Windows Exploitation & Defense Expert Exam

Emphasis on detection vs. exploitation: understand how attackers operate and how defenders can detect or mitigate these techniques.

Coverage across the kill chain: initial access, escalation, persistence, lateral movement, and cleanup/forensics.

Questions are intentionally precise: you will evaluate configurations, interpret evidence, and choose the most likely technical cause or mitigation.

Ideal for red-teamers, blue-teamers, incident responders, and engineers preparing for advanced certifications or practical assessments.

Improve ability to link observed artifacts to likely attacker techniques.

Prepare learners for real operational trade-offs when building detection and response controls.

Practical identification of misconfigurations in services, SDDL, Group Policy, and AD CS that lead to escalation.

Methods of lateral movement (WMI, SMB, RDP, Pass-the-Ticket) and the defensive signals they generate.

Persistence and LOLBin abuse techniques and how to detect/log them effectively.

Memory and disk forensic techniques to find fileless malware, hidden services, and tampering.

Cloud/hybrid pitfalls (Azure AD Connect, OAuth misuse, managed identity risks) and mitigations.