arrow-right-down binary-offensive.com


HomeSoftwareTrainingsSubscribeBlogContact
Student AreaRMF Area


  1. » Want to practice many Initial Access vectors and see which still work?
  2. » In need to write your own Red Team malware, and you're seeking hints on coding it safely?
  3. » Interested in delving into successful Complex Infection Chains, exotic file formats, or functional shellcode loader patterns?

Buckle up and sign in to a 3-day intensive ride through viable tactics - join 100+ satisfied students!


By subscribing you'll receive lifetime access to training materials, including all future updates - accessible from Student's Area.



Revamping my ☢️ Modern Initial Access training feels soo good!
Next week's @x33fcon session will be a blast!

- Nuked away VBA slides
- 10 leaked code signing certs & abuse guidance
- Signed & weaponized MSIX
- Signed ClickOnce (hopefully!)🤞
- plenty of Complex Infection Chains pic.twitter.com/ljQOXm6ioK

— mgeeky | Mariusz Banach (@mariuszbit) May 27, 2023


Overview

This intermediate-level, 3-day-long intensive course dives deep into Modern Initial Access and Evasion tactics, which were effective on numerous engagements delivered in tightly monitored environments. The author will share his insights regarding strategies that made his malware accomplish engagement objectives, side by side with aggressively configured AVs & EDRs.

Designing modern Red Team malware carriers smuggled in scripts, executables, and HTML websites are only some areas the course focuses on. We will explore numerous technical concepts and file formats. Craft advanced malicious Office documents, shellcode loaders, smuggling payloads, and other infected scripts that will help us reach target systems effectively.

By applying modern AV & EDR evasion techniques into custom-crafted Red Team weaponry, capable teams will be equipped with the knowledge to succeed during adversary simulations even in the rapidly changing threat surface landscape.

This course focuses on that - telling effective techniques apart from ones that no longer work.
1

Course Content

Day 1 - Classic Initial Access

  1. » Hello Mythic C2
  2. » Introduction
    1. » Modern Cyberdefence Stack
    2. » Initial Access and Evasion Tactics
    3. » Classic file infection vectors
      1. » Windows Script Host files: VBS/VBE, JS/JSE, HTA, WSF
      2. » AutoIt3
      3. » COM Scriptlets
      4. » Executables
      5. » Maldocs
      6. » CHMs
      7. » LNKs, Polyglot LNKs
    4. » MSI Shenanigans
      1. » MSI weaponization strategies
      2. » Backdooring MSIs
1

Day 2 - New Hope

  1. » The Beauty of HTML Smuggling
  2. » Hosting Thy Payloads
  3. » Code Signed Threats
    1. » Fantastic Code Certs And Where To Find Them
  4. » MSIX + APPX
  5. » .NET Tactics
    1. » Local & Remote AppDomain Manager Injections
    2. » Resolving WinAPIs in C# World
  6. » ClickOnce Deployments
  7. » Containerized Malware
  8. » Complex Infection Chains ❤️
    1. » Containers, Triggers, Payloads & Decoys
    2. » Search-MS + WebDAV = 🔥
    3. » Successful Tactics
1

Day 3 - Executables & Shellcode Loaders

  1. » Protectors, Obfuscators
  2. » Backdooring EXEs & DLLs
  3. » Implant Watermarking
  4. » Meet Shellcode Loader
  5. » Hiding shellcodes in PE sections, overlay, resources, certificate area
  6. » Code Signing & Leaked certificates: MSI, NVIDIA & 5 others
  7. » Basic Evasions
    1. » Strings obfuscation
    2. » Entropy, File Bloating, Pumping
    3. » Time-Delayed Execution, Beating Emulators
    4. » Fooling ImpHash
    5. » AMSI, ETW - get off my lawn
    6. » Attacking EDR's design
  8. » Calling WinAPI Safely
    1. » EDR on the Hook
    2. » Direct Syscalls
    3. » Indirect Syscalls
    4. » Asynchronous execution: FOLIAGE-style
  9. » Call Stack Obfuscation
    1. » Problem Analysis
    2. » Return Address overwrite
    3. » Spoofing
  10. » Other exotic evasions
    1. » Evading Kernel Module Load callbacks
    2. » Queuing LoadLibrary
  11. » Outro

Appendix - Maldocs

  1. » A guide through VBA infection strategies
  2. » Various means to execute implants in VBA - .NET Reflection, XSL Deserialization, and more
  3. » "Lures" - how to entice user into enabling macros
  4. » Hiding Payloads in Office structures
  5. » Alternative Macro autorun techniques
  6. » Exotic VBA carriers
    1. » Publisher, RTF files
    2. » Outlook's VbaProject.OTM
    3. » MS Access, Visio, Project
  7. » Evasion Tactics
    1. » Sandbox Evasion
    2. » Office Trusted Paths + AMSI
    3. » Code obfuscation
    4. » File Encryption

Lifetime Access to Latest Materials pack!

