0 What is CRTL⌗

The Certified Red Team Lead (CRTL) certification from Zero-Point Security provides candidates with the knowledge and practical skills required to operate against modern defensive technologies, including Endpoint Detection and Response (EDR) solutions.

The course covers a range of theoretical and practical topics, including C2 infrastructure, Windows internals, process injection, defence evasion, credential guard, Windows Defender Application Control, protected processes, and EDR evasion.

In Chapter 2, I’ll take a closer look at the course curriculum and discuss the topics, skills, and concepts covered throughout the CRTL.

1 Why the CRTL⌗

Back in May, I completed the Certified Red Team Operator (CRTO) and successfully passed the exam. Naturally, the next logical step was to take it up a notch and tackle the Certified Red Team Lead (CRTL).

While the CRTO focuses more on the fundamentals of red teaming, the CRTL takes things considerably further. The course dives deeper into evasion, operational security (OPSEC), and the techniques involved in conducting operations while minimizing the chances of detection by modern defensive technologies such as EDR.

A lot of the concepts covered by the CRTL are also areas I’ve been exploring as a hobby for several years, which made the certification a natural fit for me. Rather than pursuing it for a specific career goal, I mainly took the CRTL because I genuinely enjoy this field and wanted to deepen my knowledge and learn some new techniques, particularly when it comes to working with Cobalt Strike.

In other words, I took the CRTL because I could, and because it sounded like a fun way to learn something new.

2 CRTL Course⌗

The course is divided into twelve chapters, ten of which focus on the theoretical and practical aspects of the certification.

One of the first things you learn is how to set up redirectors for your team server, configured to only allow your intended target to connect. This helps reduce the overall risk profile of the infrastructure and provides an additional layer of separation between the operator and the target environment. The course covers both Nginx and Apache redirectors, giving you hands-on experience with each approach.

The course then moves into what actually happens within an Endpoint Detection and Response (EDR) solution: what it looks for, how it detects activity, and the mechanisms it uses to identify potentially malicious behavior. The goal is to build a solid understanding of how these technologies work before moving on to techniques for evading them. Simply put, understanding how something works gives you a much better foundation for understanding how it can potentially be bypassed.

This chapter is particularly thorough. The first part covers topics such as IAT hooking, inline hooking, syscalls, Hell’s Gate, and Halo’s Gate, supported by examples, diagrams, and debugger output to illustrate what is happening under the hood.

The second part focuses on call stacks and covers topics such as function prologues, stack unwinding, what clean call stacks look like, what an “unclean” call stack looks like, call stack spoofing, and API proxying.

The final two sections dive deeper into what happens within the Windows kernel. This includes examining which functions EDR solutions rely on to receive notifications when processes are created, images are loaded, or registry changes occur.

The next two chapters are, in my opinion, some of the most important and interesting parts of the course: Loadtime Evasion and Runtime Evasion.

This is where the course really begins to bring the previous concepts together and apply them to the practical side of EDR evasion. It covers topics such as memory permissions and why simply having large regions of memory marked as RWX is not necessarily ideal from an evasion perspective.

From there, the course explores how IAT hooking works, how indirect syscalls can be implemented, and how memory obfuscation can be applied in practice.

Throughout the course, the code and techniques gradually come together into what is essentially an evasion framework called CrystalPalace. This becomes your toolkit for working with Cobalt Strike and is also used during the exam.

CrystalKit serves as the central component of the CRTL course, tying many of the techniques covered throughout the different chapters together into a single practical framework.

The next chapter covers Post-Exploitation Evasion. It provides guidance on post-exploitation activities once a beacon has been established, including techniques for reducing the likelihood of detection by EDR solutions.

The chapter also covers the spawnto commandlet and how it can be used to make process execution appear less suspicious by launching processes with appropriate command-line arguments rather than relying solely on the base binary. One example is using msiexec.exe with legitimate-looking arguments.

Additionally, the chapter discusses tool signatures and approaches for dealing with them to reduce detections associated with commonly used tools such as Rubeus.

The following chapter covers User Impersonation & Lateral Movement, which is another important part of the course. It focuses on understanding how lateral movement between hosts can generate EDR detections and how legitimate applications and workflows can be used to make activity blend more naturally into the surrounding environment.

The chapter explores how certain applications generate the same types of events as those produced during lateral movement by design, and how understanding these behaviors can help you better understand the telemetry generated during an engagement.

The Vulnerable Drivers chapter covers how vulnerable drivers can be abused to interfere with or disable EDR defenses. A common term for this technique is BYOVD (Bring Your Own Vulnerable Driver).

