We’re excited to announce Cobalt Strike Certified Operator II – a new training course focused on advanced Cobalt Strike customisation and evasion. Building on our introductory training, this course is designed for operators who want to leverage custom evasion tradecraft in their red team exercises.
This is our first course release since Fortra’s acquisition of Zero-Point Security, bringing Cobalt Strike’s product expertise and Zero-Point Security’s training experience together within Fortra. It marks the next step in our commitment to helping security professionals develop their offensive security skills.
When we announced our introductory course, we shared plans for advanced training covering custom payload generation, User-Defined Reflective Loaders, and evasion. Cobalt Strike Certified Operator II delivers on that promise, exploring the customisation options that give operators greater control over payload behaviour, execution, and communications.
What You’ll Learn
The course explores opportunities for customisation and evasion throughout the Beacon lifecycle. Topics include:
- User-Defined Reflective Loaders – Examine detection opportunities during Beacon loading and approaches to managing that exposure using custom loaders.
- Runtime Evasion – Explore both Cobalt Strike’s built-in capabilities for managing Beacon’s behaviours during execution; as well as operator-defined approaches through IAT hooking via Crystal Palace.
- Post-Exploitation Evasion – Understand the detection considerations associated with post-exploitation activity, including DLLs and BOFs.
- Custom Process Injection – Explore how to integrate custom injection techniques into Cobalt Strike’s workflows.
- User-Defined Command and Control – Extend Beacon’s communications with custom C2 channels.
Together, these topics help operators understand how Cobalt Strike’s evasion through flexibility philosophy can enable them to bring novel evasion tradecraft to Beacon and its post-ex capabilities. Evasion tradecraft can be written once and reused across the whole ecosystem.
Who Should Enroll
Cobalt Strike Certified Operator II is aimed at practitioners who are already comfortable with Cobalt Strike’s core functionalities and are ready to explore advanced customisation. It’s a natural next step for learners progressing from our introductory training, as well as experienced operators looking to deepen their understanding of the platform’s extension points and evasion capabilities.
What’s Next?
Ready to take the next step? Get in touch with the offensive security sales team for more information about Cobalt Strike Certified Operator II.
Interested and Want More Info?
The training is available on demand, so you can learn at your own pace anytime, anywhere.
For more information, get in touch with the offensive security sales team.
