What to Expect?

Over the course of 4 weeks, you will:

• Learn how to bypass security defenses such as AMSI, Microsoft Defender, and EDR systems.
• Work with live labs using tools like Elastic EDR and perform real-world attacks like DCSync and payload execution.
• Learn how to reduce detection through advanced obfuscation, payload crafting, and stealth operations.
• Explore EDR internals, API hooking, and ETW to learn how defenders trace adversary activity.
• Use Elastic EDR to simulate and test evasion techniques, and tweak your approach based on alerts and telemetry.

Key Features

• Comprehensive weekly modules covering everything from evasion basics to advanced techniques.
• Real-world scenarios with Elastic EDR, AMSI emulation, PowerShell obfuscation, and more.
• Learn to execute stealthy DCSync attacks, bypass Defender, and manipulate telemetry.
• Learn from seasoned cybersecurity professionals who walk you through each technique.
• Test and refine your skills in a simulated environment with direct feedback.
• Work with Elastic EDR, one of the most popular open-source tools for endpoint detection.
• Start with foundational concepts and gradually tackle advanced evasion techniques.

Earning the CWEP certification demonstrates your expertise in Windows evasion techniques. From evading modern EDRs and obfuscating PowerShell/.NET payloads, to understanding API hooking, ETW patching, and advanced stealth tactics. The certification proves your ability to operate undetected in high-security environments and simulate real-world threat actor behavior. This credential enhances your career prospects, making you stand out for roles such as Red Teamer, Threat Emulation Specialist, or Senior Penetration Tester.

Bootcamp Agenda

Session 1: Introduction to Evasion and Lab Setup

Introduction to Evasion

Lab Setup

Introduction to Enterprise Defensive Solutions

Programming Basics

Processes and Threads

Playing with more Win32 API

Emulating AMSI

Session 2: PowerShell, .NET, and Payload Obfuscation

PowerShell and Dotnet

Payload Obfuscation(Strings, PowerShell, Dotnet)

Bypassing Defender

Session 3: Understanding EDRs and Hooking Mechanisms

Introduction to EDRs

API Hooking

Event Tracing for Windows

Setting up EDR labs

Understanding EDR Evasion

Session 4: EDR Evasion with Elastic and Stealth Techniques

Playing around with Elastic EDR

Using alerts to improve evasion

Executing Malicious dotnet binaries

Executing DCSync with minimum alerts

Blinding the EDR

Blending in with the noise

Introduction to Advanced Evasion

Bootcamp Schedule (August 2026 Batch)

This live bootcamp is delivered over four consecutive Saturdays, starting from August 8th, 2026, and concluding on August 29th, 2026.

Who Should Join This Bootcamp?