Red Team Tactics

​

Overview

​

What This Skill Provides

• MITRE ATT&CK Phases: Complete attack lifecycle understanding
• Reconnaissance Principles: Passive and active information gathering
• Initial Access Vectors: Entry point selection and exploitation
• Privilege Escalation: Windows and Linux elevation techniques
• Defense Evasion: Avoiding detection and maintaining stealth
• Lateral Movement: Spreading across internal networks
• Active Directory Attacks: Kerberoasting, DCSync, Golden Tickets
• Reporting Principles: Documenting attack chains and detection gaps
• Ethical Boundaries: Responsible adversary simulation

​

MITRE ATT&CK Phases

​

Attack Lifecycle

RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
       ↓              ↓              ↓            ↓
   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
       ↓              ↓              ↓            ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT

​

Phase Objectives

​

Use Cases

​

When to Use This Skill

• Red team engagements
• Adversary simulation exercises
• Security control validation
• Detection engineering
• Security awareness training
• Incident response preparation

​

Example Scenarios

1. Red Team Exercise: “Simulate an attack on this infrastructure”
2. Detection Validation: “Test if our SIEM detects lateral movement”
3. Security Assessment: “Identify detection gaps in our defenses”
4. Training: “Demonstrate how attackers move through networks”

​

Reconnaissance Principles

​

Passive vs Active

​

Information Targets

​

Initial Access Vectors

​

Selection Criteria

​

Privilege Escalation Principles

​

Windows Targets

​

Linux Targets

​

Defense Evasion Principles

​

Key Techniques

​

Operational Security

• Work during business hours
• Mimic legitimate traffic patterns
• Use encrypted channels
• Blend with normal behavior

​

Lateral Movement Principles

​

Credential Types

​

Movement Paths

• Admin shares
• Remote services (RDP, SSH, WinRM)
• Exploitation of internal services

​

Active Directory Attacks

​

Attack Categories

​

Reporting Principles

​

Attack Narrative

1. How initial access was gained
2. What techniques were used
3. What objectives were achieved
4. Where detection failed

​

Detection Gaps

• What should have detected it?
• Why didn’t detection work?
• How to improve detection

​

Ethical Boundaries

​

Always

• Stay within scope
• Minimize impact
• Report immediately if real threat found
• Document all actions

​

Never

• Destroy production data
• Cause denial of service (unless scoped)
• Access beyond proof of concept
• Retain sensitive data

​

Attack Chain Example

​

Phase 1: Reconnaissance

1. Identify company domain and email format
2. Find employee names on LinkedIn
3. Map external IP ranges
4. Enumerate exposed services

​

Phase 2: Initial Access

1. Send phishing email to identified employees
2. User clicks link, executes payload
3. Establish C2 channel

​

Phase 3: Privilege Escalation

1. Enumerate user privileges
2. Find unquoted service path
3. Write malicious executable to path
4. Restart service → SYSTEM access

​

Phase 4: Lateral Movement

1. Dump credentials from LSASS
2. Find domain admin hash
3. Pass-the-hash to domain controller
4. DCSync to extract all domain credentials

​

MITRE ATT&CK Mapping

• Tactic: Why (e.g., Privilege Escalation)
• Technique: What (e.g., T1574.009 - Unquoted Service Path)
• Procedure: How (specific implementation)

​

Detection Engineering

​

For Each Technique

• Observable artifacts: What can be detected?
• Detection logic: How to detect it?
• False positive rate: How noisy is detection?
• Evasion potential: Can it be bypassed?

​

Anti-Patterns to Avoid

​

Related Skills

• vulnerability-scanner: Finding exploitable vulnerabilities
• api-patterns: API security testing
• clean-code: Secure coding practices

​

Which Agents Use This Skill

• security-auditor: Uses for attack simulation
• penetration-tester: Primary user for red team operations

​

Operational Considerations

​

Scope Definition

• Target systems clearly defined
• Out-of-scope systems identified
• Acceptable attack vectors agreed
• Impact limitations set
• Communication plan established

​

During Engagement

• Maintain detailed logs of all actions
• Report critical findings immediately
• Stop if unexpected damage occurs
• Coordinate with blue team if needed

​

Post-Engagement

• Clean up artifacts
• Remove persistence mechanisms
• Deliver comprehensive report
• Conduct debrief with defenders

​

Tools Available

• Read, Glob, Grep: For reconnaissance and analysis