After training starts, you'll get exclusive access to Student's Area where you will find the training's latest materials.
I keep updating slides, code samples, and tools included with the training before every session (otherwise, I'd be teaching obsoleted TTPs; nobody wants that - me included!).

So, I want you to have access to the latest materials pack, even if you attended this course several rounds ago!
1

Get Certified

Prove your Initial Access skills by snatching unique certificate!
1

Target Audience

This training is designed to supply practical knowledge variety of IT specialists, including:


  1. » Penetration Testers
  2. » Red Team operators, Purple Team members
  3. » SOC analysts, Threat Hunters, Detection Engineers
  4. » Security Professionals
  5. » IT Support, administrative and network personnel

About Author

1
1
Mariusz is an active security researcher, pentester, and red team operator currently involved in advanced adversary simulations for an international Bank.

With 8+ years long experience gained as a malware analyst and AV engine developer, penetration tester who performed tens of assessments of exotic networks and systems, and finally as a red team operator - he now teaches, helps analyze, and devices new Threat Tactics, Techniques, and Procedures (TTPs).

He is best known for his research on malware development and frequent releases of offensive tools that help red teams bolster their game against cybersecurity criminals. Most of his work is published on github.com/mgeeky .

Passionately provides his Partners unique advisory, learning, and detection opportunities by sharing security expertise ranging from applications through corporate infrastructures, domain environments, and clouds - ending on Windows low-level. Over the years, he has acquired several certifications.

Training Dates

Here are the next dates planned:

VenueTraining TitleDatesDaysSeats TakenConfirmed? *Sign Up
* Training is considered confirmed when there's at least 40% seats taken.


Pricing

Prices are for 3 days Online training organized by myself. To check the current training price, click on the Sign Up button.
For a private offer, contact me.

TypePrice
Early-Bird - First Two weeks after announcing training slot1500 EUR
Regular1700 EUR
Last Minute - last two weeks before training's start date2000 EUR


By registering for the Training, you give your consent to all of the registration terms and conditions

Stay up to date with Binary-Offensive newsletter


Want to stay informed on my future training sessions, software releases, blog posts, and other Red Team-related goodies?

Consider signing up for the newsletter. I promise to send, at most, 1-2 emails per month.

Whenever you wish to unsubscribe, an unsubscribe-me link will be attached to each message sent, so don't worry about changing your mind.


Didn't you receive any email from me? Try checking in Spam & whitelisting the binary-offensive.com domain.
Some mail servers (like Office365) consider my domain suspicious.
That's what I get for publishing open-source offensive tooling ¯\_(ツ)_/¯

What others
think about my trainings?


Image

Gerardo. Ruiz
These last two weeks were hectic but incredibly rewarding as I completed the Initial Access Workshop under the expert guidance of Mariusz Banach.
This advanced training focused on the tactics, techniques, and procedures used by Threat Actors and Red Teams to establish initial footholds in network environments.
We delved into recently abused file vectors, macro-enabled Office documents, executable formats, and strategies for evading various cybersecurity controls.
The hands-on approach allowed us to understand and practice real-world scenarios, preparing us to defend our networks better.
I’m thrilled to have gained this certification and am eager to apply these critical insights to enhancing our cybersecurity posture.
A huge thank you to Mariusz Banach for leading this enlightening workshop!
#CyberSecurity #RedTeam #ThreatIntelligence #InfoSec #Certification

Posted on LinkedIn


Posted on LinkedIn
Image

Alireza Vahdad
Thrilled to announce my completion of the "Modern Initial Access and Evasion Tactics" training!
What an intense yet incredible journey and a valuable addition to my arsenal of initial access strategies!
Huge thanks to Mariusz Banach for his insightful teachings and warm personality.
Connecting with you was a fantastic bonus of the course! 😊
I highly recommend this course to anyone eager to deepen their understanding and skillset in this domain.

Posted on LinkedIn

Image

Mitchel Jordan - Senior Security Engineer, Praetorian Security, Inc.
Mariusz is a passionate security researcher with a depth of knowledge to share during the Modern Initial Access & Evasion Tactics course.
I walked away with several new TTPs and ideas to operationalize/incorporate into my team's engagements.
Will for sure be on the lookout for his future workshops.

Image

Eternalkyu @eternalky_u
Mariusz Banach's (mgeeky) 'Modern Initial Access and Evasion Tactics' course was the first training I took this year.
Here is my review, written from the perspective of an experienced web developer.

@jhaddix's TBBHM training (which I took in December 2023) suggested Mariusz's course, and the upcoming session was already fully booked, so I could not wait for a spot to open up in the next training.
I promptly reserved a seat after Mariusz announced the new schedule around Christmas.

