Altered Security

How Altered Security grades your exam report

Applies to CRTP, CRTE, CARTP.

What the CRTP, CRTE and CARTP report has to contain — the Active Directory attack path, documented so it can be walked again.

CRTP
24-hour exam + report
CRTE
48-hour exam + report
CARTP
24-hour exam + report

Altered Security’s exams are Active Directory attack chains, and the report is judged on whether the chain is legible. A reader should be able to follow your path from initial foothold to enterprise admin as a single connected story.

The standard

Document the attack path, step by step, with enough detail to walk it again. Every hop needs: what you had, what you did, what you got, and how that enabled the next hop.

Isolated findings are less useful here than in a general pentest report. The value is in the chain.

Structure that works

Attack path summary. A short diagram or ordered list showing the route: foothold → credential → lateral move → escalation → domain. One page. This is the first thing a marker reads and it frames everything after it.

Step-by-step walkthrough. For each hop:

Enumeration evidence. Show what you saw before you acted. AD attacks turn on what the directory told you — trusts, ACLs, delegation, group nesting — and a path that skips the enumeration reads as a lucky guess.

Mitigations. Per step, how it would have been prevented or detected.

Getting the detail right

Active Directory reports fail on ambiguity more than on omission. Name things precisely: which user, on which host, in which domain, with which rights. “I used the admin account” is not a step. “Used svc_backup, which was a member of Backup Operators on SRV-FILE01 in corp.local” is.

Include the tooling flags. Rubeus and Mimikatz commands are not self-explaining six months later, and they are not self-explaining to a marker either.

The time split

CRTP gives 24 hours on the network and a further 24 to write. CRTE and CARTP allow 48 hours. Take notes and screenshots continuously — an AD chain has many small steps and reconstructing the ordering afterwards is where people lose marks.

The exams this covers