CRTO: a practical Red Team Operator preparation guide
CRTO focuses on Active Directory red-team operations. Build skills in C2, OPSEC, credential access, lateral movement and exam-ready methodology.
- AUTHOR
- Karol Rapacz / CEO of Breachroad · OSCP · PNPT
- PUBLISHED
- 19 June 2026
- READING TIME
- 9 min read
- TOPIC
- Careers and Certifications
CRTO — Red Team Operator from Zero-Point Security is a practical Active Directory operations route using command-and-control. The exam requires objectives in the RTO environment; check current terms directly with the provider before purchase.
Skills developed
Core areas include C2 configuration, communication profiles, lab initial access, domain enumeration, credentials, lateral movement, Kerberos, delegation and escalation toward critical assets.
Do not treat CRTO as a course in one framework. Understand beacon protocols, state, process artefacts and defender-visible events.
Operator workflow
Define objective, expected effect and telemetry before each action. Maintain identity and host graphs. Avoid running the same technique across the domain without a reason; in real operations this increases detection and impact.
Practise channel changes, pivoting and session recovery only in authorised labs. Document commands and evidence like a professional engagement.
Preparation
Windows, AD, PowerShell, Kerberos and networking foundations are required. OSCP+ or CPTS provides a useful base. Before the exam, reproduce a complete chain without walkthroughs and explain every step independently of C2 command names.
CRTO develops operators, while purple teaming turns techniques into measurable detection improvements.
Operator thinking instead of command lists
Every action should follow an operational objective. Define the information or position you need, select a technique with acceptable impact, and choose the tool last. This order allows a channel or syntax change without losing the whole methodology when the environment differs from the training lab.
Maintain a session map containing host, user, integrity level, communication method, available credentials and reachable segments. After a failed session, you should know which stable point can resume the operation. Never assume an implant or C2 channel is invisible; observe processes, logs and traffic as a defender would.
Active Directory identity flow
The critical elements in a domain scenario are relationships among users, groups, sessions and hosts. Validate every discovered path with the smallest controlled action. Keep theoretical possibility separate from access that has been confirmed. Record the origin of tickets and the context in which they are used, because confused identities make an attack chain impossible to audit.
Training with a blue-team perspective
After each lab, reconstruct your own traces: process creation, authentication, connections, system changes and disk artefacts. Map them to likely telemetry sources and possible detections. This is not an optional defensive add-on; it explains why one technique carries more operational risk than another.
Test readiness with a full scenario without walkthroughs and introduce a deliberate failure halfway through. Recover the session, explain each decision and build a concise timeline. Always confirm timing, infrastructure and permitted materials on the current Zero-Point Security page because provider rules can change.
A stable operations runbook
Before an action, record objective, source session, expected effect and success signal. Afterwards, capture the real result, artefacts and next decision. This preserves operational logic even when C2 infrastructure resets or several sessions have similar names.
Maintain separate procedures for access recovery, channel change, pivoting and lab clean-up. A runbook cannot assume one framework always works. It should describe network prerequisites, user context and how to confirm communication follows the intended path.
After training, build an “action — trace — possible detection — safer alternative” table. Analyse your actions without assuming invisibility. This improves operational awareness and creates practical material for red and blue teams to review together.
Give every technique a stop condition: host instability, an unexpected user, scope departure or increased impact. A professional operator knows when not to continue as well as how to execute. Practise this judgement as consistently as C2 operation.
Finally compare the plan with the real timeline. Differences reveal reactive decisions and delayed notes, providing a simple way to improve the runbook after every lab.
Source: Zero-Point Security — Exams.
