One definition of the word ‘beacon’ is “a radio transmitter that emits a characteristic guidance signal for aircraft” (The Free Dictionary). A beacon in cybersecurity terms is a piece of software inside of a system that emits a characteristic guidance signal for a software listener. This can be for good or bad. An anomalous or unknown beacon is often an indicator of compromise (IoC). For the sake of WMD 5, a beacon is your C2 Agent… and you’re going to build one!
WMD 5 is designed to introduce you to and help you become comfortable with making your own full-fledged agent. Continuing with our trilogy around the C2 Agent Lifecycle AKA the “WMD Advanced Path”, we will iterate on the concepts of WMD 4 Stage0/1 development and build our own custom Stage 2 Agent. Also, a bit of Stage 1 and Stage 3 are sprinkled in here as well for good measure.
WMD Intro Path
- WMD 1 – Malware Dev Basics and Shellcode Loaders
- WMD 2 – Adv Execution and Obfuscation TTPs
- WMD 3 – Dynamic Evasion Techniques
Bundle = 20% Off the WMD Intro Path (Courses 1 – 3)
A New Trilogy Continues…
In a unique style that his students have come to love (both here on JHT and at DEF CON), Dahvid Schloss embarked on a new journey spawning a second trilogy. WMD 4 is the start of the WMD Advanced Path! WMD 5 is available now and expect to see WMD 6 in Q1 of 2026. Will there be a third trilogy? Hmm…
Price = $150
What will I learn in WMD 5?
In WMD 5, we focus on Agents:
- What they are
- How to choose a design language for them
- How to write them
- How to integrate Stage 1s and Stage 3s into them
By the end of WMD 5, you should understand how to design and write your own agent.
What is the format of this course?
This course is a follow-along coding course. You won’t be given the code directly, and it’s encouraged that you write the code yourself while the video plays as the best way to learn is by doing.
You need to set up the lab environment on your own to produce your agents and DLL files. This should be considered the first step in the journey. If you can’t figure out the lab part first, it may not be the best time to start this course.
That being said, we do have VMs for your convenience, but you should still know how to set this up.
WMD 5 contains 12.5 hours of video, an option to use your own dedicated virtual lab to play and quizzes to test your understanding. Of course, the ultimate test is… DOES YOUR CODE WORK!?!? Here’s the Agenda:
Who should take WMD 5?
People who are tired of just using the same ol’ signatured-based agents from all their favorite C2s and want to build something custom but just aren’t sure where to start? This is meant for you.
Prerequisites for WMD 5
You don’t have to buy all of the previous WMD courses, but this course assumes that students have the knowledge presented in the WMD Intro Path (WMD Courses 1 – 3). Therefore, having basic coding skills, experience with shellcode and AV evasion are highly recommended. It also assumes you have PIC knowledge from WMD 4.
This course gives students the option to play on their own or utilize a dedicated virtual environment. Because everything is provided for you, you need nothing other than a computer, Internet access and your brain!
