Cobalt Strike Certified Operator Training I

In this course, made in collaboration between Cobalt Strike and Zero Point Security, users can learn how to use Cobalt Strike to carry out red team assessments and adversary simulations, making it the perfect starting point for security professionals who are new to red teaming. The curriculum includes learning modules and guided labs where users will gain hands-on experience with the concepts and workflows needed to confidently begin using Cobalt Strike in their operations.

Learn the fundamental features of Cobalt Strike and ensure you are getting the most out of this powerful red teaming tool.
DATASHEET
BUY NOW

Cobalt Strike Certified Operator Training lI

Cobalt Strike Certified Operator Training II (CSCO II) is designed to build upon practical skills learned in CSCO I.

By the end of this self-paced course, you will be equipped to extend and tailor Cobalt Strike for advanced payload delivery and static, load-time, runtime, and post-exploitation evasion using hands-on tradecraft such as Aggressor Script, UDRLs, Sleep Mask, Beacon Gate, and more. 

DATASHEET
BUY NOW

Zero-Point Security Trainings

Created by CREST-approved training operator Zero‑Point Security, these Red Team Operations trainings specialize in offensive security, red team operations, and adversary emulation, with a strong emphasis on real‑world tradecraft.

Red Team Operations I (RTO I) 

Red Team Ops I, created by Zero-Point Security, gives security professionals the practical knowledge and hands-on skills needed to plan and conduct adversary simulation and emulation exercises with Cobalt Strike. 

From engagement planning, legal considerations, and initial access through privilege escalation, credential access, lateral movement, Kerberos, Active Directory, pivoting, and domain dominance, you’ll learn how to execute realistic red team operations across the attack lifecycle. 

Hands-on demonstrations, labs, challenges, and a final exam help you apply what you learn in a structured environment and build the confidence to assess defenses, identify security gaps, and deliver meaningful findings to stakeholders. Upon completion, you’ll earn a Red Team Operator certificate. 

Red Team Operations II (RTO II) 

Red Team Ops II, created by Zero-Point Security, helps experienced operators develop the advanced skills needed to operate against modern endpoint defenses and security controls with Cobalt Strike. 

Explore C2 infrastructure, EDR telemetry, load-time and runtime evasion, post-exploitation tradecraft, user impersonation, lateral movement, vulnerable drivers, application control, and Credential Guard. Through hands-on labs and practical challenges, you’ll learn how defensive technologies observe and disrupt operations—and how to adapt your tradecraft accordingly. 

Complete the training and final exam to demonstrate your expertise and earn the Red Team Lead certification. 

BOF Development and Tradecraft 

Learn to develop, test, and integrate Beacon Object Files for Cobalt Strike and other C2 frameworks. Created by Alex Reid and Zero-Point Security, this practical course takes you from Windows API fundamentals and COFFLoader concepts to building BOFs, calling Beacon APIs, integrating Aggressor Script, and applying advanced tradecraft. 

Through guided, hands-on projects—including a ransomware simulator, UAC bypass, and TGT auto-harvester—you’ll develop reusable operator capabilities while learning how to test, troubleshoot, patch, and clean up BOF code. By the end of the course, you’ll have the foundation to create and adapt custom BOFs for authorized red team operations. 

UDRL and Sleepmask Development 

Learn to develop and customize Cobalt Strike’s User-Defined Reflective Loader, Sleepmask, and BeaconGate components. Created by Alex Reid and Zero-Point Security, this advanced course combines low-level Windows internals, hands-on development, and offensive tradecraft to help you build more capable and resilient payloads. 

You’ll progress from PE loading, API resolution, relocations, and memory masking to advanced techniques including module stomping, Control Flow Guard, call stack spoofing, proxied library loading, and CET-compliant sleep obfuscation with fibers. Updated for the latest version of Cobalt Strike, the course also covers BeaconGate support for BOFs and runtime configuration. 

By the end, you’ll be equipped to develop, test, troubleshoot, and refine custom UDRL and Sleepmask components for authorized red team operations.

Additional Training From Cobalt Strike

The Cobalt Strike team has compiled a number of online resources and training videos to provide an overview of Cobalt Strike as well as tips and tricks to using the solution.

Cobalt Strike Introductory Demo

On-demand Cobalt Strike demonstration includes a guided walkthrough in a small cyber range to help demonstrate the key features of the solution. The focus is not on understanding all the security topics mentioned in detail, but rather to explore Cobalt Strike’s capabilities.

Red Team Operations with Cobalt Strike

This is a free course on red team operations and adversary simulations written by the Cobalt Strike team. This course will provide the background and skills necessary to emulate an advanced threat actor with Cobalt Strike.

In-Memory Evasion

This is a four-part mini course on the cat and mouse game related to memory detections. This course is for Red Teams that want to update their tradecraft in this area. It’s also for Blue Teams that want to understand the red perspective on these techniques.

Need training for a larger group or multiple teams?

If your organization is looking for 1+ Zero‑Point Security trainings, reach out to us. We’ll work with you to create a customized training plan that aligns with your team’s goals, scales to your organization’s size, and meets your specific learning needs.


Courses by Trusted Training Partners

The following training partners use Cobalt Strike to some degree in their courses. These can be a great way to practice and learn how Cobalt Strike can be used in a realistic environment.