Purple Teaming with Cobalt Strike
Premium 5-Day Cyber Security Training
Adversary Simulation & Detection in Critical Environments
A premium five-day course where participants switch hats between attacker and defender, learning to compromise enterprise IT, pivot into operational technology, and defend industrial systems with professional incident response.
Why This Course?
This is not a traditional cyber security course. It’s an elite, hands-on program built for the new reality of converged IT and OT environments. You'll switch roles between attacker and defender, mastering the full adversary lifecycle from initial breach to industrial disruption. This is a deeper, more immersive experience that goes beyond standard training, culminating in a professional-grade incident response.
🚀 Course Overview
Offense
Learn to breach enterprise IT environments, escalate privileges, and pivot into operational networks. Gain hands-on adversary simulation tradecraft.
Defense
Practice detecting, investigating, and containing attacks across both IT and OT environments. Strengthen your hunt and incident response skills.
Purple Teaming
Align offense and defense in real time, closing detection gaps and generating actionable improvements.
Capstone
Conclude with a full IT→OT attack campaign, followed by live response and professional-grade reporting.
📅 The 5-Day Journey
- Establish a realistic foothold in enterprise IT and simulate attacker persistence.
- Detect and triage early intrusion indicators across logs and network traces.
- Refine early detection hunts and playbooks in joint red/blue debriefs.
- Escalate privileges and move laterally across the IT environment.
- Hunt abnormal authentication, SMB/RDP and lateral activity in real time.
- Co-develop playbooks and containment triggers for lateral movement detection.
- Compromise Active Directory, establish persistence, and stage attacks.
- Investigate domain anomalies and IT→OT pivot attempts across boundaries.
- Close detection gaps and strengthen monitoring at jump points.
- Target SCADA and engineering workstations in a safe, controlled lab.
- Detect OT protocol anomalies and correlate them with IT indicators.
- Build unified incident timelines that connect IT intrusions to OT effects.
- Execute a full IT→OT adversary campaign under realistic time pressure.
- Respond in real time, from detection through containment and recovery.
- Produce a professional-grade incident report and executive briefing.
🔑 What Makes This Course Different?
Realism
Not just theory. Every stage takes place in a live-fire lab where both attack and defense are exercised against realistic scenarios.
Balance
Unlike traditional courses, participants experience both sides of the engagement and see how real adversaries move across IT and OT.
Outcomes
Leave with confidence, a polished incident report, and the ability to apply lessons directly in enterprise and industrial contexts.
Who Should Attend?
Red teamers, blue teamers, SOC analysts, OT defenders, security leaders. Anyone serious about mastering IT→OT adversary simulation and detection.
Prerequisites
Familiarity with Windows and networking concepts is helpful. No prior OT experience required — the labs guide you end-to-end.