Red Team Tactics

1---
2name: red-team-tactics
3description: Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
4allowed-tools: Read, Glob, Grep
5---
6 
7# Red Team Tactics
8 
9> Adversary simulation principles based on MITRE ATT&CK framework.
10 
11---
12 
13## 1. MITRE ATT&CK Phases
14 
15### Attack Lifecycle
16 
17```
18RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
19       ↓              ↓              ↓            ↓
20   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
21       ↓              ↓              ↓            ↓
22LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
23```
24 
25### Phase Objectives
26 
27| Phase | Objective |
28|-------|-----------|
29| **Recon** | Map attack surface |
30| **Initial Access** | Get first foothold |
31| **Execution** | Run code on target |
32| **Persistence** | Survive reboots |
33| **Privilege Escalation** | Get admin/root |
34| **Defense Evasion** | Avoid detection |
35| **Credential Access** | Harvest credentials |
36| **Discovery** | Map internal network |
37| **Lateral Movement** | Spread to other systems |
38| **Collection** | Gather target data |
39| **C2** | Maintain command channel |
40| **Exfiltration** | Extract data |
41 
42---
43 
44## 2. Reconnaissance Principles
45 
46### Passive vs Active
47 
48| Type | Trade-off |
49|------|-----------|
50| **Passive** | No target contact, limited info |
51| **Active** | Direct contact, more detection risk |
52 
53### Information Targets
54 
55| Category | Value |
56|----------|-------|
57| Technology stack | Attack vector selection |
58| Employee info | Social engineering |
59| Network ranges | Scanning scope |
60| Third parties | Supply chain attack |
61 
62---
63 
64## 3. Initial Access Vectors
65 
66### Selection Criteria
67 
68| Vector | When to Use |
69|--------|-------------|
70| **Phishing** | Human target, email access |
71| **Public exploits** | Vulnerable services exposed |
72| **Valid credentials** | Leaked or cracked |
73| **Supply chain** | Third-party access |
74 
75---
76 
77## 4. Privilege Escalation Principles
78 
79### Windows Targets
80 
81| Check | Opportunity |
82|-------|-------------|
83| Unquoted service paths | Write to path |
84| Weak service permissions | Modify service |
85| Token privileges | Abuse SeDebug, etc. |
86| Stored credentials | Harvest |
87 
88### Linux Targets
89 
90| Check | Opportunity |
91|-------|-------------|
92| SUID binaries | Execute as owner |
93| Sudo misconfiguration | Command execution |
94| Kernel vulnerabilities | Kernel exploits |
95| Cron jobs | Writable scripts |
96 
97---
98 
99## 5. Defense Evasion Principles
100 
101### Key Techniques
102 
103| Technique | Purpose |
104|-----------|---------|
105| LOLBins | Use legitimate tools |
106| Obfuscation | Hide malicious code |
107| Timestomping | Hide file modifications |
108| Log clearing | Remove evidence |
109 
110### Operational Security
111 
112- Work during business hours
113- Mimic legitimate traffic patterns
114- Use encrypted channels
115- Blend with normal behavior
116 
117---
118 
119## 6. Lateral Movement Principles
120 
121### Credential Types
122 
123| Type | Use |
124|------|-----|
125| Password | Standard auth |
126| Hash | Pass-the-hash |
127| Ticket | Pass-the-ticket |
128| Certificate | Certificate auth |
129 
130### Movement Paths
131 
132- Admin shares
133- Remote services (RDP, SSH, WinRM)
134- Exploitation of internal services
135 
136---
137 
138## 7. Active Directory Attacks
139 
140### Attack Categories
141 
142| Attack | Target |
143|--------|--------|
144| Kerberoasting | Service account passwords |
145| AS-REP Roasting | Accounts without pre-auth |
146| DCSync | Domain credentials |
147| Golden Ticket | Persistent domain access |
148 
149---
150 
151## 8. Reporting Principles
152 
153### Attack Narrative
154 
155Document the full attack chain:
1561. How initial access was gained
1572. What techniques were used
1583. What objectives were achieved
1594. Where detection failed
160 
161### Detection Gaps
162 
163For each successful technique:
164- What should have detected it?
165- Why didn't detection work?
166- How to improve detection
167 
168---
169 
170## 9. Ethical Boundaries
171 
172### Always
173 
174- Stay within scope
175- Minimize impact
176- Report immediately if real threat found
177- Document all actions
178 
179### Never
180 
181- Destroy production data
182- Cause denial of service (unless scoped)
183- Access beyond proof of concept
184- Retain sensitive data
185 
186---
187 
188## 10. Anti-Patterns
189 
190| ❌ Don't | ✅ Do |
191|----------|-------|
192| Rush to exploitation | Follow methodology |
193| Cause damage | Minimize impact |
194| Skip reporting | Document everything |
195| Ignore scope | Stay within boundaries |
196 
197---
198 
199> **Remember:** Red team simulates attackers to improve defenses, not to cause harm.
200