CRTO review

CRTO was the point where I had to stop thinking only about exploitation and start thinking about OPSEC and stealth. Things that are trivial in one or two commands on a lab bench suddenly aren't viable when you don't want the defenders kicking you out. That mindset shift, plus getting into real C2 operations, was the biggest change for me.

Quality of the Explanations

I really liked how the course is explained: clear, easy to follow, and never draining to work through. I genuinely enjoyed it, especially the second half, where it gets less theoretical and you move on to hands-on exploitation.

Labs

This is the part I liked the least. Labs are mostly hand-held, with the exception of two or three of them, and each one is time-boxed to roughly 30 to 60 minutes. On top of that, you can only run the same lab once every 24 hours, so there is little room to experiment on your own, fine-tune your tradecraft, or ask "what happens if I do this instead?". I felt this the most when trying to build a custom C2 profile.

Visibility Into What You Failed

I would have liked more visibility into why something got caught. I understand the course is built around Windows Defender rather than a full EDR backed by a SIEM, so I'm not sure how much more insight is even possible. Still, detections felt generic, and it was hard to tell exactly what gave me away (when Defender caught me, at least; other failure modes give you more specific feedback). This is the kind of feedback you get:

"Defender detected malware multiple times. Ensure Beacon is resilient against static detection via Malleable C2, the Artifact Kit, and Resource Kit. Post-ex OPSEC, such as the spawnto, ppid, etc, are the hardest bits to get right."

Tooling

Cobalt Strike is the primary tool of the course and the exam, and it is a very complete one. Still, I would have liked a bit more room for bring-your-own tooling: Cobalt Strike is the base of your operations, but you still need things like the Rubeus binary, and even though the attack host ships plenty of BOFs, I sometimes felt pushed toward fork-and-run when a public BOF on GitHub would have suited the task. Same story with enumeration: labs expect PowerView, while I much prefer tools like BloodyAD.

When I asked Rasta Mouse (the course author) whether the lack of extra tooling was an OPSEC choice or just out of scope for the course, his answer was:

"Neither specifically. Just that Skillable doesn't have a built-in way (that I know of) to allow you to upload files via the lab client. But we also have to be a bit restrictive over those features because egress is a concern for Cobalt Strike."

My Exam Experience

I really enjoyed the exam: a fun full operation pivoting across multiple hosts.

Watch Out for this errors

If you hit either of these, the affected machine most likely needs a reset:

• SMB: 64 → ERROR_NETNAME_DELETED ("The specified network name is no longer available").
• RPC: 1722 → RPC_S_SERVER_UNAVAILABLE ("The RPC server is unavailable").

It took me a few hours to figure this out. You can select the machine in the upper-left corner and reset just that one.

Recommendations and Tips

1. Redo the Defence Evasion Module Before the Exam

Don't sleep on the "Defence Evasion" module. It sits at the beginning of the course and is easy to have half-forgotten by the time you finish, so run through that lab again right before the exam.

2. Save Everything That Works

Keep every successful command the moment it works. You'll need it to repeat your steps fast if a machine breaks, and again for a retake.

3. Keep Notes Like You Mean It

Same discipline as ever: note where each credential came from and where it worked, and keep an ideas list. Retakes are possible if you fail, so don't panic. Good notes are what make a second attempt cheap.

Would I Recommend the CRTO?

Yes. If you want to learn C2 operations and start thinking like an operator instead of just an exploiter, this is exactly the course. The teaching is excellent and the exam is genuinely fun.