Module 21 of 22 — Prove you can do it alone
Knowledge is not competence. You can read every module, memorize every command, and still fail when it matters. The capstone is a live, unassisted exercise — you against a target network, with a time limit, no hints, and real consequences. Pass, and you earn the 22nd Survey Division certification. Fail, and you know exactly where to study.
Why this matters: In the real world, there are no hints. No walkthroughs. No second chances. The capstone is designed to simulate the stress, uncertainty, and complexity of a real engagement. If you can pass this, you can operate in the field.
This is the final exercise. No instructor, no hints, no safety net. You have a mission: compromise a target network, escalate privileges, establish persistence, and exfiltrate data. You have 8 hours. Your tools are your own. Your decisions are your own. Your success or failure is your own. This is what separates the operator from the student.
Think of it as a live-fire exercise. The targets are real. The defenses are real. The only difference is that nobody dies if you fail — but your reputation does.
The capstone is where you prove you can chain it.
Knowing how to run nmap or Mimikatz in isolation is not enough. The capstone forces you to string reconnaissance, exploitation, privilege escalation, lateral movement, and exfiltration into one continuous operation. One tool gets you a foothold; the chain gets you the domain.
Layman terms: Anyone can swing a hammer. The test is whether you can build the whole house.
The 22nd Survey Division Capstone is a comprehensive, hands-on assessment that evaluates your ability to execute a full offensive security engagement from reconnaissance to exfiltration. It is not a test of memorization — it is a test of judgment, adaptability, and technical depth.
| Competency | Why It Matters | Modules Applied |
|---|---|---|
| Reconnaissance | You cannot attack what you do not understand | 02, 01 |
| Initial Access | Every breach starts with a foothold | 10, 17, 09 |
| Privilege Escalation | Users cannot steal domain secrets | 08, 11 |
| Persistence | Access that evaporates is worthless | 07, 12 |
| Credential Access | Credentials are the keys to the kingdom | 06, 19 |
| Lateral Movement | One machine is never the goal | 15, 14 |
| Domain Compromise | The crown jewel of every engagement | 19, 20 |
| Exfiltration | Data stolen is data proven | 16, 13 |
| Documentation | Undocumented exploitation is indistinguishable from imagination | All modules |
GeoDefend is a fictional mid-sized aerospace engineering firm with approximately 500 employees, a hybrid cloud infrastructure, and a recently deployed EDR solution. They are the target for this capstone. Your client engagement letter authorizes you to test their external perimeter, internal network segmentation, and Active Directory security posture.
GeoDefend represents a typical high-value target in the defense industrial base (DIB). They are not a Fortune 500 with unlimited security budget, nor are they a small business with no defenses. They are the sweet spot for adversaries: valuable data, moderate defenses, and realistic attack surface. If you can compromise GeoDefend, you can compromise thousands of real companies just like it.
A single tool doesn't make you a hacker, chaining does.
Metasploit, BloodHound, and Cobalt Strike are force multipliers, not replacements for judgment. The capstone will hand you nothing. You must decide which tool fits each phase, when to abandon a failing approach, and how to recover when your favorite technique is blocked by EDR or segmentation.
Layman terms: A race car doesn't make you a champion driver — knowing when to brake, accelerate, and overtake does.
This section walks through the complete attack chain against GeoDefend, from initial reconnaissance to final exfiltration. Each phase maps to modules you have already studied. This is not a hint — it is a demonstration of what mastery looks like.
OSINT
Map the target surface
Payload
Build the delivery package
Phish
Get the payload to the target
Execute
Trigger the payload
Implant
Establish C2 beacon
Control
Remote interactive access
Achieve
Exfiltrate the objective
Before touching the target, you build an intelligence profile. Everything you learn now reduces surprise later.
Passive reconnaissance first. Every packet you send to the target is a potential detection event. Start with public data (subdomains, LinkedIn, job postings) before sending a single packet to their infrastructure. The more you know before you touch the target, the fewer mistakes you make when you do.
