Sold by: SANS Institute
Deployed on AWS
Advanced red team operations for experienced operators. Covers covert infrastructure, EDR and NDR evasion, kernel-level tradecraft, credential attacks against hardened systems, cloud and identity attacks including Entra ID, and custom tooling development. Includes a full-day capture-the-flag exercise against a hardened multi-domain environment.
Overview
Operate against hardened enterprise and government networks where standard red team techniques fail. SEC665 delivers the advanced tradecraft required when targets have mature security programs, modern EDR/NDR, and cloud-integrated environments.
This course is built for experienced operators: DoD red teams, intel community professionals, and enterprise practitioners who need capabilities beyond foundational penetration testing.
Master advanced offensive operations:
Covert Infrastructure and Initial Access
- Build attribution-resistant C2 infrastructure with Terraform
- Execute AiTM phishing to bypass MFA
- Deliver payloads via WebAssembly smuggling and DLL sideloading
- Evade identity-aware security during reconnaissance
Privilege Escalation and Lateral Movement
- Dump credentials despite Protected Processes and Credential Guard
- Relay attacks over C2 channels in hardened environments
- Move laterally with COM/DCOM while evading EDR telemetry
- Modify Impacket for stealth operations
Cloud and Identity Attacks
- Compromise Entra ID through device code phishing
- Pivot between cloud and on-prem environments
- Exploit AD Certificate Services and Configuration Manager
- Backdoor CI/CD pipelines for persistent access
EDR Research and Kernel Tradecraft
- Reverse engineer EDR kernel components and minifilters
- Develop custom BOFs and obfuscated .NET tooling
- Identify EDR blind spots through callback analysis
- Understand driver exploitation risks and techniques
Culminates in Rogue One, a full-day CTF against a hardened multi-domain environment where you apply everything learned.
36 CPE credits across 5 intensive days.
Highlights
- Master advanced tradecraft: Build attribution-resistant C2 with Terraform. Execute AiTM phishing to bypass MFA. Evade EDR through unhooking, direct syscalls, and kernel callback manipulation. Pivot across cloud and on-prem environments.
- 18 labs including: Credential dumping against Protected Processes and Credential Guard, Impacket modification for stealth, BOF development, EDR minifilter analysis, COM hijacking, and Entra ID device code phishing.
- Culminates in Rogue One CTF: Full-day operation against a hardened multi-domain environment. Built for experienced operators in DoD, intel, and enterprise red teams. 5 days, 36 CPEs.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
SEC665 - Single User | Single user license for Offensive Ops - SEC665: Red Team Ops: Developing Adversary Techniques | $8,780.00 |
Dimensions summary
This listing offers one pricing option: a single-user license billed as a contract. You buy access per user, measured in units. To cover more people, you add more units. The course runs 5 days as instructor-led training, or self-paced over a 4-month access period, and includes 18 hands-on labs. Pricing does not vary by format or tier here. If you need to train a team, the vendor offers group purchasing arranged separately.
Top-of-mind questions for buyers
One unit is a license for one named person to take SEC665: Advanced Red Team Operations. Each learner needs their own unit. You cannot share a single license across multiple people. To train several staff, you buy one unit per person.
No. The single-user license bills as a flat contract per unit. The price does not vary by delivery format. You choose instructor-led delivery over 5 days or self-paced access over 4 months. Either way, you buy one unit per learner at the same rate.
Cost scales in whole units. Each additional learner adds one more single-user license at the same per-unit rate. There is no volume tier built into this listing. If you plan to train a team, the vendor runs a separate group purchasing program with discounted pricing arranged directly.
www.sans.org+1
Helpful?
Vendor refund policy
Refund requests must be submitted by the deadline date specific to User's training event. To find the specific deadline date for User's training event, please go to training event link at <www.sans.org > and click on the cancellations link.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Bishop Fox Offensive Security Services
Strengthen your security posture with Bishop Fox, the leader in offensive security testing. Our expert-driven services help you proactively identify and remediate vulnerabilities before attackers can exploit them. Delivered through the Bishop For portal, hosted on AWS, you can real-time visibility into assessment findings, secure access to detailed reports, and on-demand remediation. Whether securing your applications, cloud environments, networks, AI initiatives, or products, Bishop Fox helps you stay ahead of threats.
Invinsense OXDR is a threat exposure management suite which helps organizations to run remediation focused Continuous Threat Exposure Management Program. It consolidates various tools like Attack Surface Monitoring, Vulnerability Management, Breach and Attack Simulation, Continuous and Automated Red Teaming and RedOps. It helps organisations to reduce risk through proactive threat exposure management that results in remediation.
Leverage cutting-edge AI tools and techniques to enhance offensive security operations. Learn to automate reconnaissance, exploit development, and post-exploitation activities using machine learning and large language models. 18 CPEs.
Develop advanced exploit development skills to discover zero-day vulnerabilities, analyze patches, and write complex exploits targeting modern systems. Learn kernel exploitation, browser attacks, and techniques to bypass contemporary security mitigations. 40 CPEs.
Advanced purple team training to simulate sophisticated threat actor techniques through comprehensive adversary emulation. Learn to plan and execute realistic attack scenarios that test and improve defensive capabilities across complex enterprise environments. 36 CPEs.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.