4-day live training over Zoom
16 hours of intensive, hands-on training with lifetime access to every session recording for self-paced review.
4-DAY LIVE ONLINE · 2027
[INTERMEDIATE][11 MODULES][CERTIFIED]
Offensive PowerShell: Advanced Red Teaming, Obfuscation & Evasion_
Next live edition
Jan 25 – Jan 28, 2027
Sessions
9AM - 4PM CET
Registration closes
Jan 22, 2027
A 4-day intermediate training covering Active Directory reconnaissance, credential theft, Kerberos attacks, AMSI and ETW bypass, fileless execution, shellcode loading, persistence and exfiltration, all from pure PowerShell and .NET. Amr Thabet.
Duration4days
Live hours328h / day
Modules11
CPE Credits28hours
Amr Thabet
CYBERSECURITY EXPERT · MALWARE RESEARCHER
Author of "Mastering Malware Analysis" book
// Overview
Overview
PowerShell is installed on every Windows host, trusted by default, and wired straight into .NET and the Win32 API. That makes it the most versatile tool on a modern Windows engagement and the most targeted by defensive telemetry. This training teaches you to use it offensively.
Over four days you will work through the full attack chain in pure PowerShell and .NET: Active Directory reconnaissance, credential theft, the complete Kerberos attack set, AMSI and ETW bypass, fileless execution, in-memory C# and shellcode loading, persistence, malware development and exfiltration. Everything is built from scratch. No off-the-shelf frameworks.
// Training Benefits
Why this training is different
Pure PowerShell and .NET
Build everything from built-in cmdlets, .NET classes and P/Invoke. No third-party binaries dropped, no off-the-shelf frameworks.
Source code and tools
Full source code for every tool and technique developed during the training, yours to keep and use on engagements.
Lab environment
A pre-configured lab environment with all required tools and a multi-host Active Directory domain, ready to use from day one.
// What You Will Learn
What you will learn
Day 1 starts with a PowerShell scripting refresher, then moves into WMI/CIM enumeration, PowerShell Remoting, and Active Directory reconnaissance. You will map users, groups, trusts, ACLs, AD CS, tiering violations and Azure/AzureAD from a low-privilege shell.
Day 2 covers credential theft and lateral movement. You will dump credentials and NTLM hashes from memory, extract Kerberos tickets directly with PowerShell, and execute the full Kerberos attack chain: Kerberoasting, Pass-the-Hash, Pass-the-Ticket, Golden and Silver Tickets, delegation abuse and DCSync.
Day 3 is AMSI and ETW bypass, from basic patching through patchless techniques using hardware breakpoints, including a novel in-house function pointer caching manipulation. The second half covers initial access and fileless attacks: LOLBins, third-party app abuse, payload encryption, executing PowerShell in memory from JavaScript, unmanaged PowerShell and VBA macro delivery.
Day 4 brings it all together with C# invocation from PowerShell, shellcode loading (process injection, reflective DLL injection, transacted hollowing), persistence techniques, and malware development. You will build HTTP and WebSocket reverse shells, implement exfiltration over S3, and see how CI/CD pipelines and Terraform become attack surfaces.
// Full Syllabus
11 modules · 4 days of intense learning
Day 01
PowerShell Foundations, Remoting & AD Reconnaissance
8h live01
PowerShell Scripting 101
- Understand syntax, cmdlets and arguments
- Write complex one-liner scripts
- Variables, If/Else and While/Loops
- Dealing with strings, JSON data and regexes
- Writing functions, scripts and modules
- Exceptions and error handling
02
WMI/CIM and PowerShell Remoting
- WMI/CIM for host and domain enumeration: processes, services, sessions, shares, installed software
- WinRM, PSSessions, Invoke-Command
- The double-hop problem
03
Active Directory Reconnaissance
- Domains, forests, trusts and organizational units
- Enumerating users, groups and service accounts
- Identifying Kerberoastable accounts and honeypot accounts
- Enumerating ACLs, finding weaknesses and planning attack paths
- AD CS enumeration: Certificate Authorities, certificate templates and Enterprise CAs
- Understanding tiering models and identifying bypass possibilities
- Azure and AzureAD enumeration for possible lateral movement paths
Day 02
Credential Theft, Lateral Movement & Kerberos Attacks
8h live04
Credential Theft
- Dumping credentials and NTLM hashes from memory
- Extracting Kerberos tickets and dumping LSASS directly with PowerShell
- Requesting, manipulating and reusing TGTs and service tickets
- Keylogging and social engineering for credential theft
05
Lateral Movement and Kerberos Attacks
- Kerberoasting
- Pass-the-Hash and Pass-the-Ticket
- Overpass-the-Hash / Pass-the-Key
- Silver Ticket and Golden Ticket attacks
- Unconstrained Delegation exploitation
- Constrained Delegation abuse: S4U2Self and S4U2Proxy
- Resource-Based Constrained Delegation (RBCD)
- DCSync for domain-wide credential extraction
Day 03
AMSI/ETW Bypass & Fileless Attacks
8h live06
AMSI and ETW Bypass Techniques
- AMSI internals and data flow
- AMSI patching
- Improved AMSI patching
- Patchless AMSI bypass with hardware breakpoints
- AMSI data manipulation
- AMSI function pointer caching manipulation (novel technique created in-house)
- ETW patching and improved patching
- Patchless ETW bypass with hardware breakpoints
07
Initial Access and Fileless Attacks
- Abuse Microsoft binaries (LOLBAS / LOLBins)
- Abuse third-party apps and Electron vulnerabilities
- Payload encryption
- Executing PowerShell in memory from JavaScript
- Unmanaged PowerShell
- VBA macros to PowerShell
Day 04
Shellcode, Persistence & Malware Development
8h live08
C# Invocation with PowerShell
- Downloading and executing managed .NET binaries in memory using Assembly Reflection
- In-memory C# compilation with CodeDOM and Roslyn
- Using managed C# in-memory with disk traces
09
Loading Unmanaged Shellcode with PowerShell
- Process injection
- Executing unsafe Win32 APIs from C# / .NET
- Reflective DLL injection from PowerShell
- Executing shellcode using function pointer caching manipulation
- Transacted hollowing from PowerShell
10
Maintaining Persistence
- Abusing PowerShell Scheduled Jobs for disguise and maintaining persistence
- PowerShell Profiles ($PROFILE abuse)
- Domain persistence (DCSync, Shadow DCs, Golden and Silver tickets, and more)
- Additional persistence techniques
11
Malware Development and Exfiltration
- HTTP reverse shell in PowerShell
- WebSocket reverse shell in PowerShell
- Invisible PowerShell
- Exfiltration using S3
- Hint of CI/CD attacks and Terraform PowerShell injection
// Target Audience
Who this training is for
Red Team Operators and Pentesters
Offensive security professionals who want to build their own PowerShell tooling instead of relying on off-the-shelf frameworks.
