AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.

Red Team Tactics

Adversary simulation principles based on MITRE ATT&CK framework.

1. MITRE ATT&CK Phases

Attack Lifecycle

RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE

       ↓              ↓              ↓            ↓

   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY

       ↓              ↓              ↓            ↓

LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT

Phase Objectives

Phase

Objective

Recon

Map attack surface

Initial Access

Get first foothold

Execution

Run code on target

Persistence

Survive reboots

Privilege Escalation

Get admin/root

Defense Evasion

Avoid detection

Credential Access

Harvest credentials

Discovery

Map internal network

Lateral Movement

Spread to other systems

Collection

Gather target data

C2

Maintain command channel

Exfiltration

Extract data

2. Reconnaissance Principles

Passive vs Active

Type

Trade-off

Passive

No target contact, limited info

Active

Direct contact, more detection risk

Information Targets

Category

Value

Technology stack

Attack vector selection

Employee info

Social engineering

Network ranges

Scanning scope

Third parties

Supply chain attack

3. Initial Access Vectors

Selection Criteria

Vector

When to Use

Phishing

Human target, email access

Public exploits

Vulnerable services exposed

Valid credentials

Leaked or cracked

Supply chain

Third-party access

4. Privilege Escalation Principles

Windows Targets

Check

Opportunity

Unquoted service paths

Write to path

Weak service permissions

Modify service

Token privileges

Abuse SeDebug, etc.

Stored credentials

Harvest

Linux Targets

Check

Opportunity

SUID binaries

Execute as owner

Sudo misconfiguration

Command execution

Kernel vulnerabilities

Kernel exploits

Cron jobs

Writable scripts

5. Defense Evasion Principles

Key Techniques

Technique

Purpose

LOLBins

Use legitimate tools

Obfuscation

Hide malicious code

Timestomping

Hide file modifications

Log clearing

Remove evidence

Operational Security

• Work during business hours

• Mimic legitimate traffic patterns

• Use encrypted channels

• Blend with normal behavior

6. Lateral Movement Principles

Credential Types

Type

Use

Password

Standard auth

Hash

Pass-the-hash

Ticket

Pass-the-ticket

Certificate

Certificate auth

Movement Paths

• Admin shares

• Remote services (RDP, SSH, WinRM)

• Exploitation of internal services

7. Active Directory Attacks

Attack Categories

Attack

Target

Kerberoasting

Service account passwords

AS-REP Roasting

Accounts without pre-auth

DCSync

Domain credentials

Golden Ticket

Persistent domain access

8. Reporting Principles

Attack Narrative

Document the full attack chain:

• How initial access was gained

• What techniques were used

• What objectives were achieved

• Where detection failed

Detection Gaps

For each successful technique:

• What should have detected it?

• Why didn't detection work?

• How to improve detection

9. Ethical Boundaries

Always

• Stay within scope

• Minimize impact

• Report immediately if real threat found

• Document all actions

Never

• Destroy production data

• Cause denial of service (unless scoped)

• Access beyond proof of concept

• Retain sensitive data

10. Anti-Patterns

❌ Don't

✅ Do

Rush to exploitation

Follow methodology

Cause damage

Minimize impact

Skip reporting

Document everything

Ignore scope

Stay within boundaries

Remember: Red team simulates attackers to improve defenses, not to cause harm.

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

Limitations

• Use this skill only when the task clearly matches the scope described above.

• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.

• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.