Red Team Tactics

red-team-tactics

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

CongDon1207/AGENTS.md·0installs18stars

SKILL.md

Full skill instructions

Red Team Tactics

Adversary simulation principles based on MITRE ATT&CK framework.

1. MITRE ATT&CK Phases

Attack Lifecycle

RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
       ↓              ↓              ↓            ↓
   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
       ↓              ↓              ↓            ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT

Phase Objectives

Phase	Objective
Recon	Map attack surface
Initial Access	Get first foothold
Execution	Run code on target
Persistence	Survive reboots
Privilege Escalation	Get admin/root
Defense Evasion	Avoid detection
Credential Access	Harvest credentials
Discovery	Map internal network
Lateral Movement	Spread to other systems
Collection	Gather target data
C2	Maintain command channel
Exfiltration	Extract data

2. Reconnaissance Principles

Passive vs Active

Type	Trade-off
Passive	No target contact, limited info
Active	Direct contact, more detection risk

Information Targets

Category	Value
Technology stack	Attack vector selection
Employee info	Social engineering
Network ranges	Scanning scope
Third parties	Supply chain attack

3. Initial Access Vectors

Selection Criteria

Vector	When to Use
Phishing	Human target, email access
Public exploits	Vulnerable services exposed
Valid credentials	Leaked or cracked
Supply chain	Third-party access

4. Privilege Escalation Principles

Windows Targets

Check	Opportunity
Unquoted service paths	Write to path
Weak service permissions	Modify service
Token privileges	Abuse SeDebug, etc.
Stored credentials	Harvest

Linux Targets

Check	Opportunity
SUID binaries	Execute as owner
Sudo misconfiguration	Command execution
Kernel vulnerabilities	Kernel exploits
Cron jobs	Writable scripts

5. Defense Evasion Principles

Key Techniques

Technique	Purpose
LOLBins	Use legitimate tools
Obfuscation	Hide malicious code
Timestomping	Hide file modifications
Log clearing	Remove evidence

Operational Security

Work during business hours
Mimic legitimate traffic patterns
Use encrypted channels
Blend with normal behavior

6. Lateral Movement Principles

Credential Types

Type	Use
Password	Standard auth
Hash	Pass-the-hash
Ticket	Pass-the-ticket
Certificate	Certificate auth

Movement Paths

Admin shares
Remote services (RDP, SSH, WinRM)
Exploitation of internal services

7. Active Directory Attacks

Attack Categories

Attack	Target
Kerberoasting	Service account passwords
AS-REP Roasting	Accounts without pre-auth
DCSync	Domain credentials
Golden Ticket	Persistent domain access

8. Reporting Principles

Attack Narrative

Document the full attack chain:

How initial access was gained
What techniques were used
What objectives were achieved
Where detection failed

Detection Gaps

For each successful technique:

What should have detected it?
Why didn't detection work?
How to improve detection

9. Ethical Boundaries

Always

Stay within scope
Minimize impact
Report immediately if real threat found
Document all actions

Never

Destroy production data
Cause denial of service (unless scoped)
Access beyond proof of concept
Retain sensitive data

10. Anti-Patterns

❌ Don't	✅ Do
Rush to exploitation	Follow methodology
Cause damage	Minimize impact
Skip reporting	Document everything
Ignore scope	Stay within boundaries

Remember: Red team simulates attackers to improve defenses, not to cause harm.

Install skill

Copy and run in your terminal

npx -y skills add https://github.com/CongDon1207/AGENTS.md --skill red-team-tactics

View on GitHub

.agent/skills/red-team-tactics/SKILL.md

senior-data-engineer
World-class data engineering skill for building scalable data pipelines, ETL/ELT systems, and data infrastructure. Expertise in Python, SQL, Spark, Airflow, dbt, Kafka, and modern data stack. Includes data modeling, pipeline orchestration, data quality, and DataOps. Use when designing data archit...
0 installs
clean-code
Pragmatic coding standards - concise, direct, no over-engineering, no unnecessary comments
0 installs
vr-ar
VR/AR development principles. Comfort, interaction, performance requirements.
0 installs
tailwind-patterns
Tailwind CSS v4 principles. CSS-first configuration, container queries, modern patterns, design token architecture.
0 installs

More skills from CongDon1207

CongDon1207/AGENTS.md

testing-patterns

Testing patterns and principles. Unit, integration, mocking strategies.

18 0

View

CongDon1207/AGENTS.md

Guide for creating effective skills, adding skill references, skill scripts or optimizing existing skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, frameworks, libraries o...

18 0

View

CongDon1207/AGENTS.md

performance-profiling

Performance profiling principles. Measurement, analysis, and optimization techniques.

18 0

View

CongDon1207/AGENTS.md

python-patterns

Python development principles and decision-making. Framework selection, async patterns, type hints, project structure. Teaches thinking, not copying.

18 0

View

CongDon1207/AGENTS.md

xlsx

Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Codex needs to work with spreadsheets (.xlsx, .xlsm, .csv, .tsv, etc) for: (1) Creating new spreadsheets with formulas and formatting, (2) Reading or analyzing d...

18 0

View

CongDon1207/AGENTS.md

pdf

Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. When Codex needs to fill in a PDF form or programmatically process, generate, or analyze PDF documents at scale.

18 0

View

CongDon1207/AGENTS.md

brainstorming

Socratic questioning protocol + user communication. MANDATORY for complex requests, new features, or unclear requirements. Includes progress reporting and error handling.

18 0

View

CongDon1207/AGENTS.md

web-design-guidelines

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

18 0

View

CongDon1207/AGENTS.md

databases

Work with MongoDB (document database, BSON documents, aggregation pipelines, Atlas cloud) and PostgreSQL (relational database, SQL queries, psql CLI, pgAdmin). Use when designing database schemas, writing queries and aggregations, optimizing indexes for performance, performing database migrations...

18 0

View

CongDon1207/AGENTS.md

vulnerability-scanner

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

18 0

View

CongDon1207/AGENTS.md

docx

Comprehensive document creation, editing, and analysis with support for tracked changes, comments, formatting preservation, and text extraction. When Codex needs to work with professional documents (.docx files) for: (1) Creating new documents, (2) Modifying or editing content, (3) Working with t...

18 0

View

CongDon1207/AGENTS.md