OSEP study plan

Build an isolated lab with a Windows victim VM (Defender on, snapshotted both clean and 'reduced-protection'), a Linux attacker host, and a file-transfer channel over SMB and HTTP.

Compile three distinct payload variants (staged, stageless shellcode loader, and an injected-beacon build), recording the exact build command, toolchain version, and resulting file hash for each.

Execute each variant against the victim and record the Defender detection name, time-to-detect, and whether the trigger was static signature, heuristic, or behavioral.

Author a detection matrix that maps each payload trait (encoder, encryption, sleep interval, injection target, parent process) to the AV/EDR behavior it triggered.

Implement and test two in-memory script-execution evasion techniques against the lab host and log which console/engine telemetry each one suppressed.

Deploy AppLocker default rules and a WDAC baseline on the victim, then achieve code execution from a standard-user context using at least two distinct trusted-path or LOLBin techniques.

Test two userland API-unhooking approaches against a cloud EDR trial and document which protected regions were restored and whether detection fired afterward.

Enumerate which event providers and log channels remain useful to a defender after your evasion steps, and write the counter-detection notes.

Deploy a lab AD forest (1 DC, 2 member servers, 2 workstations) with realistic delegation, SMB signing, and service-account misconfigurations, and snapshot every host.

Enumerate the forest from a domain-joined low-privilege account and produce a shortest-path-to-Domain-Admin graph with the specific edges you intend to exploit.

Perform Kerberoasting and AS-REP roasting against the lab, then crack at least one obtained hash offline and prove validity with an authenticated query.

Dump credentials from LSASS using three different mechanisms and record which succeed under each protection profile.

Escalate from a standard user to SYSTEM on a member server by exploiting a service misconfiguration (unquoted path, weak service ACL, or writable binary), and capture the before/after token.

Execute an NTLM relay attack against a host with SMB signing disabled and demonstrate credential capture end to end.

Move laterally with three distinct remote-execution mechanisms and record the artifacts each leaves on source and destination hosts.

Write detection notes that name the specific event ID or log source a defender would need for each lateral-movement technique used.

Build four client-side delivery documents in different formats (macro-enabled document, shortcut file, container image, and HTML smuggling page) and verify each executes a callback.

Stand up an HTTPS listener with a redirector in front of it and confirm the callback survives a domain-reputation check and a proxy inspection.

Run all four deliveries through the lab Defender and a mail-gateway filter, and record block rate, delivery latency, and the exact reason for any block.

Harden one delivery to defeat the block you observed and re-test to confirm the fix.

Chain a full operation from initial phishing callback through local privilege escalation to lateral movement into the AD lab, keeping a single timeline.

Apply OPSEC controls to the chain (log clearing policy, process-name hygiene, callback jitter) and note which defender detections each control defeats and which it does not.

Perform an objective-based run against the lab using only your own written runbook, timing each phase.

Document the three steps where the chain would most likely fail in a monitored enterprise and why.

Enumerate a freshly deployed Linux target for privilege-escalation paths (SUID/SGID, sudo rights, cron jobs, capabilities, writable service units) and rank findings by exploitability.

Escalate to root using at least three of the ranked paths and record the exact command chain for each.

Harvest credentials from the Linux host (config files, history, key material, memory) and demonstrate reuse against a second Linux host.

Establish persistence on the Linux target and pivot from it into the Windows lab network, proving tunneled access to an internal service.

Re-run the Linux escalation and pivot from a clean snapshot using only your playbook, and fix every step that fails or needs improvisation.

Re-test your top three evasion techniques against a changed protection profile (updated signatures or higher heuristic level) and record what still works.

Consolidate all eight weeks of notes into a single index organized by exam domain, with a one-line trigger for each technique.

Complete a timed mock run covering one task from each of the four domains and grade yourself against the deliverable criteria you wrote in weeks 1-7.