StatusISOLATED LAB
Phase03_INITIAL_ACCESS
EgressBLOCKED?
Resume Session
MENTOR TRACK // M22

12-Month Skill Roadmap

What comes after the 8-week apprenticeship. Paced for someone with a job and a home lab — not for someone claiming mastery in ninety days.

  1. Q1 - Foundation

    Months 1-3

    Capstone — Reproduce the full apprenticeship weakened baseline from clean, no notes.

    Skills

    • AD fundamentals, Kerberos mental model, GPO scoping.
    • Linux + PowerShell fluency for daily ops.
    • Structured enumeration on Windows and Linux hosts.

    Labs

    • Complete the 8-week apprenticeship track.
    • Rebuild the DC twice from scratch, unaided the second time.

    Projects

    • Personal cheat-sheet repo (in your own words).
    • Network diagram + host inventory of the lab.

    Reading

    • Microsoft Learn: AD DS + Kerberos.
    • MITRE ATT&CK: Initial Access & Discovery categories.

    Tools

    • PowerShell, Sysinternals, Wireshark, Sysmon.

    You should be able to

    • Explain, in your own words, how a domain join actually works.

  2. Q2 - Offensive Craft

    Months 4-6

    Capstone — Solve your own weakened baseline from scratch under a 2-hour clock.

    Skills

    • Kerberos abuse patterns in the lab (roasting, delegation).
    • Lateral movement via native tooling.
    • Attack-path thinking with graph tooling, in your lab only.

    Labs

    • Complete all ten Red Team Ops phases.
    • Introduce two additional documented misconfigurations you design yourself.

    Projects

    • Personal kill-chain template.
    • Detection notes per technique used.

    Reading

    • ATT&CK sub-techniques you actually executed.
    • Vendor docs for every service you touched.

    Tools

    • Add: BloodHound (in-lab), Impacket, Rubeus / Certipy - for lab use only.

    You should be able to

    • You can draw the attack path before you type the first command.

  3. Q3 - Defense + Depth

    Months 7-9

    Capstone — Run a self-graded internal engagement against the full stack with a written report.

    Skills

    • Detection engineering: write and tune three rules that catch you.
    • Web app + API security fundamentals against a vulnerable-by-design lab app.
    • Certificate services and identity edge cases.

    Labs

    • Add Elastic/Kibana pipeline; rerun ops phases with detections on.
    • Introduce ADCS templates and a small internal web app.

    Projects

    • Three tuned detection rules with proof of low FP rate.
    • Report on the vulnerable web app.

    Reading

    • Elastic detection docs, OWASP ASVS, SpecterOps ADCS research (concepts).

    Tools

    • Elastic stack, Winlogbeat, Burp Community (local lab app only).

    You should be able to

    • You measure your offense by what the blue side did or did not catch.

  4. Q4 - Professionalization

    Months 10-12

    Capstone — Deliver a full mini-engagement package: report, exec summary, technical detail, remediation, verification steps.

    Skills

    • Report writing that a real engineer can act on.
    • Scope + communication under pressure.
    • Time-boxed prioritization.

    Labs

    • Two 4-hour simulated engagements with only scope + ROE given.
    • One capstone with defensive controls tuned by you the previous quarter.

    Projects

    • Polished sample report (redacted, lab-only).
    • Public technical write-up on a legal target (own lab, authorized platform, or an OSS project with permission).

    Reading

    • Published pentest reports (public ones), your target cert's syllabus if pursuing one.

    Tools

    • Whatever you have already used. No new toys this quarter.

    You should be able to

    • You would not embarrass yourself in front of a working pentest team.
    • You can honestly say what you know and what you do not.