RANKUP Training Suite

Fluency is built at the prompt, not on the slide.

A student finishes the course knowing what PowerShell is. Then they sit down at a live prompt and can't type a single working command without help. That gap is not a knowledge problem. It is a fluency problem, and fluency is only built one way — by producing the syntax yourself, repeatedly, until it stops requiring conscious effort.

Most training platforms hand the student a reference and call it instruction. RANKUP makes them type it.

{{ ctaLabel }} See the lab catalog

RANKUP — {{ slideLabel }}

                
                [RANKUP]
              
Stuck? Type more at any prompt to open a Deep Dive reference window.
CLI/PowerShell Courseware
PowerShell Foundations
Type esc at any prompt to pause or return to this menu.
Progress: 1 / 9 sections complete
1. Cmdlets and Discovery [DONE]
2. Variables and Assignment
3. Strings
4. Arrays
5. Hashtables
6. Math and Operators
7. Control Flow
8. Functions
9. Environment and System
B. Bonus Training
F. Run Full Training
R. View Completed Syntaxes [UNLOCKED]
P. Print Completion Certificate [LOCKED]
C. Toggle Companion Text [On]
X. Exit
Select a section: 
PS C:\Users\Student>
RANK 3 Operative
184 XP
BONUS00:30
LIVES:

              [RANKUP]
            
POWERSHELL FOUNDATIONS
PowerShell is the primary administration platform for modern Windows environments, and the primary attack surface. This courseware builds the conceptual and syntactic foundation you need to work in it effectively.
-- WHY THIS MATTERS ------------------------------
PowerShell is the most capable built-in attack tool on any Windows system. It is present by default, trusted by the OS, and capable of everything from credential theft to lateral movement to data exfiltration.
-- WHAT YOU WILL COVER ---------------------------
->  Cmdlets and Discovery--  Get-Command, Get-Help, Get-Member
->  Variables and Assignment--  types, scope, common patterns
->  Strings--  manipulation, formatting, interpolation
->  Arrays--  creation, indexing, filtering
->  Hashtables--  key-value pairs, splatting
->  Math and Operators--  arithmetic, comparison, logical
->  Control Flow--  if/else, foreach, while, switch
->  Functions--  definition, parameters, scope
->  Environment and System--  env vars, system info, version
-- DCWF / NICE WORKFORCE ALIGNMENT ---------------
WORK ROLES
451  Systems Administrator
511  Cyber Defense Analyst
531  Cyber Defense Incident Responder
KNOWLEDGE AREAS
K0060  Operating systems
K0318  OS command-line tools
K0392  Scripting languages and techniques
L. Launch this course
B. Back to main menu
Your choice: 

GLOBAL APPENDIX REFERENCE

Part 1

Trainer Command Reference

Module 1: CMD & Batch — the Windows command prompt environment that predates PowerShell, and the syntax adversary tooling still speaks.

cdchanges your current working directory

dirlists the contents of the current directory

echoprints text to the terminal; with > it writes a file

ipconfigdisplays IP configuration for active adapters

systeminfosnapshot of local system configuration

tasklistdisplays all currently running processes

net userlists all local user accounts on the machine

pingsends ICMP echo requests to a specified host

Part 1 — trainer command referencecmd & batch

{{ slideNum }} / 03

Suites deployed

Labs available

416

Assessed challenges

KSA codes mapped

DCWF work roles

01 Courseware

Five modules. Each one builds on the last.

Students type actual syntax at a simulated prompt. Incorrect answers trigger graduated hints. The third miss reveals the answer and marks the gap.

01

CMD & Batch Scripting

The shell most students inherit and never learn. Path handling, redirection, loops, and the batch constructs still running in production environments.

ranks 1–2

02

WMIC

Windows Management Instrumentation from the command line. Class queries, aliases, remote node syntax, and output formatting under pressure.

ranks 2–4

03

PowerShell Foundations

Verb-noun structure, parameters, objects, and the discovery cmdlets. Students stop guessing at syntax and start deriving it.

ranks 4–6

04

Pipes & Filters

Where fluency shows. Chaining, selection, sorting, grouping, measurement — building a single line that answers a real question.

ranks 6–8

05

PowerShell Remoting

Sessions, fan-out execution, credential handling, and the failure modes that stall an investigation on a live network.

ranks 8–10

Rank progression

A 10-tier rank progression runs across the courseware, earned through correct answers, first-attempt bonuses, and synthesis performance. Labs maintain a separate six-tier standing.

Courseware ranks

Attempts per challenge

02 Lab catalog

6 suites. 41 labs. 416 assessed challenges.

One flagship investigation campaign, plus 5 suites mapped to DCWF work roles.

Flagship suite suite DCO

DCO Investigation & Remediation Suite

A continuous adversary campaign. One environment, one intrusion, four phases — Investigation, Remediation, Hardening, Validation.

Nothing resets between labs. The student inherits what they left behind. It is the most demanding material in the catalog.

Labs

222

Assessed challenges

Phases

Persistent environment

phase 01

Investigation

Establish scope. Trace the intrusion through host and network artifacts.

phase 02

Remediation

Remove persistence and restore the affected hosts to a known state.

phase 03

Hardening

Close the paths the adversary used. Document each control applied.

phase 04

Validation

Prove the environment is clean. Produce the evidence a reviewer would ask for.

DCWF work role suites

Code

Work role

Labs

Assessed

KSA codes

{{ s.code }}

KSA codes are mapped per challenge. The crosswalk is a deliverable — a reviewer can trace any assessed item back to the work role framework. Custom suites are built against agency-specific KSA sets and SOPs.

03 Deployment

Built for the environments that don't have internet.

offline / air-gap

Complete on disk

No internet connection required at install or runtime. No license server. No telemetry. The suite runs in a closed enclave exactly as it runs on a connected network.

reporting

Signed performance reports

Exportable and tamper-evident. Each report ties a student's assessed results to the KSA codes behind them, in a form that goes straight into a training record.

instructor console

Cohort-level visibility

Training NCOs and program managers see where a cohort stalls — by module, by challenge, by attempt count. The gaps surface before the exercise, not after.

progression

Ranks earned by output

10 courseware ranks and a separate six-tier lab standing. Advancement comes from typed answers, first-attempt bonuses, and synthesis performance — not seat time.

the companion

Tips, never the answer

The companion flame sits at the top of every module, offering general tips and tricks as the student works — and companion text is colored to match it. What it never does is type for them. The syntax still has to come from the student, which is the only part that builds fluency.

04 About

Greybox Worx

Greybox Worx builds cybersecurity training for the U.S. federal government. The courseware and labs were written by a practitioner who has sat on both sides of the training gap — teaching the material, then watching capable people stall at a live prompt.

The design of the product follows from that. Every challenge requires produced syntax. Hints are graduated, not given. Assessment is per challenge and mapped to a KSA code, so a program manager can point at a result and say what it proves.

Custom suite development is available against agency-specific KSA sets and standard operating procedures.

NAICS

611420

Framework

DCWF / NICE

Delivery

Offline media

05 Procurement

Request a briefing.

NAICS 611420 — computer training
UEI & CAGE on request
Crosswalk deliverable available

Tell us the work roles you need covered and the environment you deploy into. We respond with a capability brief, a lab catalog, and pricing against your seat count.

Name

Agency / organization

Official email

Seats

Contract vehicle

Environment

Work roles and requirement