---
name: red-team-tactics-25ce66f484cb
description: Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
allowed-tools: Read, Glob, Grep
---

# Red Team Tactics

> Adversary simulation principles based on MITRE ATT&CK framework.

---

## 1. MITRE ATT&CK Phases

### Attack Lifecycle

```
RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
       ↓              ↓              ↓            ↓
   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
       ↓              ↓              ↓            ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
```

### Phase Objectives

| Phase                    | Objective                |
| ------------------------ | ------------------------ |
| **Recon**                | Map attack surface       |
| **Initial Access**       | Get first foothold       |
| **Execution**            | Run code on target       |
| **Persistence**          | Survive reboots          |
| **Privilege Escalation** | Get admin/root           |
| **Defense Evasion**      | Avoid detection          |
| **Credential Access**    | Harvest credentials      |
| **Discovery**            | Map internal network     |
| **Lateral Movement**     | Spread to other systems  |
| **Collection**           | Gather target data       |
| **C2**                   | Maintain command channel |
| **Exfiltration**         | Extract data             |

---

## 2. Reconnaissance Principles

### Passive vs Active

| Type        | Trade-off                           |
| ----------- | ----------------------------------- |
| **Passive** | No target contact, limited info     |
| **Active**  | Direct contact, more detection risk |

### Information Targets

| Category         | Value                   |
| ---------------- | ----------------------- |
| Technology stack | Attack vector selection |
| Employee info    | Social engineering      |
| Network ranges   | Scanning scope          |
| Third parties    | Supply chain attack     |

---

## 3. Initial Access Vectors

### Selection Criteria

| Vector                | When to Use                 |
| --------------------- | --------------------------- |
| **Phishing**          | Human target, email access  |
| **Public exploits**   | Vulnerable services exposed |
| **Valid credentials** | Leaked or cracked           |
| **Supply chain**      | Third-party access          |

---

## 4. Privilege Escalation Principles

### Windows Targets

| Check                    | Opportunity         |
| ------------------------ | ------------------- |
| Unquoted service paths   | Write to path       |
| Weak service permissions | Modify service      |
| Token privileges         | Abuse SeDebug, etc. |
| Stored credentials       | Harvest             |

### Linux Targets

| Check                  | Opportunity       |
| ---------------------- | ----------------- |
| SUID binaries          | Execute as owner  |
| Sudo misconfiguration  | Command execution |
| Kernel vulnerabilities | Kernel exploits   |
| Cron jobs              | Writable scripts  |

---

## 5. Defense Evasion Principles

### Key Techniques

| Technique    | Purpose                 |
| ------------ | ----------------------- |
| LOLBins      | Use legitimate tools    |
| Obfuscation  | Hide malicious code     |
| Timestomping | Hide file modifications |
| Log clearing | Remove evidence         |

### Operational Security

- Work during business hours
- Mimic legitimate traffic patterns
- Use encrypted channels
- Blend with normal behavior

---

## 6. Lateral Movement Principles

### Credential Types

| Type        | Use              |
| ----------- | ---------------- |
| Password    | Standard auth    |
| Hash        | Pass-the-hash    |
| Ticket      | Pass-the-ticket  |
| Certificate | Certificate auth |

### Movement Paths

- Admin shares
- Remote services (RDP, SSH, WinRM)
- Exploitation of internal services

---

## 7. Active Directory Attacks

### Attack Categories

| Attack          | Target                    |
| --------------- | ------------------------- |
| Kerberoasting   | Service account passwords |
| AS-REP Roasting | Accounts without pre-auth |
| DCSync          | Domain credentials        |
| Golden Ticket   | Persistent domain access  |

---

## 8. Reporting Principles

### Attack Narrative

Document the full attack chain:

1. How initial access was gained
2. What techniques were used
3. What objectives were achieved
4. Where detection failed

### Detection Gaps

For each successful technique:

- What should have detected it?
- Why didn't detection work?
- How to improve detection

---

## 9. Ethical Boundaries

### Always

- Stay within scope
- Minimize impact
- Report immediately if real threat found
- Document all actions

### Never

- Destroy production data
- Cause denial of service (unless scoped)
- Access beyond proof of concept
- Retain sensitive data

---

## 10. Anti-Patterns

| ❌ Don't             | ✅ Do                  |
| -------------------- | ---------------------- |
| Rush to exploitation | Follow methodology     |
| Cause damage         | Minimize impact        |
| Skip reporting       | Document everything    |
| Ignore scope         | Stay within boundaries |

---

> **Remember:** Red team simulates attackers to improve defenses, not to cause harm.


---
Source attribution: Ab-aswini
Original project: https://github.com/Ab-aswini/Agent-kit-P1/blob/16ae07362b19abdfca76a3c20a7e34bb40dbadff/.agent-os/skills/red-team-tactics/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Copyright (c) 2025 Ab-aswini

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: Ab-aswini
Original project: https://github.com/Ab-aswini/Agent-kit-P1/blob/16ae07362b19abdfca76a3c20a7e34bb40dbadff/.agent-os/skills/red-team-tactics/SKILL.md
Attribution basis: Source repository record

Fields of work: Data & Analytics, Development & Engineering, Legal
Roles: Compliance Officer, Data Analyst, Security Engineer
Specialties: Specialty not specified
Tools: Glob, Grep, Read
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: faeeb8c6c594d5dd1ddfa2535091aa7b5078e203b97b3d7c2c2c0a4bc14fc9cf