red-team-tactics_skill

Overview

This skill codifies red team tactics and operational principles mapped to the MITRE ATT&CK lifecycle. It focuses on attack phases, common techniques for initial access, lateral movement, privilege escalation, and defense evasion, plus ethical boundaries and reporting guidance. The goal is to help teams plan realistic adversary simulations and produce actionable detections and mitigation recommendations.

How this skill works

The content inspects each ATT&CK phase and lists practical objectives, typical vectors, and decision criteria for selecting techniques. It summarizes reconnaissance trade-offs (passive vs active), access vectors, escalation checks for Windows and Linux, lateral movement paths, Active Directory attack categories, and operational security measures. It also prescribes reporting structure and detection-gap analysis to convert exercises into defensive improvements.

When to use it

• Designing a red team engagement plan or tabletop exercise
• Creating realistic attack scenarios for purple team drills
• Assessing detection coverage and detection engineering priorities
• Training blue team analysts on common adversary behaviors
• Validating incident response playbooks against realistic techniques

Best practices

• Define and enforce clear scope, legal and safety boundaries before testing
• Prefer low-impact proof-of-concept actions; avoid destructive techniques
• Mimic normal user and network patterns to increase realism while minimizing noise
• Document the full attack chain and link each technique to detection gaps
• Report actionable mitigations prioritized by risk and detection feasibility

Example use cases

• Simulate phishing to test email defenses and user response workflows
• Run lateral movement scenarios using valid credentials to validate segmentation
• Exercise privilege escalation checks on Windows services and Linux sudo misconfigurations
• Test Active Directory resiliency with Kerberoasting and DCSync detection rules
• Perform post-engagement reporting that maps techniques to missed alerts and controls