This is also a topic I have researched previously, including work with EchoDrv.sys several years ago. It was interesting to revisit the subject in the context of the CRTL course and see how the techniques have evolved.

The App Control for Business chapter focuses on WDAC (Windows Defender Application Control). WDAC differs from AppLocker in several important ways, including its ability to enforce application control at the kernel level in addition to the user level.

This makes WDAC considerably more challenging to work around. The course discusses various techniques involving signed binaries, as well as the importance of examining the policies deployed on the target system. Since WDAC configurations can vary significantly between environments, understanding the specific policy in place is an important part of assessing how application control is being enforced.

The final technical chapter covers Credential Guard. Credential Guard uses hardware virtualization and the Windows hypervisor to isolate sensitive authentication material, such as NTLM hashes, Kerberos Ticket Granting Tickets (TGTs), and other authentication credentials, inside a secure virtualized environment.

This makes certain attack paths and delegation scenarios considerably more difficult to exploit, including scenarios involving Constrained Delegation and Resource-Based Constrained Delegation (RBCD). Credential Guard also does not permit Unconstrained delegation, so any tactics that rely on it (such as relaying) are no longer possible.

The chapter explores alternative approaches that can be used to work within these restrictions and discusses how Credential Guard changes the available attack surface.

The final two chapters cover the certificate of completion, which you receive after completing the course, and the final examination. Successfully passing the exam awards you the Red Team Lead Certification.

3 CRTL Labs⌗

The CRTL courses are accompanied by labs. These labs are designed to guide you through what you need to accomplish to achieve the operational objective, effectively helping you understand both what to do and how to do it.

The labs can only be started once within a 24-hour period, likely to prevent repeated resets and unnecessary resource usage across environments. Each lab also has a time limit, for example; 45 minutes, after which the session ends if you are not finished. In that case, you can attempt the lab again after the cooldown period.

Since the lab environments are largely consistent across the course, a practical way to practice is to redo labs you have already completed, aiming to improve speed and familiarity with the workflow. You can even take on challenges from other labs within these environments, which helps bypass this cooldown timer a bit.

Personally, I felt that the allocated lab time was not always sufficient for certain exercises. This may partly be due to my own approach to learning, as I wanted to fully understand what was happening under the hood and how all the different components worked together.

Additionally, I wanted to be as well prepared as possible for the exam. Since I did not know exactly what to expect, I spent extra time practicing the entire setup process from the ground up. As a result, I sometimes needed more time than the allotted lab time allowed.

The CRTL labs follow a similar approach to the CRTO labs, providing a guided, step-by-step learning experience. The examples first show what the EDR detected and which aspects of the activity triggered an alert. You are then shown how to apply an evasion technique, followed by another example demonstrating how the EDR responds after the bypass has been implemented.

4 CRTL Exam⌗

The exam was… interesting, to say the least. The biggest time sink for me was initially bypassing the Windows Defender Application Control (WDAC) policy. Without giving away what you need to look for, let’s just say that I was very happy to have some vulnerability research experience from my spare time. :)

Keeping a cool head and executing commands with intent also helps tremendously. Whereas the CRTO was more of a case of, “if you see this, do this,” the CRTL is in its own league. You really have to step things up a notch and think more critically about the situation in front of you. This is especially important because some techniques may not work as expected due to Credential Guard being enabled, meaning you need to adapt your approach rather than simply following a familiar playbook.

Once you obtain the first beacon, the exam becomes much more manageable, provided you have set up your CrystalKit correctly. Hopefully, you also made good notes while working through the CRTO, because they can make navigating the CRTL exam considerably easier.

The exam consists of a total of 18 possible points you can achieve in 24 hours, you need 16 at minimum to pass the exam. Achieving the main objective awards you with 10 points, the remaining points are earned by maintaining good OPSEC throughout the engagement.

5 CRTL Conclusion⌗

I really enjoyed completing the CRTL, and in hindsight, my preparation was probably a bit overkill for the exam. That said, I still learned a great deal throughout the process, particularly when it came to conducting a red team engagement while maintaining a strong level of OPSEC.

The exam aligned very well with my existing background, and it was also great to revisit and refresh some of the topics I had previously researched myself. Even when I was already familiar with certain concepts, seeing them presented in the context of a complete red team engagement added a lot of value.

Overall, I want to give credit to RastaMouse for putting together such a well-structured and thoughtfully designed course, lab environment, and exam. Much like the CRTO, the CRTL provides a cohesive learning experience that ties the different concepts together in a practical way.