Exfiltration Over Alternative Protocol: Asymmetric Encrypted Non-C2 Protocol

Threat actors often leverage valid accounts to gain unauthorized access to target systems and networks. T1078.003 is a focused course designed to provide participants with a deep understanding of local accounts and their exploitation to further the objectives of an adversary in a cyber operation.

Course Content

Royal ELK 3


Royal Lab 3
Attack, Detect and Mitigate


What is the T1048.003 Sub-Technique?
Course Description

By mastering T1078.003: Valid Accounts: Local Accounts, adversaries can gain unauthorized access to target systems, escalate privileges, and maintain a persistent presence within the target network. They can utilize various techniques to identify, compromise, and exploit local accounts, such as password attacks, credential dumping, and social engineering, which enable them to obtain valid credentials. Once they have acquired these credentials, adversaries can move laterally within the network, access sensitive information, and carry out further attacks with minimal detection. The exploitation of local accounts also allows adversaries to masquerade as legitimate users, which makes it more challenging for security professionals to identify and remediate malicious activities. Overall, leveraging valid local accounts enables adversaries to conduct sophisticated cyber operations while remaining undetected, thereby significantly increasing the potential impact of their attacks.

This course is part of a Career Path:
No items found.

Instructed by

Master Instructor
Matthew Mullins

Matt has led multiple Red Team engagements, ranging from a few weeks to a year and covering multiple security domains. Outside of Red Teaming, Matt is also a seasoned penetration tester with interests in: AppSec, OSINT, Hardware, Wifi, Social Engineering, and Physical Security. Matt has a Master's degree in Information Assurance and an exhaustive number of certifications ranging from frameworks, management, and hands-on hacking. Matt is a Technical SME at Cybrary, focusing on Adversarial Emulation and Red Teaming for course content.

Owen Dubiel

Owen is certified in the GIAC GSEC, CompTIA CySA+, and various other vendor-related certifications. He works both as a technical security engineer and as an SME architect instructor in his spare time. Spreading the word of cyber security is a passion of his. Owen lives in Southeast Michigan with his beautiful wife, daughter, and his dog, Thor. In his free time, Owen enjoys watching sports and movies, and spending time with his family.

Chris Daywalt

After too many years of security operations work, Chris Daywalt tries to turn his phone off at 5:00 pm EST. While there are a bunch of training classes and education somewhere on his resume, much of what he has to teach was learned at the school of hard knocks, often at the expense of his previous clients. He wants to help you spend more time detecting and denying adversaries and less time banging your head against your keyboard. He dips his blueberry donuts in orange juice.

Chris’ 19-year career includes work for organizations of all sizes, both government and private sector, and is distributed roughly like so:

  • 30% doing DFIR
  • 30% teaching DFIR
  • 20% monitoring and detection engineering
  • 15% risk assessment
  • 5% other stuff, like sneaking in a game of Plants vs. Zombies or taking a quick nap at the desk (Don’t judge - I work overtime)

    Lucas Romano

    Lucas is a seasoned threat researcher in multiple security disciplines, such as real-world adversarial tracking, network vulnerabilities, web exploitation, API abuse, and more. He began his career at the US Department of Defense, where he was trained by some of the world's best operators and analysts. Lucas now operates in the Cybrary red team, emulating real-world threat actors and running purple team exercises. He has 11 industry certifications, including the OSWA, GPEN, GAWN, GCFE, and RHCSA. He is also a member of the GIAC Advisory Board. In his free time, he enjoys working outdoors to improve his farm.

    Cybrary Logo
    Certification Body
    Certificate of Completion

    Complete this entire course to earn a Exfiltration Over Alternative Protocol: Asymmetric Encrypted Non-C2 Protocol Certificate of Completion