Course Index
Overview
A foundational Machine Learning course for security professionals
If you work in technology, Artificial Intelligence is now the topic being discussed. Across all segments of the corporate landscape, AI/ML will proliferate. This course teaches the fundamentals of classical Machine Learning that serve as a foundation, so you can branch into Deep Learning, Reinforcement Learning (RL), Adversarial ML, and other avenues.
By building practical tools that you can use live in engagements, you will develop a strong understanding of how ML models work and how to code them. Our projects present some of what can be accomplished rapidly in cyber security:
- Generative Adversarial Networks for Malware Development
- Clustering Attacks Against XDRs and MDR teams
- Password Hunting with Machine Learning
- Turul product
We understand the cross section of ML and offensive security. This was reinforced by the fact that we were shortlisted for TURUL GAN and TURUL C2 by NATO’s Defence Innovation Accelerator in 2024 from 2700 companies across the NATO Alliance.
"The course presents the most comprehensive review of machine learning, from an introduction to Python to manual algorithm implementation, that I've ever seen. Understanding the intricacies of the manual implementation helped me understand how to better capture the functionality of my own machine learning implementations into OOP abstractions.
The operational utility of the method covered in the course is on the bleeding edge of offensive technologies. As AI and ML become more pervasive, the importance of the material in this course will continue to increase."
Training consultants from: Cybersecurity, financial services, automotive and manufacturing, technology and SaaS, public sector and defense.
Get Certified
Certified Red Team ML Specialist (RTMLS)
The training has three assignments that need to be completed and handed into our trainers for review. Our team (view here) reviews each coursework submitted and provides feedback. Upon successful completion of all course material and assignments / coursework you will be awarded the Certified Red Team ML Specialist certification.
This certification will enable you to prove to employers that you can develop tooling such as SharpML, have a deep understanding of Clustering and Classification, and can attack EDRs using ML obfuscation techniques in both Red and Blue Team contexts.
Curriculum
What You Will Learn
A mixture of videos, exercises, reading, and fully fledged projects will help you master the fundamentals of classical Machine Learning. These techniques are foundational and give you the grounding to branch out into Deep Learning, Reinforcement Learning, Adversarial ML, and other avenues.
Python Basics
Many courses require knowledge of Python, we will teach you from ground-up.
Machine Learning Theory
Learn about Clustering & Classification, the maths behind them, classical ML theory, and how it underpins modern approaches like deep learning.
Adversarial ML
Learn about attacking Machine Learning models, here the focus is on AV & EDR engines static analysis.
Practical Tools
You will learn to build SharpML, and have two other projects to complete.
Foundation and Branches
Classical ML is the foundation. From here you can branch into specialized tracks and advanced applications: Deep Learning, Reinforcement Learning (RL), Adversarial ML, and Applied Offensive Tooling.
The video lessons are laid out to gradually build your knowledge from the ground up, some videos, some reading, some links, and at the end three practical courseworks that will be assessed before receiving your certificate of completion. The lesson list is below:
Chapter 1: Introduction
Introduction and course orientation.
Chapter 2: Python
Install Required Software, Setting a Workspace, Basic Program - Hello World, Scalar Types, Strings, Variables, Tuples, Lists, Sets, Dictionaries, Indentation, If Elif Else, For Loop, While Loop, Break Continue, Defining a Function, Methods, Structure, Using Instances, Arguments Passing, Mutable and Immutable, Standard Library, Numpy, Scipy, Matplotlib Pyplot, Pandas, I/O
Chapter 3: Machine Learning Theory and Designing an Algorithm
Basics and workflow theory; K-means & distances; class definition; normalization; outliers removal; split data into training and test data; model selection; score; plotting data; and why not neural networks.
