Public information lays the groundwork
Reconnaissance and OSINT help select targets, technologies, people and an initial access scenario.
[ Two-day practical workshop ]
Understand the attacker's path before they take it through your infrastructure.
In safely prepared MS Azure labs, participants work through the entire attack chain: from reconnaissance and initial access through enumeration to privilege escalation and lateral movement in Active Directory.
[ The attack chain ]
Individual mistakes may not look critical. But an attacker can link them into a working chain.
The workshop follows the connections between human, physical and technical weaknesses, from the first piece of public information to significant privileges within the domain.
People and physical access open doors
Phishing, quishing, smishing or a planted device can bypass technical controls.
One account is not the end of the road
Enumeration and misconfigured permissions enable progression to more sensitive systems and identities.
Active Directory amplifies the impact
Lateral movement, persistence and escalation can turn a local incident into a domain compromise.
[ Workshop outcomes ]
Participants will understand the attack path and translate its steps into specific defences.
01
Map the attack surface
Click to learn more →01
They will connect public sources, services, technologies and people's roles into realistic reconnaissance.
← Back02
Recognise the path to access
Click to learn more →02
They will understand how social engineering, physical techniques, scanning and access connect.
← Back03
Work through the AD kill chain
Click to learn more →03
They will try enumeration, privilege escalation, lateral movement and the principles of persistence.
← Back04
Design security measures
Click to learn more →04
They will link each attack phase to prevention, detection and recommendations for their infrastructure.
← Back[ Audience ]
For technical teams that want to understand attacks in context
The workshop assumes a basic understanding of networking, Windows, Active Directory and the command line. Advanced penetration testing experience is not required.
[ Suitable for, among others ]
- System and network administrators
- Active Directory administrators
- Security specialists
- SOC and incident response teams
- Beginner penetration testers
- Cloud and Microsoft specialists
[ Workshop content ]
Two days. Two perspectives. One continuous attack from reconnaissance to the domain.
All attack techniques are performed exclusively in an authorised and isolated MS Azure environment.
01Day 1: MITRE ATT&CK in practice
- The attack chain and how techniques connect
- Mapping activities to MITRE ATT&CK
- The connection between attack, detection and defence
02Day 1: Reconnaissance and target exploration
- Shodan, Censys and DNSDumpster
- Mapping services, technologies and infrastructure
- Preparing a realistic scenario
03Day 1: OSINT
- Maltego and relationship analysis
- Metadata and digital footprint
- Advanced searching and dorking
04Day 1: Social engineering
- Phishing, quishing and smishing
- Psychological principles behind the scenarios
- Defensive measures and verification
05Day 1: Physical techniques
- Flipper Zero, o.MG cable and baiting
- Risks of peripherals and physical access
- Practical defences and internal rules
06Day 1: Scanning and initial access
- Port and service scanning
- Gaining access in the lab
- Creating and testing malware only in an isolated environment
07Day 2: Active Directory kill chain
- Attack phases in a domain environment
- Identities, relationships and misconfigured permissions
- The attacker's and defender's perspectives
08Day 2: Enumeration
- Mapping accounts, groups and systems
- Finding paths through the domain
- Detection options
09Day 2: Privilege escalation
- Principles of privilege escalation
- Exploitable configurations in the lab
- Hardening identities and permissions
10Day 2: Lateral movement
- Moving between systems and identities
- Expanding access
- Segmentation and monitoring
11Day 2: Persistence
- Principles of maintaining access
- Traces and detection options
- Restoring trust after a compromise
12Day 2: Measures for your infrastructure
- Prioritising weaknesses
- Prevention, detection and response
- Specific recommendations
[ Workshop format ]
You will try attack techniques in the lab. We always translate their impact into defensive measures.
The workshop combines two expert perspectives, live demonstrations and participants' own hands-on work.
01
Isolated Azure labs
Click to learn more →01
Experiments take place in an authorised environment with no impact on production systems.
← Back02
Live demonstrations
Click to learn more →02
The instructors demonstrate how techniques connect, how traces arise and what detection options are available.
← Back03
Independent exercises
Click to learn more →03
Participants work through the lab and verify steps under the instructors' guidance.
← Back04
Review of defensive measures
Click to learn more →04
Each session ends with a discussion of prevention, detection and protective measures.
← Back[ Practical information ]
An intensive two-day workshop for a small technical group
We tailor the content to participants' experience, the technologies they use and infrastructure priorities.
- Format
- In-person practical workshop
- Duration
- 16 hours / 2 days
- Number of participants
- Recommended: 5–15 people
- Environment
- Isolated labs in MS Azure
- Prerequisites
- Basic knowledge of networking, Windows, Active Directory and the command line
- Price
- Quoted individually based on scope and lab preparation
- Customisation
- Based on the organisation's experience and technologies
- Instructors
- Pavel Matějíček and Lubomír Ošmera
[ Your trainer ]
Two days led by specialists in different parts of the attack chain
[ Day 1 · Reconnaissance and initial access ]
Pavel „SPAJK“ Matějíček
Pavel is an ethical hacker, CEH certification holder and specialist with a purple-team perspective. He focuses on reconnaissance, OSINT, social engineering, physical techniques and initial access.
[ Day 2 · Active Directory ]
Lubomír Ošmera
Lubomír is a Microsoft Security Trainer and red teamer. He guides participants through the Active Directory kill chain, from enumeration through privilege escalation and lateral movement to persistence and protective measures.
[ Why BOIT ]
An attack does not end with finding a vulnerability. That is why the workshop follows the entire chain.
A safe, isolated environment
Techniques are performed only in the prepared Azure labs.
Purple and red team perspectives
Two instructors connect attack with prevention, detection and response.
Human, physical and technical security
The workshop shows how information, people, devices, services and identities connect.
Measures for your own infrastructure
Each phase ends with practical defensive recommendations.
[ Client experiences ]
BOIT training combines expertise with practical, clear delivery
Pavel's cybersecurity training has the pace of an ice hockey game: fast, practical and full of participation. No boredom, just clear insights you can put into practice immediately.
Thanks to Pavel's proactive approach, his training is among the most popular and best attended in our company.
Pavel combines top-tier expertise with a witty delivery. In more than 10 years of organising professional events, BOIT ranks among our best partners.
[ FAQ ]
What you need to know before booking
01Is the workshop suitable for complete beginners?
Advanced experience is not required, but basic knowledge of networking, Windows, Active Directory and the command line is necessary.
02Are the techniques safe and legal?
Yes. Exercises take place in an authorised, isolated MS Azure environment.
03Why do two instructors lead the workshop?
The first day covers reconnaissance and initial access; the second covers the Active Directory kill chain. Each part is led by a specialist.
04Does the workshop include creating malware?
Yes, solely as a controlled laboratory exercise to understand the principles, traces and defences.
05Can the content be customised?
Yes. We tailor the topics and measures to the technologies, the group's experience and the organisation's priorities.
06Does every participant work in a lab?
The workshop is designed for hands-on work by a small group in a prepared lab environment.
07How much does the workshop cost?
We prepare a quote based on the number of participants, customisation and lab preparation.