Specter Bash 2026 Trainings

Specter Bash 2026 is a "spirited" week of SpecterOps training courses! (And food's included!) About Specter Bash Specter Bash is an annual, community-focused training event with a Halloween twist hosted by SpecterOps. This year we're offering the following Adversary Tactics courses at Specter Bash (see below sections for more course details): • Adversary Tactics: Red Team Operations • Adversary Tactics: Identity-driven Offensive Tradecraft • Adversary Tactics: Detection • Adversary Perspectives: Azure The trainings will run Monday (Oct 5) to Thursday (Oct 8). We hope you'll join us, it'll be scary-fun! Specter Bash 2024 In-person Attendee Benefits By attending in person you'll receive the following exclusive benefits: • (Spooky) Evening events to connect with industry peers • Food! (Breakfast & Lunch provided throughout the event; Dinner provided Monday - Wednesday) • Exclusive event-themed swag Evening Events • Monday Night - Welcome Reception • Tuesday Night - Group Dinner (Instructors and Students) • Wednesday Night - Fireside Chats and Costume Contest Venue Specter Bash will take place at The Inverness in Denver, CO (200 Inverness Dr W, Englewood, CO 80112, USA) Venue Amenities: • Located on an 18-hole golf course • Adjoining Breckenridge Brewery • Luxury spa on-site • 30 minutes from Denver International Airport Specter Bash Trainings Upgrade your skills by taking one of our four different courses • In-depth four-day-long courses • Engage with our Frontline Practitioners • Hands-on Labs throughout the courses • Note: Only in-person training tickets are considered part of the Specter Bash event; virtual tickets do not include the in-person benefits of the event Adversary Tactics: Red Team Operations Upgrade your Red Team engagements with bleeding-edge Tactics, Techniques, and Procedures (TTPs) used by attackers in real-world breaches. This course will teach participants how to infiltrate networks, gather intelligence, and covertly persist in a network like an advanced adversary. Participants will use the skillsets taught in Adversary Tactics: Red Team Operations to go up against live incident responders in an enterprise lab environment designed to mimic a mature real-world network. Participants will learn to adapt and overcome Blue Team response through collaborative feedback as the course progresses. Topics covered include: • Design and deploy sophisticated, resilient covert attack infrastructure • Utilize advanced Active Directory attack techniques to execute domain enumeration, escalation, and persistence • Perform sophisticated post-exploitation actions, including sophisticated data mining, going beyond just achieving “Domain Admin” • Use cutting-edge lateral movement methods to move through the enterprise • Practice “offense-in-depth” by utilizing a variety of tools and techniques in response to defender actions and technical defenses • Effectively train network defenders to better protect themselves against advanced, persistent adversaries Full course details here. Adversary Tactics: Identity-driven Offensive Tradecraft As modern architecture increasingly shifts services and data from on-premises infrastructure to the cloud, Identity becomes the thread that ties everything together. Our Adversary Tactics: Identity-driven Offensive Tradecraft course is a follow-on to our Adversary Tactics: Red Team Operations course and offers an in-depth look at identity-driven attacks, targeting both on-premises and hybrid identities. Participants will learn how to abuse the intricacies of different authentication and authorization mechanisms to traverse on-premises and cloud environments, gain access to integrated systems, and even cross tenants. Participants will also be equipped with a practical approach to identifying known attack paths and forging new ones within complex operational environments and across people, processes, and technology. Full course details here. Adversary Tactics: Detection You bought all the latest detection tools, but somehow still can't seem to detect mimikatz. IT is screaming about the resource consumption from the multitude of security tools on the endpoints, analysts are barely staying afloat in the oceans of data your toolsets have created, and the latest red team report detailed how response actions were ineffective again. If this sounds familiar for your organization, this is the course for you. We'll walk you through starting with a detection engineering strategy first and then focusing on methodologies to build robust alerting, with the end result of improving detection and response capabilities throughout security operations. This course will provide you the understanding and ability to build robust detections, starting with the why and going all the way to the technical implementation of detecting threat actor activity. You will learn how to apply the methodologies and technical approaches practiced, regardless of the security toolsets deployed in your organization. Adversary Tactics: Detection builds on standard network defense and incident response (which often focuses on alerting for known malware signatures) by focusing on abnormal behaviors and the use of adversary Tactics, Techniques, and Procedures (TTPs). We will teach you how to engineer detections based on attacker TTPs to perform threat hunting operations and detect attacker activity. In addition, you will learn use utilize free and/or open source data collection and analysis tools (such as Sysmon, Windows Event Logs, and ELK) to analyze large amounts of host information and build detections for malicious activity. You will use the techniques and toolsets you learn to create threat hunting hypotheses and build robust detections in a simulated enterprise network undergoing active compromise from various types of threat actors. Full course details here. Adversary Perspectives: Azure Organizations have their heads in the clouds, or at least their infrastructure. Gone are the days of on-premises domain controllers and Exchange servers. Microsoft’s Azure provides organizations with the ability to deploy cloud hosts and services to augment, or in some cases, replace existing functionality completely. All of these new cloud assets need protection, both through traditional defensive security measures, and offensive security assessments. For new and veteran security professionals alike, understanding how these new technologies work and the nuances of securing them can quickly become complicated. Adversary Perspectives: Azure provides participants without previous Azure experience with a solid understanding of how attackers look at Microsoft Azure and Entra ID, its authentication mechanisms, and how they commonly attack Azure-based environments. Full course details here. Virtual Trainings If traveling to Denver, CO isn’t feasible, you can opt to take the course virtually online through Zoom. You will receive the same training portal access and watch the live instruction. However, the virtual training is not part of Specter Bash – remote attendees will NOT receive any of the exclusive benefits that come with in-person attendance. Remote attendees will receive logistics emails and credentials the week before the trainings. Specter Bash is the in-person only event that complements the trainings; virtual tickets are not part of Specter Bash. Questions? Reach out to [email protected] and a Specter will be in touch soon! Special Tickets Are you a member of the U.S.