practices # You record everything so others can follow your work. Term Meaning Vantage point Network location and routing context of the observer Host discovery Probes used to identify responsive addresses Port scan Probes used to classify transport endpoints Service identification Evidence about the application using an endpoint Deconfliction Document Purpose Ticketing system Tracks issues and resolutions Asset management / CMDB Inventories hardware and software Standard Operating Procedures (SOPs) Step-by-step process guides Knowledge base Reusable how-to articles Network topology diagrams Maps the network layout Change Management Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/initial-access-phishing-and-delivery/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/initial-access-phishing-and-delivery/Distinguish phishing delivery, interaction, execution, and access. Interpret campaign metrics, modern Office controls, and Windows architecture with worked examples. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course Initial access is the establishment of a usable starting context for an assessment. A delivered message, a clicked link, and code execution represent different outcomes. Your test should identify which boundary it examines and collect evidence appropriate to the tested boundary. Allow about 20 minutes, plus time to design the simulation record. The worked examples use synthetic events and require no messages sent to real recipients. What You Will Learn # Distinguish delivery, interaction, execution, and communication outcomes. Explain how email, document, identity, and endpoint controls affect an access path. Analyze a synthetic campaign’s rates and ambiguous events. Evaluate whether two simulations support a fair comparison. Create a bounded initial-access test specification and handover record. Term Meaning Delivery A message or artifact reaches the specified destination Interaction A recorded action such as following a link Execution Instructions run in an identified process and security context Foothold Usable access within the assessment’s permitted scope Mar Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/situational-awareness-and-host-operations/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/situational-awareness-and-host-operations/Build a current host-state record using Windows and Linux identity, process, socket, and routing evidence, with a worked snapshot comparison. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course Situational awareness is a current, evidence-backed picture of the host and security context where an assessment action would run. It starts with identity and scope, then adds the process, network, and service facts needed for the next decision. Collecting every available field is less useful than answering the right questions accurately. Allow about 18 minutes, plus time to create the host-state record. Commands below inspect local state and do not require credential extraction. What You Will Learn # Identify the host, account, process, and network context separately. Explain why an interface address does not establish a usable route. Apply read-only Windows or Linux checks in a training environment. Analyze changes between two host snapshots. Create a handover record with freshness and collection limits. Term Meaning Host identity Evidence tying the current system to an approved asset Security context Identity and permissions used by the current process or thread PID Process identifier, valid within its host and lifetime Listener Socket accepting incoming communication Rout Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/user-persistence/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/user-persistence/Understand user startup triggers, HKCU context, and restoration. Follow a benign Notepad Run-entry lab with evidence and cleanup checks. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course User persistence arranges for an action to recur in a user’s context after a defined trigger. A configuration entry, a successful launch, and a verified removal are three separate outcomes. This module uses a visible Notepad startup entry in a disposable Windows VM to examine the complete lifecycle. Allow about 20 minutes, plus two lab sign-ins. Use a dedicated test account and save your work before signing out. What You Will Learn # Distinguish logon-triggered startup from boot-triggered services. Explain user identity, executable availability, and policy dependencies. Inspect startup configuration before changing it. Observe a benign entry through creation, trigger, and removal. Create a lifecycle record with independent cleanup evidence. Term Meaning Startup entry Configuration requesting execution at a defined trigger Run value Named registry value specifying a command at user logon RunOnce value Startup configuration intended for a single logon execution HKCU HKEY_CURRENT_USER, resolved for the calling context Trigger Event which makes the co Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/local-privilege-escalation/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/local-privilege-escalation/Evaluate Windows privilege escalation paths through service permissions, DLL loading, evidence quality, and a read-only lab exercise. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course Local privilege escalation crosses a permission boundary on a host. A writable directory, unusual service, or scanner finding starts an investigation. Establish which identity controls which operation, which privileged process consumes the result, and what evidence supports the claimed impact. This module develops a permission-boundary record. You will inspect a prepared training service without modifying it, compare incomplete findings, and design a minimal validation with a clear stopping point. Allow 35–50 minutes. Difficulty: intermediate. The worked case is illustrative, not an observed compromise. Learning Outcomes # Define service permissions, file permissions, and DLL search behavior. Explain why a suspicious configuration is an incomplete escalation claim. Inspect a training service and its filesystem permissions. Compare evidence for competing escalation hypotheses. Produce a validation record with a remediation and retest condition. Before You Begin # Use a disposable Windows lab VM with an instructor-provided service named CourseLabService and a documented application directory. Read Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/privileged-persistence-and-process-migration/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/privileged-persistence-and-process-migration/Understand Windows service persistence, process lifetime, architecture, and migration tradeoffs through read-only inspection and a service lifecycle exercise. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course Privileged persistence preserves an approved execution opportunity across a defined interruption. A Windows service is one possible mechanism. Its configured account, startup behavior, running process, and recovery dependencies need separate verification. This module teaches you to build a service lifecycle record and judge whether process migration serves a concrete requirement. A running callback proves connectivity at one moment. It does not establish boot durability, service health, or successful restoration. Allow 35–45 minutes. Difficulty: intermediate. The timeline exercise uses synthetic observations. Learning Outcomes # Distinguish service configuration, service state, and process lifetime. Explain account selection and filesystem redirection. Inspect a prepared service without changing its configuration. Evaluate migration against stability and evidence requirements. Create a lifecycle record covering trigger, observation, and restoration. Before You Begin # Use the prepared Windows lab VM and service manifest from Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/persistence-cleanup-and-defense-evasion/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/persistence-cleanup-and-defense-evasion/Restore persistence changes with a precise artifact ledger, correct registry identity, evidence preservation, and independent verification of cleanup. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course Cleanup restores agreed system state after an exercise. It removes or reverses the team’s changes while preserving the evidence needed to explain them. Deleting a visible file is only one possible step, and a failed query does not prove an artifact is absent. This module develops a restoration ledger linking ownership, baseline, action, verification, and unresolved work. It also separates defense-evasion testing from evidence destruction, so the assessment’s final state remains reviewable. Allow 30–45 minutes. Difficulty: intermediate. The worked cleanup case uses synthetic records. Learning Outcomes # Define restoration, artifact ownership, and verification scope. Explain how registry identity and loaded hives affect cleanup. Inspect the exact Run entry from the earlier benign exercise. Analyze failed queries, file identity changes, and remaining processes. Create a restoration ledger with an independent review condition. Before You Begin # Bring the baseline records from Read More at https://simeononsecurity.com/ ]]>https://simeononsecurity.com/red-team-course/domain-privilege-escalation-and-kerberos-abuse/Sat, 12 Sep 2026 00:00:00 +0000https://simeononsecurity.com/red-team-course/domain-privilege-escalation-and-kerberos-abuse/Analyze Kerberos service-ticket exposure, account privilege, encryption choices, and delegation evidence with a domain escalation review record. Read the full article at https://simeononsecurity.com/ ← Return to the Red Team Course Domain privilege escalation combines identity, ticket, directory, and authorization evidence. Kerberoasting is one possible path. A service principal name (SPN) identifies a service account for Kerberos, but it does not grant administrative authority to the account. This module builds a ticket and privilege review. You will distinguish a ticket request from offline password analysis, compare service-account designs, and produce a defensible decision about the next approved test. Allow 40–55 minutes. Difficulty: intermediate. Examples use synthetic account names and expected evidence. Learning Outcomes # Define KDC, TGT, TGS, SPN, service account, and delegation. Explain why ticket encryption and account privilege are separate questions. Inspect ticket-cache and directory evidence in an approved lab. Compare traditional service accounts with managed service accounts. Create a domain escalation review with evidence and limits. Before You Begin # Use the domain lab and collection agreement from Read More at https://simeononsecurity.com/ ]]>