Skip to main content
Xcademia
CYB-0301ExpertCurrent Intake
XART

Xcademia Advanced Red Team Practitioner

10-Day Instructor-Led Programme

The XART Certification Programme is the practitioner standard for advanced red team operators who conduct adversary simulation engagements, bypass modern endpoint defences, operate persistent C2 infrastructure, and produce MITRE ATT&CK-mapped red team reports for strategic security improvement. Assessed on Day 10 through a supervised full-day adversary simulation against a defended enterprise environment. No 48-hour solo exam.

Duration

10 Days

Price

$8,745

Xcademia Advanced Red Team Practitioner
Duration
10 Days
Complete in 10 days
Learning Style
Mentor-led, practical and scenario-based
Guided walkthroughs, real-world examples, and applied skills for the workplace.

Course Overview

Penetration testing tells you what vulnerabilities exist. Red teaming tells you whether your defences can detect and stop a determined adversary. XART is built for the operator who has already earned XEHP or equivalent and now wants to develop advanced adversary simulation capability: custom C2 infrastructure with evasive profiles, ADCS and advanced Active Directory attacks, custom payload development, cloud-scale lateral movement, and the full adversary simulation methodology that delivers strategic value rather than vulnerability lists.

Across ten instructor-led days, participants build capability across the complete advanced red team lifecycle: threat actor emulation methodology, C2 framework design and operational security, advanced Active Directory attacks (ADCS, Kerberos delegation abuse, cross-forest trust exploitation), custom payload development and EDR bypass engineering, advanced initial access techniques, cloud and container red teaming at depth, adversary simulation campaign execution, anti-forensics and OPSEC, and professional red team report production aligned to MITRE ATT&CK. Every session uses realistic enterprise targets with defensive tooling active.

On Day 10, participants conduct a full-day supervised adversary simulation against a representative enterprise environment with EDR and SIEM active. They plan, execute, and document the engagement with a Cobalt Strike or Sliver C2, bypassing defences and achieving objectives within a defined threat actor profile. A senior red team practitioner observes methodology at key decision points. XART certificate and Practitioner Assessment Report issued together.

Hands-On Learning

Live C2 infrastructure build across Cobalt Strike and Sliver, ADCS exploitation labs, EDR bypass engineering sessions, custom shellcode loader development, cloud red team labs across AWS and Azure AD, and a full-day supervised adversary simulation on Day 10.

Mentor-Led Sessions

Mentor-led sessions mapping real advanced persistent threat TTPs to MITRE ATT&CK v14, examining what blue teams actually detect vs miss, and building the threat actor emulation plans that turn red team findings into strategic security decisions.

Career-Ready Skills

Plan and execute full adversary simulation engagements with custom C2 infrastructure, advanced Active Directory exploitation, modern EDR bypass, and cloud red team capability, producing ATT&CK-mapped reports that drive measurable security improvement.

Learning Outcomes

Plan and execute advanced adversary simulation engagements using threat actor emulation methodology with custom C2 infrastructure and ATT&CK-aligned technique selection

Design and operate C2 infrastructure with evasive traffic profiles, redirectors, and OPSEC controls that survive analysis by blue team investigators

Exploit advanced Active Directory vulnerabilities including ADCS ESC chains, Kerberos delegation abuse, cross-forest trusts, and ACE-based persistence

Develop custom shellcode loaders and evasive payloads that bypass modern EDR platforms including CrowdStrike, SentinelOne, and Microsoft Defender

Conduct cloud red team operations across AWS, Azure AD, and Microsoft 365 achieving objectives through IAM, federation, and cloud service exploitation

Produce professional ATT&CK-mapped red team reports with executive narrative, technique heat maps, and strategic remediation roadmaps

Prerequisites

1

Completion of XEHP or OSCP or equivalent with minimum 2 years of hands-on penetration testing experience

2

Working knowledge of Active Directory, Windows exploitation, and at least one C2 framework

3

Comfort with Python or PowerShell scripting for payload modification and automation

Detailed Syllabus

Organized by professional domains with comprehensive coverage

Topics Covered:
  • •Red team vs penetration test vs adversary simulation: objectives, scope, and rules of engagement distinctions
  • •Threat actor emulation: selecting and profiling an appropriate adversary for the target sector using CTI
  • •Red team charter design: objectives, success criteria, out-of-scope conditions, and deconfliction process
  • •MITRE ATT&CK for red teams: technique selection based on threat intelligence and target defensive posture
  • •Multi-phase red team engagement planning: reconnaissance through impact with milestone-based governance
Stage 5Final Capstone

Xcademia Advanced Red Team Practitioner — Capstone Project

On Day 10, participants receive a threat actor profile and a scoped enterprise environment with active EDR and SIEM monitoring. They design and execute an adversary simulation engagement over the full day: infrastructure setup, initial access, internal reconnaissance, privilege escalation, lateral movement to objectives, and evidence collection for the report. The senior practitioner observes methodology at key decision points and evaluates the final ATT&CK-mapped red team report. Certificate and Practitioner Assessment Report issued together on passing standard.