What immediately stood out to me was that the whole course, communication, and execution were so well-prepared and professional:

  1. » You get lifetime access to a student VM containing all the training tools, code, and a lot of scripts that Mariusz wrote himself, which makes using the provided material so much easier.
  2. » You get access to various hosted apps, e.g., a Mythic C2 instance, that Mariusz provides. The provided setup allows you to get your hands dirty with the provided exercises and adds so much to the value of the training.
  3. » You get immediate access to this day's recording at the end of each course day.
  4. » The student area contains up-to-date slides and links to the recordings, so you can always come back and review the material again.

... Read more on Eternalkyu's blogpost!


Posted on LinkedIn
Image

Sean @au5_mate
Just finished up @mariuszbit's initial access course.
Despite being well-versed in the topic beforehand, I learned some awesome new tips and tricks, and gained some further knowledge of concepts
that I just hadn't reached the same depth of understanding of before the course.

Would definitely recommend it for anyone looking to upskill or reinforce their knowledge of initial access TTPs, lots for both Red & Blue teamers to take away from it!

Posted on Twitter

Image

Arthur @theart42
Mariusz knows the subjects really really well, has done a lot of work on tooling himself and is able to explain it really well.
These are three days of intense information absorption I can apply in my work.

Posted on Twitter

Image

Cory Rondorf
I recently had the opportunity to take "Modern Initial Access and Evasion Tactics" by Mariusz Banach (binary-offensive.com).
It's a fantastic course exploring various modern initial access techniques and AV/EDR evasion strategies.
I highly recommend this course for any offensive security professionals.
#redteam #edr #evasion #phishing #offensivesecurity

Posted on LinkedIn


Posted on LinkedIn

Posted on LinkedIn

Posted on LinkedIn

Posted on LinkedIn
Image

Pierre @pruno9
Mgeeky really knows its subject and succeeds at transmiting the core concept in a limited amount of time.
Even for the parts he claims not knowing very well he still took the time to do the research to give us some basic concepts to expand on.
Too bad Microsoft pretty much killed macros because Mgeeky really worked on that and it shows, still very interesting even less usable than before.
In summary, a very interesting course with actually usable and facilitated (with mgeeky's provided tools) tactics.


Posted on LinkedIn

Posted on LinkedIn

Posted on LinkedIn

Posted on LinkedIn

Posted on LinkedIn

Posted on LinkedIn

Posted on LinkedIn
Image

Stefan Bauregger
Mgeeky shows in this training that he is a top-notch red teamer and shares his knowledge, insights and war-stories.
It was amazing to hear about his methodology and to get access to some of his tooling.

Image

Dipen Patel
Marius is exceptional with his course, content.
I have learned a lot of new things during the class, the course is up to date with real world examples.
I highly recommend this course to anyone who seeking to learn new things or upgrade their current knowledge.

Image

Ivan Da Silva @humble_desser
Mariusz Banach is a red team operator and former malware analyst that has poured his heart and knowledge into his Malware Development training.
I was lucky enough to take his training and I was impressed with his research and knowledge of the subject(s).
I would recommend this training to anyone interest into getting familiar with malware development.

Also mentioned on LinkedIn

Image

Jakub Dzieciątko @aol1306
Mariusz created the best training on malware development I have ever attended and has great teaching skills. He's clearly an expert on the topic and he enjoys sharing his own research. I'm going to recommend his work to anyone interested in red teaming. The things I liked the most about it:
- the amount of useful content
- the materials created in a way I can easily use them later
- inspiring methods of tool creation
- good organization - infection divided into stages, each stage well explained and multiple techniques presented
- going together with the exercises so I could see how you work
- presenting methods to find our own evasion etc techniques

Image

Olivier Lamotte @olamotte33
Throughout the fast-paced training Mariusz took the time to engage with students to make sure every topic became clear. Mariusz's contributions to the offensive security community are always mindful of the impact on the defensive side, which is too rare these days. Thank you for a great training with a ton of actionable content.

Today was the last day of @mariuszbit's training. I can honestly recommend it to anyone, who is interested in Red Teaming. Content is great and I can't wait to deploy some novel initial access techniques. Wanna decrease detection rate of your implants? Then,this is a no-brainer👍

— Jan Kopecky (@rnmx123) October 21, 2022
Image

anonymized @anonymized
Hey guys, I can confirm that me and other guys from our team had a training from Mariusz last week. The framework looks pretty l33t, but I still haven't explored most of it... it is actually pretty big 😄 so, I'm still discovering all the possibilities. The training was amazing and as far as initial access and all kind of tactics to keep your malware undetected are concerned, it was even better than [CUT] or [CUT] 👍🏻

Contact

If you have any questions, concerns or doubts about the training, session dates available or you're interested in arranging a private session tailored specifically to your Team's needs and calendar - let me know!

I'm always open for a collaboration and brainstorming.

  1. » Mail me on mb[at]binary-offensive.com


  • Mail me
  • Reach me out on LinkedIn
  • Follow me on Twitter
  • Check out my Github


Copyright © 2022 binary-offensive.com | designed by www.ombre.tech