Start free, no card.Start free

AI Offensive Security Certification

AU · CA · NZ · UK · US

StrikeOps Academy

Curriculum Pathways Certifications Pricing

Search/Start learning

PathwaysThe AD Attack Chain, AI-Accelerated

advanced pathway

The AD Attack Chain, AI-Accelerated

From first foothold to domain dominance across Active Directory, with AI reasoning over every attack path and a human owning every state change.

7 modules · ~28 min total

Enumerate

1T5 · AI for Cloud & Identity Attack Paths · 3 minActive Directory attacks: the overviewWhy Active Directory is the battleground of internal engagements, the shape of a typical domain takeover, and a map to the techniques that get you there.
2T5 · AI for Cloud & Identity Attack Paths · 3 minBloodHound and attack pathsActive Directory describes itself, and BloodHound collects that description to compute the shortest path from where you are to Domain Admin, turning a tangle of permissions into a queryable graph.

Abuse identity

3T5 · AI for Cloud & Identity Attack Paths · 4 minKerberos attacksHow the design of Active Directory's authentication protocol becomes an attack surface: Kerberoasting, AS-REP roasting, delegation abuse, and ticket forgery.
4T5 · AI for Cloud & Identity Attack Paths · 6 minNTLM relay and coercionHow an attacker on the wire turns Windows' own authentication against it: poisoning name resolution with Responder, relaying NTLM with ntlmrelayx, and forcing authentication with coercion attacks.
5T5 · AI for Cloud & Identity Attack Paths · 4 minAD CS attacks with CertipyActive Directory Certificate Services is a privilege-escalation goldmine. Learn the ESC1 to ESC11 family of misconfigurations, why certificates are such durable credentials, and how Certipy enumerates and exploits them.

Escalate and move

6T5 · AI for Cloud & Identity Attack Paths · 4 minCredential access and crackingOnce you have a foothold, credentials are the currency of escalation. Learn where Windows stores secrets, how attackers harvest them from LSASS, DPAPI and NTDS, and how offline cracking turns hashes into passwords.
7T5 · AI for Cloud & Identity Attack Paths · 4 minLateral movementTurning one compromised host into many. Learn the protocols and techniques that move an attacker across a network, the tooling that does it at scale, and how to map the blast radius of a single credential.

Ready when you are

Certify the dual mandate.

Start free, learn on subscription, and earn a verifiable credential recognised across the Five Eyes.

Start learningCompare certifications

StrikeOps Academy

The certification for operators who wield AI in offensive engagements and attack the AI systems inside every target.

Recognised across

AUCANZUKUS

Learn

Curriculum
Learning pathways
Search

Certify

Certifications
Pricing
Certification exams

Credentials

Associate · Silver
Professional · Gold
Expert · Platinum

Questions, or planning a team rollout?

Talk to our team and we will point you to the right track or credential.

© 2026 StrikeOps Academy. A StrikeOps company. All rights reserved.

Privacy Policy Terms of Service

The offensive techniques taught here are for authorised security testing only. The StrikeOps Academy labs are the sole sanctioned target unless you hold explicit written authorisation.