01 Training & Courses
An intermediate red team course on operating without malware or implants - blending into environments and exploiting native capabilities the way real adversaries do.
02 Overview
MAE covers 14 modules across the full lifecycle of malwareless operations, mapped to 101+ MITRE ATT&CK techniques across all 14 tactical categories. The focus is operating without malware or implants - living off the land, blending into environments, and exploiting native capabilities rather than dropping tooling that lights up detections.
Every lab is self-hosted, with no shared infrastructure, so you build and break in an environment that's entirely yours. It's built for offensive practitioners, internal red teams, detection engineers, and defenders who want to understand real adversary behaviour rather than checkbox techniques.
Full malwareless operations lifecycle, from initial access through to impact.
Mapped across all 14 MITRE ATT&CK tactical categories.
No shared infrastructure - your environment, your rules.
For practitioners ready to move past tooling into real tradecraft.
03 Curriculum
The 14 modules track the MITRE ATT&CK tactical categories end to end - each grounded in techniques that hold up on real engagements.
Gathering information on targets before touching them - the quiet groundwork.
Standing up the infrastructure and access needed to operate without tooling that burns.
Getting a foothold using native paths rather than malware.
Running actions on objectives with living-off-the-land techniques.
Keeping access without dropping implants that detection engineers will catch.
Climbing from foothold to control using native misconfigurations and capabilities.
Blending into the environment and staying under the detection threshold.
Harvesting and abusing credentials the way adversaries actually do it.
Mapping the environment from the inside without tripping alarms.
Moving through the estate using legitimate protocols and access.
Locating and staging the data that matters to the objective.
Everything-as-a-C2 channels - blending traffic into what's already there.
Getting data out without the obvious tells defenders look for.
Demonstrating business impact responsibly, the way a real operation would.
04 What's included
Everything you need to work through malwareless adversarial emulation end to end.
05 Who it's for
Red teamers and pentesters ready to move past tooling into tradecraft that survives modern detection.
Teams who need to emulate real adversary behaviour against their own estate, not run a scanner.
Blue and purple teams who want to understand exactly what malwareless operations look like from the attacker's seat.
07 FAQ
Everything you need to know before enrolling.
08 Collaboration
Beyond MAE, adversary architecture and simulation design in collaboration with XINTRA.
Adversary architecture across the following XINTRA labs:
06 Social proof
Trusted work, recognised results
Fifteen years of offensive security practice, industry recognition, and feedback from the practitioners who've taken the course.
Hear directly from practitioners who've taken the course and put the tradecraft to work.
Read all testimonials on the LMS