Chapter 4: Building SharpML
- SharpML Python model code
- Organization of SharpML code
- Class set up
- Load data
- Load rules
- Training
- Testing
- Results
- Final considerations
- Init
- Save output
- Run
- Examples
- C# code overview
- Next steps
Chapter 5: Build a CMS Web Analyzer
In this course, you’ll learn how to develop a model that identifies and classifies web component technologies in static index HTML pages. You’ll start by defining the problem, evaluating the pros and cons of using machine learning versus traditional algorithms, and conceptualizing a solution using clustering and classification techniques. You’ll then translate this into features, scrape relevant data from HTML pages, and compile a labelled dataset. By the end, you’ll have created a high-performance ML model in Python and integrated it into tools like BurpSuite or OWASP Zap.
Chapter 6: Build a Macaronic Obfuscator
In this course, you’ll learn how to create a Python tool that obfuscates elements in C# project files to evade detection, based on insights from Advanced Threat Protection (ATP) analysis. You’ll set up your own ATP E5 lab and interface with the Anti-Malware Scan Interface (AMSI) through its API and function call interception. You’ll generate wordlists from Windows OS structures and GitHub directories with malware samples, automate identification of keywords that trigger ATP responses, and develop a static obfuscator pipeline. You’ll also implement junk code generation and refine your strategy using the AMSI API.
Chapter 7: LLM Bonus - Build an LLM Infused SAST Tool
In this course, you’ll learn to use a local Large Language Model (LLM) that integrates with a secure code regex tool to identify, explain, and dynamically suggest fixes for potential code issues. You’ll deploy Llama.cpp locally, experiment with open-source LLMs, adapt a tool like cq to highlight vulnerable code, use Control Flow Graphs to enhance context, and prompt the LLM with identified code and surrounding context. Finally, you’ll integrate the workflow into a web app with an HTML dashboard.
For a more detailed explanation of the course, don’t hesitate to reach out to us and ask any questions you have.
Who Is It For
Your starting point. How the course will feel.
You already build ML models and write C# implants
Mostly review; only the adversarial/obfuscation angles will stretch you.
You’re an experienced red-teamer / pentester who has scripted but hasn’t touched ML
Sweet spot, the ML side ramps up gently, then the projects push you.
You’re early-career (OSCP-level) and still shaky on Python / AD tradecraft
Expect a steep learning curve once you hit the SharpML and obfuscation sections; it will feel advanced.
You’re a blue-teamer/data-scientist looking to understand attacks
The offensive perspective will be new and challenging, but the ML won’t.
What You Will Build
1. Main Project, SharpML
SharpML employs C# to mine Active Directory file shares, while bundling a resource file. This resource file is a custom Machine Learning algorithm written in Python (compiled with Pyinstaller) whose logic uses Clustering and Classification to evaluate the likelihood of a User / Password pair and subsequently automatically test these against a Domain Controller to assist operators in identifying passwords littered on fileshares.
Open-source tool, SharpML Codebase. Browse the repository tree and preview files without leaving the page. View on GitHub.
A version of this tool had been open-sourced when the team were running Hunnic Cyber, but further developments have been made internally by Atlan Digital R&D and you will receive the uncompiled Machine Learning model as part of the training. This project was also mentioned in conjunction with DeepPass developed by Harmj0y at SpectreOps (view here) and discussed by Cobalt Strike in the context of post-exploitation (view here).
2. Macaronic Obfuscator for Static Evasion
You will build and train your own obfuscator for static evasion.
3. CMS Web Technologies Analyzer
Generating a dataset yourself, you will develop a model to identify web technologies in HTML pages.
4. LLM for Secure Code Review
As part of the course you build your own secure code review tool using LLMs.
Enroll
Course updates
Stay ahead of adversarial ML
Get course updates, new modules, and offensive ML research straight to your inbox. No spam.
Enquiries
Send us a brief outline of what you are looking for and we will respond directly.
Contact Us
How can we help?
Whether you represent a corporate, a consultancy, a government or an MSSP, we’d love to hear from you. To discover just how our offensive security contractors could help, get in touch.