Defenders should monitor for the reconnaissance phase — it is the only phase where the attacker is not yet inside.
Weaponization is where you package your exploit into a deliverable form. For GeoDefend, we weaponize a malicious macro document targeting the engineering team's CAD software procurement process.
Delivery is the moment of truth. The best payload in the world is useless if the target never opens it.
The user opens the document and enables macros. The VBA macro decrypts the embedded shellcode and injects it into a legitimate process using process hollowing (Module 10).
One beacon is not enough. You need multiple persistence mechanisms so that losing one does not mean losing access.
Get-WmiObject -Class __EventFilter -Namespace root\subscriptionC2 is your lifeline. If it is detected and cut, the engagement is over. Use domain fronting, HTTPS, and jitter to blend in.
The final objective: extract the flag file and sensitive data without triggering DLP or network alerts.
Effective defense requires understanding the attacker's perspective. This section provides a structured detection playbook for each kill chain phase.
Monitor for mass DNS resolution, port scanning from single sources, and certificate transparency log monitoring. Correlate external scanning with subsequent phishing attempts.
Focus on email gateway alerts, macro execution, and browser exploitation. The first execution is your best chance to stop the chain.
AMSI, PowerShell script block logging, and Sysmon Event ID 1 (process creation) are critical. Look for LOLBAS (Living Off The Land Binaries and Scripts).
Weekly Autoruns audits, WMI subscription reviews, and scheduled task baselines. Persistence is where attackers get sloppy — they leave artifacts.
Monitor for TokenPrivilege adjustments, named pipe impersonation, and UAC bypass techniques. Event ID 4673 (privileged service call) is valuable.
LSASS access by non-system processes, Kerberoasting (Event ID 4769), and DCSync (Event ID 4662 with replication rights). Enable Audit Credential Validation.
Monitor for SMB connections from workstations to workstations, WMI remote execution (Event ID 5856), and RDP lateral movement (Event ID 4624 Type 10).
DLP alerts, DNS tunneling detection, and outbound data volume baselines. The attacker has already won — now you need to know what they took.
Purple teaming is the collaborative integration of red and blue capabilities. The goal is not to "win" but to improve organizational resilience through continuous feedback.
After each engagement, map every technique to MITRE ATT&CK and identify undetected TTPs. These are your highest priority improvements.
Convert red team techniques into detection rules: Sigma, YARA, Splunk SPL, or KQL. Test with red team before deploying to production.
Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and dwell time. Track these over time to measure improvement, not just activity.
Use tools like Caldera, Atomic Red Team, or Prelude to continuously validate detections. Automated purple team exercises scale what manual engagements cannot.
You are given VPN access to a lab network with three machines:
Your starting position: VPN access only. No credentials. No prior knowledge.
Document everything.
In the capstone, an undocumented exploit is worth zero points. In the field, undocumented findings are indistinguishable from imagination. Screenshot commands, save output, timestamp actions, and write the narrative while you work. Your report is the product — the compromise is just evidence.
Layman terms: A detective can solve a case, but without a case file the prosecutor has nothing. Write it down.
Gain a foothold on any machine in the network. Document your reconnaissance, the vulnerability identified, and the exploit used.
Hint: WEB01 has a web application. What does it do? What does it trust?
Escalate from standard user to local administrator or SYSTEM. Document the technique and the verification method.
Establish at least two persistence mechanisms. Verify they survive reboot.
Extract credentials from memory or disk. Document the method and the credentials recovered.
Move from your initial foothold to at least one other machine. Document the path and the technique.
Compromise the Domain Controller (DC01). Document the full attack chain from initial access to Domain Admin.
Exfiltrate the flag file from DC01: C:\flag.txt. Document the method and verify the flag hash.
8 hours from VPN connection. The exam auto-terminates after 8 hours. Partial submissions are accepted but scored accordingly.
