1.1 Red Teaming 101 — Index

BLUF. Master red-team course using the Harada OW64 methodology — initial access through reporting, with recon lab artifacts and supporting infra.

Important

Mandatory entry gate: Before any technical module, complete Rules of Engagement, owned-lab verification, data-handling approval, telemetry readiness, evidence-retention planning, stop conditions, emergency contacts, and rollback testing. Every exercise must use synthetic identities or canary data, stop when the approved proof is obtained, preserve telemetry, and end with verified cleanup.

Curriculum order

Stage	Required result
0. Governance	Approved scope, exclusions, techniques, contacts, data rules, stop authority, and cleanup owner
1. Lab readiness	Owned targets, snapshots, seeded identities, canary data, time sync, and tested recovery
2. Telemetry baseline	Endpoint, identity, directory, DNS, proxy, firewall, application, and packet evidence confirmed
3. Recon and access simulation	Allowlisted discovery and synthetic access exercises with a defined proof boundary
4. Host and identity validation	One ATT&CK behavior per exercise; collect evidence without reusable secrets
5. Pivot and objective validation	Narrow routes and benign canary data only; stop at the approved objective
6. Restore and report	Restore captured state, verify cleanup, preserve evidence, and document detection and mitigation

Use TTP Validation Catalog for the standard exercise contract and first validated technique set.

Shelves

#	Folder	Entry	Role
1.1.1	`1.1.1 OW64/`	OW64 README	Master course — Linux, AD, C2, EDR, reporting, recon
1.1.2	`1.1.2 Infra/`	GOAD Lab README	Proxmox GOAD lab — three-node federated architecture
—	`1.1.1 OW64/TTP Validation Catalog.md`	TTP Validation Catalog	ATT&CK rationale, telemetry, detection, mitigation, evidence, stop, and cleanup
—	`backup/`	Archive	Superseded notes

1.1.1 OW64 — reference pillar order

Pillar	Note
Initial access	0.4 Initial Access
Linux	1. Linux
Windows / AD	2. Windows AD
Windows / AD detailed library	Windows Tradecraft
Web (hub)	→ 1.2 Web learn track
Networking	4. Networking · 4.1 Pivoting
Cloud (hub)	→ 1.3 Clouds
EDR	6. EDR
C2	7. C2
Reporting	8. Reporting
Recon lab	Recon — External

Also under 1.1.1: Recon/noise-lab/ (artifact outputs).

1.1.2 Infra — key docs

Doc	Note
README	GOAD Lab README
BUILD-GUIDE	Build Guide
NETWORK-DIAGRAM	Network Diagram
NODE3-SCRIPTS-QUICKSTART	Node 3 Scripts Quickstart

Cross-shelf

Shelf	Relationship
1.2 Web	Dedicated web learn + attack tracks
1.3 Clouds	Cloud learn + attack (PwnedLabs)
Platform Internals	Windows mechanics, PE, syscalls, authentication, memory, and OS theory
Windows Domain Playbook	Defensive lab assessment, hunting, evidence, Defender/SentinelOne validation

Rename note (2026-08-27)

Was	Now
`101/`	`1.1.1 OW64/`
`Infra/`	`1.1.2 Infra/`