Assessed by a senior Xcademia practitioner

Framework Alignment

This course is mapped directly onto the standards your organisation already answers to. No invented frameworks, no proprietary jargon.

  • MITRE ATT&CK v14

    Global

    Primary adversary simulation framework: all techniques mapped to tactic and technique IDs throughout

  • MITRE ATLAS

    Global

    AI-specific adversary techniques referenced in AI-enabled threat actor module

  • PTES

    Global

    Penetration Testing Execution Standard: engagement lifecycle methodology foundation

  • CBEST

    Global

    Bank of England threat-led penetration testing: advanced red team positioning context

  • TIBER-EU

    Global

    EU threat intelligence-based ethical red teaming: adversary simulation regulatory context

  • NIST SP 800-115

    Global

    Technical engagement scoping, rules of engagement, and reporting standards

  • DORA TLPT

    Global

    DORA Threat-Led Penetration Testing: financial sector adversary simulation requirements

  • DoD 8140

    Global

    US defence workforce framework: red team operator and exploitation analyst role categories

Skills You'll Gain

Master these in-demand skills through hands-on practice

Adversary simulation methodologyC2 infrastructure design (Cobalt Strike/Sliver)ADCS exploitation (ESC1-ESC8)Custom payload developmentEDR and AMSI bypassAiTM phishing (Evilginx2)AWS and Azure AD red teamingKubernetes red teamingAnti-forensics and OPSECATT&CK-mapped report writingPhysical red team operationsPurple team collaboration

Career Progression

A clear view of the roles this programme supports, what typically comes next, and where learners progress over time

Red Team OperatorRed Team LeadSenior Penetration TesterAdversary Simulation SpecialistOffensive Security EngineerPurple Team Lead
Flexible Delivery Options

Ways to Learn

Choose the learning format that works best for you and your team

Book Now

Live Online

Instructor-Led Training

Join live instructor-led sessions from anywhere. Interactive, engaging, and flexible.

10 Days
Small cohorts
  • Live instructor interaction (real-time)
  • Trainer-led walkthroughs and real examples
  • Guided resources and session notes provided
  • Structured Q&A and practical discussion

Price per person

$8,745+ VAT

Group enrolments and early planning options available.

All prices are exclusive of VAT where applicable. Group enrolments and custom packages available on request.

Premium Training Option

Prefer a Faster, Personalised Route into IT?

Not everyone learns best in a group. If you want focused guidance, faster clarity, and confidence you can use on the job, our 1-to-1 Fast-Track Training gives you private, mentor-led support tailored to your experience and goals.

Personalised Xcademia Advanced Red Team Practitioner learning plan
Tailored to your pace and goals
Live 1-to-1 sessions
With an experienced mentor
Real-world troubleshooting
Practice, not just exam theory
Flexible scheduling
To fit around work, study, or family

"Many learners choose 1-to-1 when they want understanding, not memorisation."

Explore 1-to-1 Fast-Track Training

Exam & Certification Information

Everything you need to know about the certification exams

Xcademia Certification Programme

Xcademia Certification Programme

On successful completion of Xcademia Advanced Red Team Practitioner, learners are assessed on the final day through a supervised practitioner scenario. Three outcomes are possible, Certificate Awarded, Certificate Deferred, or Not Awarded. The Practitioner Assessment Report and certificate are issued together. Verified at xcademia.com/verify.

Certificate Awarded

Assessed competent on the final day.

Certificate Deferred

Resit available on a future cohort.

Not Awarded

Attendance record issued. Reassessment possible.

Frequently Asked Questions

Everything you need to know about this course

OSEP is a 48-hour solo practical exam requiring Learn One subscription at $2,749 per year. XART is 10 instructor-led days with a senior practitioner present, ending in a supervised full-day adversary simulation on Day 10. The practitioner observes C2 design, detection evasion, and operational decision-making. The Practitioner Assessment Report documents advanced red team methodology capability.

Share:

Ready to Start Your Learning Journey?

Take the next step in your professional development

Digital certificate upon completion
Comprehensive course materials
Expert instructor support
Flexible learning options