What the course covers
About this course map
CRTE — Certified Red Team Expert — is the Active Directory specialist certification from Altered Security. Where a general penetration test touches AD as one component, CRTE is about nothing else: it goes deep into the way a Windows domain, and a whole forest of them, can be enumerated, abused, escalated through and persisted in. It is the certification for someone who has decided that Active Directory is where enterprise compromise actually happens and wants to master it specifically.
The course behind it teaches tradecraft against a large, realistic multi-domain, multi-forest lab — the kind of environment a mature enterprise actually runs, with trusts, delegation and defences in the way. The emphasis is on understanding *why* each attack works at the protocol level, not just running a tool.
The exam is a practical: a fully patched lab environment that you enumerate, exploit, escalate and move through, ending in a report of the paths you found.
Module 01 — Active Directory as an attack surface
The model you need before any technique makes sense.
Module 02 — Local privilege escalation
Getting from a foothold user to local administrator.
Module 03 — Lateral movement
Spreading through the domain with what you have collected.
Module 04 — Domain privilege escalation
The Kerberos attacks that turn a foothold into domain control.
Module 05 — Cross-trust and forest attacks
The part that separates CRTE from a general AD course — moving between domains and forests.
Module 06 — Persistence and defence evasion
Staying in, and staying quiet.
Module 07 — Reporting the attack paths
Turning the engagement into something the client can fix.
Exam & certification
- 1Train with us instructor-led preparation, labs and practice questions.
- 2Sit the official examExam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date.
- 3Get certifiedThe certification is awarded by Zero-Point Security when you pass their exam.
What you receive
- Zero-Point Security certification — issued by Zero-Point Security after you pass, and verifiable with them.
- Hacky Security certificate of completion — for the training itself, with a unique ID.
- Checkable by employers — anyone can confirm our certificate on the Verify page.
This course is Hacky Security’s own preparation training. The certification itself is awarded by Zero-Point Security, not by us.
Similar courses
Independent preparation training delivered from Hacky Security's own curriculum. Hacky Security is not affiliated with or endorsed by the certification body named above. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.