Submit a report containing:
| 90-100 points | PASS with Distinction |
| 70-89 points | PASS |
| 0-69 points | FAIL — Retake required |
Test your readiness before attempting the capstone. Each quiz covers critical concepts from the full course.
Question: During the GeoDefend engagement, you discover that WEB01 is running an outdated version of Apache Struts. Which kill chain phase are you currently in, and what is the most appropriate next action?
Question: Your EDR alerts on LSASS memory access by a process named rundll32.exe with command line rundll32.exe C:\Users\jdoe\AppData\Local\Temp\update.dll, DllRegisterServer. Which detection strategy would most reliably identify this as malicious?
Question: After a red team engagement, you discover that 60% of techniques used were not detected by the blue team. What is the most appropriate purple team response?
Completing the 22nd Survey Division course opens multiple career trajectories. The capstone is your proof of competence for employers.
0-2 years
Penetration tester, SOC analyst, vulnerability researcher
3-5 years
Red team lead, threat hunter, malware analyst
5-8 years
Offensive security architect, detection engineer, research director
8+ years
CISO, consulting partner, product founder, government advisor
Penetration testing, red teaming, exploit development, malware research. High demand, high stress, high reward.
Blue team operations, detection engineering, incident response, SOC leadership. Stable, structured, critical.
Adversary emulation, threat intelligence, detection research, tool development. The bridge between offense and defense.
National security, cyber operations, counter-intelligence, policy. Requires clearance, offers unique mission impact.
Security architecture, risk management, CISO advisory, board engagement. Business acumen meets technical depth.
AppSec, DevSecOps, cloud security engineering, product management. Build secure systems at scale.
The 22nd Survey Division certification is a foundation, not a destination. These industry certifications validate your expertise at different career stages.
The gold standard for penetration testers. 24-hour practical exam, requires deep Linux and Windows exploitation knowledge.
Red Team Entry-Mid $1,600+Advanced exploit development, web application attacks, and EDR evasion. Three 48-hour exams. The pinnacle of offensive certifications.
Red Team Senior $2,500+Incident response, detection, and containment. Open-book exam with practical scenarios. Ideal for blue team professionals.
Blue Team Entry-Mid $2,000+Static and dynamic malware analysis, reverse engineering, and threat intelligence. Essential for malware researchers.
Purple Team Mid-Senior $2,000+Management-focused, broad security domains. Required for many government and enterprise security leadership roles.
Management Mid-Senior $750+Cobalt Strike-focused red team operations. 48-hour practical exam emphasizing C2, persistence, and evasion.
Red Team Mid $1,200+Practical blue team certification with 24-hour incident response exam. SIEM analysis, threat hunting, and forensics.
Blue Team Entry $500+Practical penetration testing with report writing emphasis. Good bridge between training and OSCP.
Red Team Entry $400+Every capstone attempt teaches something. Here are the most common lessons from past candidates:
Spend the first 30 minutes on reconnaissance, not exploitation. A well-targeted attack saves hours of brute force.
Screenshot every step as you go. Retroactive documentation is inaccurate and costs points.
Test your tools in a lab before the exam. A broken payload at hour 6 is a failed exam.
Don't chase impossible escalation paths. If one technique fails, move to another — there are always multiple paths.
Don't celebrate early. A compromised DC means nothing if you can't exfiltrate the flag cleanly.
The best operators find vulnerabilities and fix them. Remediation recommendations are 20% of your score.
The capstone integrates knowledge from every module in the course. Use this index to review weak areas before attempting the exam.
| Exam environment | ✅ 3-machine lab ready |
| Scoring rubric | ✅ 100 points defined |
| Time limit | ✅ 8 hours enforced |
| Pass criteria | ✅ 70+ points required |
| Kill chain coverage | ✅ All 7 phases mapped |
| Cross-module links | ✅ All 22 modules linked |
| Interactive quizzes | ✅ 3 quizzes embedded |
| Copy buttons | ✅ All code blocks enabled |