How Altered Security grades your exam report
Applies to CRTP, CRTE, CARTP.
What the CRTP, CRTE and CARTP report has to contain — the Active Directory attack path, documented so it can be walked again.
- CRTP
- 24-hour exam + report
- CRTE
- 48-hour exam + report
- CARTP
- 24-hour exam + report
Altered Security’s exams are Active Directory attack chains, and the report is judged on whether the chain is legible. A reader should be able to follow your path from initial foothold to enterprise admin as a single connected story.
The standard
Document the attack path, step by step, with enough detail to walk it again. Every hop needs: what you had, what you did, what you got, and how that enabled the next hop.
Isolated findings are less useful here than in a general pentest report. The value is in the chain.
Structure that works
Attack path summary. A short diagram or ordered list showing the route: foothold → credential → lateral move → escalation → domain. One page. This is the first thing a marker reads and it frames everything after it.
Step-by-step walkthrough. For each hop:
- The command run, exactly, with its output
- What the output told you and why you moved where you moved next
- The credential, ticket or trust relationship you obtained
Enumeration evidence. Show what you saw before you acted. AD attacks turn on what the directory told you — trusts, ACLs, delegation, group nesting — and a path that skips the enumeration reads as a lucky guess.
Mitigations. Per step, how it would have been prevented or detected.
Getting the detail right
Active Directory reports fail on ambiguity more than on omission. Name things
precisely: which user, on which host, in which domain, with which rights. “I
used the admin account” is not a step. “Used svc_backup, which was a member of
Backup Operators on SRV-FILE01 in corp.local” is.
Include the tooling flags. Rubeus and Mimikatz commands are not self-explaining six months later, and they are not self-explaining to a marker either.
The time split
CRTP gives 24 hours on the network and a further 24 to write. CRTE and CARTP allow 48 hours. Take notes and screenshots continuously — an AD chain has many small steps and reconstructing the ordering afterwards is where people lose marks.
The exams this covers
- what the CRTP exam involvesUnderstand
- what the CRTE exam involvesUnderstand
- what the CARTP exam involvesUnderstand