Offensive Developers
Developers working in offensive security who want to go deeper into PowerShell, .NET and Win32 for engagement tooling.
Security Professionals
Cybersecurity professionals who want to understand offensive PowerShell tradecraft firsthand to strengthen their overall security knowledge.
// Prerequisites
- Comfortable with PowerShell scripting basics (a Day 1 refresher is included)
- Working knowledge of Windows and Active Directory concepts
- Comfort with .NET and basic C# is a plus
- Setup instructions are sent before the training
// Takeaways
What you'll walk away with
- 01
Active Directory reconnaissance
Map the full AD attack surface from a low-privilege shell, including users, groups, trusts, ACLs, AD CS, tiering violations and Azure/AzureAD.
- 02
Credential theft and Kerberos attacks
Extract credentials, hashes and Kerberos tickets, then execute the full Kerberos attack chain: Kerberoasting, Pass-the-Hash, Golden Tickets, delegation abuse and DCSync.
- 03
AMSI and ETW bypass
Bypass AMSI and ETW from basic patching through patchless hardware-breakpoint techniques, including a novel in-house function pointer caching manipulation.
- 04
Fileless execution and shellcode loading
Execute code without touching disk: LOLBins, in-memory C# with Assembly Reflection and Roslyn, reflective DLL injection, process injection and transacted hollowing.
- 05
Persistence and exfiltration
Maintain access with scheduled jobs, profile abuse and domain persistence, then exfiltrate data over S3 and custom channels.
- 06
Malware development
Build HTTP and WebSocket reverse shells in pure PowerShell and understand supply chain attack surfaces including CI/CD and Terraform injection.
// Training Structure
How the training is structured
Everything is implementation-first. You will not just learn what a technique does, you will write the code that does it. Every tool you use during the training is something you build yourself, and you leave with the full source code.
This is an offensive course taught strictly for authorized testing. It assumes a solid Windows and Active Directory background, and a Day 1 refresher brings everyone up to speed on PowerShell scripting before the pace picks up.
// Your Trainers
Learn from people who do this work
LeadAmr Thabet
CYBERSECURITY EXPERT · MALWARE RESEARCHER
Amr Thabet is a cybersecurity expert with 12+ years of experience in malware research and incident handling. He has worked with Fortune 500 companies worldwide and is the author of "Mastering Malware Analysis". Amr specialises in advanced malware hunting, digital forensics, threat hunting, and Windows internals security.
Author of "Mastering Malware Analysis" book
// ROI for Your Organization
Persuade your manager
Stronger engagements
Your team runs deeper Windows and AD attacks with custom PowerShell tooling they built and control, not off-the-shelf frameworks defenders already detect.
Build offensive capability in-house
Instead of relying on public tools, your staff come away able to build and maintain their own PowerShell-based engagement tooling end to end.
Covers the full attack chain
From AD recon and credential theft through Kerberos attacks, evasion, shellcode and persistence, every stage of a real engagement is covered in one training.
// Pricing
Register early. Save more.
Early Bird
$1,600
Ends Dec 14
Regular
$2,200
Ends Jan 22
4 days of live, instructor-led training over Zoom (16 hours)
Certificate of completion
Lifetime access to all session recordings
Access to a lab environment for the duration of the training
Training slides
Full source code for all tools and techniques built in the training
Pre-configured lab environment with Active Directory domain
Setup instructions sent before the training
All prices net, VAT excl.
// FAQ
Frequently asked questions
Is this a beginner PowerShell course?
It is intermediate. Day 1 includes a scripting refresher, then the pace assumes you are comfortable with Windows and Active Directory.
Do we use Empire, Cobalt Strike or off-the-shelf frameworks?
No. The point is to build your own tooling from pure PowerShell, .NET and P/Invoke so you understand it end to end.
Is it live?
Yes, every session is live with the instructor, with hands-on labs.
What kind of lab environment is provided?
A pre-configured environment with a multi-host Active Directory domain and all required tools. Setup instructions are sent before the training.
// Register · January 25 · 9AM - 4PM CET
Learn it live.
Use it on your next case.
4 days · 11 modules · live and hands-on with Amr Thabet. Limited to 30 participants.
All prices net, VAT excl.
