red-team

---
name: red-team
description: Use when planning or executing authorized red team engagements or attack-path analysis. Covers MITRE ATT&CK kill-chain planning, technique scoring, choke points, and OPSEC risk.
category: Engineering
version: 1.0.0
tools: []
---

# Red Team

Red team engagement planning and attack-path analysis for authorized offensive security simulations. This is not vulnerability scanning and not incident response — it is structured adversary simulation to test detection, response, and control effectiveness.

## What This Covers

The methodology for red team engagement planning: building structured attack plans from MITRE ATT&CK technique selection, access level, and crown-jewel targets. Score techniques by effort and detection risk, assemble kill-chain phases, identify choke points, and flag OPSEC risks.

**Distinction from adjacent disciplines:** red team engagement planning is offensive, structured attack planning and execution aimed at testing detection/response (not the systematic exploitation of specific weaknesses that vulnerability discovery does, not the proactive telemetry-based detection of attacker TTPs, and not the reactive containment/investigation of a confirmed incident).

## Authorization Requirement

All red team activity described here requires written authorization: a signed Rules of Engagement (RoE) document, a defined scope, and explicit executive approval. Never produce an engagement plan without confirming this authorization exists first. Unauthorized use of these techniques is illegal under the CFAA, the Computer Misuse Act, and equivalent laws worldwide.

## Building an Engagement Plan

Build a scored, kill-chain-ordered attack plan from: the selected MITRE ATT&CK techniques, the starting access level, and the crown-jewel targets.

**Access levels:**

| Level | Starting position | Techniques available |
|-------|------------------|----------------------|
| External | No internal access — internet only | External-facing techniques only (T1190, T1566, etc.) |
| Internal | Network foothold, no credentials | Internal recon + lateral-movement prep |
| Credentialed | Valid credentials already obtained | Full kill chain including priv-esc, lateral movement, impact |

Flag a scope violation whenever a requested technique falls outside what the stated access level permits — don't silently include it.

## Kill-Chain Phase Methodology

Organize techniques into these phases, in this order, and structure the execution plan accordingly:

| Phase | Order | MITRE Tactic | Examples |
|-------|-------|--------------|----------|
| Reconnaissance | 1 | TA0043 | T1595, T1596, T1598 |
| Resource Development | 2 | TA0042 | T1583, T1588 |
| Initial Access | 3 | TA0001 | T1190, T1566, T1078 |
| Execution | 4 | TA0002 | T1059, T1047, T1204 |
| Persistence | 5 | TA0003 | T1053, T1543, T1136 |
| Privilege Escalation | 6 | TA0004 | T1055, T1548, T1134 |
| Credential Access | 7 | TA0006 | T1003, T1110, T1558 |
| Lateral Movement | 8 | TA0008 | T1021, T1550, T1534 |
| Collection | 9 | TA0009 | T1074, T1560, T1114 |
| Exfiltration | 10 | TA0010 | T1048, T1041, T1567 |
| Impact | 11 | TA0040 | T1486, T1491, T1498 |

Each phase must complete before advancing to the next, unless the engagement scope specifies an assumed-breach start (skip directly to a later phase). Don't skip persistence before attempting lateral movement — persistence ensures operational continuity if a single foothold is detected and removed.

## Technique Scoring and Prioritization

Score each technique's effort with: `effort_score = detection_risk × (len(prerequisites) + 1)`. Lower effort score means easier to execute without triggering detection.

| Technique | Detection Risk | Prerequisites | Effort Score | MITRE ID |
|-----------|---------------|---------------|-------------|---------|
| PowerShell execution | 0.7 | initial_access | 1.4 | T1059.001 |
| Scheduled task persistence | 0.5 | execution | 1.0 | T1053.005 |
| Pass-the-Hash | 0.6 | credential_access, internal_network | 1.8 | T1550.002 |
| LSASS credential dump | 0.8 | local_admin | 1.6 | T1003.001 |
| Spearphishing link | 0.4 | none | 0.4 | T1566.001 |
| Ransomware deployment | 0.9 | persistence, lateral_movement | 2.7 | T1486 |

## Choke Point Analysis

Choke points are techniques required by multiple paths to crown-jewel assets — detecting one choke-point technique detects every attack path that passes through it. Identify choke points by finding techniques in the `credential_access` and `privilege_escalation` tactics that serve as prerequisites for multiple subsequent techniques targeting crown jewels. Prioritize detection-rule development and monitoring density around choke points — hardening one has multiplied defensive value.

Common choke points by environment: Active Directory domain → T1003 (credential dump), T1558 (Kerberoasting), highest priority; AWS environment → T1078.004 (cloud account), `iam:PassRole` chains, highest priority; hybrid cloud → T1550.002 (Pass-the-Hash), T1021.006 (WinRM), high priority; containerized apps → T1610 (deploy container), T1611 (container escape), high priority.

## OPSEC Risk Assessment

OPSEC risk items are actions likely to trigger detection or leave persistent artifacts:

| Tactic | Primary OPSEC risk | Mitigation |
|--------|------------------|------------|
| Credential Access | LSASS memory access triggers EDR | Prefer LSASS-less techniques (DCSync, Kerberoasting) where possible |
| Execution | PowerShell command-line logging | Use AMSI bypass or an alternative execution method in scope |
| Lateral Movement | NTLM lateral movement generates event 4624 type 3 | Prefer Kerberos; avoid NTLM over the network |
| Persistence | Scheduled tasks generate event 4698 | Use a less-monitored persistence mechanism within scope |
| Exfiltration | Large outbound transfers trigger DLP | Stage data and use slow exfil if stealth is required |

Before each phase, check: is the technique in scope per the RoE; will it generate logs the blue team actively monitors; is there a less-detectable in-scope alternative; if detected, does it reveal the full operation or only the current foothold; are cleanup artifacts defined for post-exercise removal?

## Crown Jewel Targeting

Crown-jewel assets are the high-value targets that define an engagement's success criteria:

| Crown Jewel Type | Target Indicators | Attack Paths |
|-----------------|------------------|--------------|
| Domain Controller | AD DS, NTDS.dit, SYSVOL | Kerberoasting → DCSync → Golden Ticket |
| Database servers | Production SQL, NoSQL, data warehouse | Lateral movement → DBA account → data staging |
| Payment systems | PCI-scoped network, card data vault | Network pivot → service account → exfiltration |
| Source code repositories | Internal Git, build systems | VPN → internal git → code signing keys |
| Cloud management plane | AWS management console, IAM admin | Phishing → credential → AssumeRole chain |

Crown-jewel definition is agreed in the RoE — measure engagement success by whether the crown jewels were reached, not by the count of vulnerabilities found.

## Attack Path Methodology

Identify all viable routes from the starting access level to each crown jewel. Score each path by total effort (sum of per-technique effort scores), choke-point count (how many choke points the path passes through), and detection probability (product of per-technique detection risks). Lower effort plus fewer choke points is the attacker's path of least resistance.

Example attack path graph: external access → T1566.001 spearphishing → initial access → T1059.001 PowerShell → execution → T1003.001 LSASS dump → credential access [CHOKE POINT] → T1550.002 Pass-the-Hash → lateral movement → T1078.002 domain account → privilege escalation → Crown Jewel: Domain Controller.

## Workflows

**Quick engagement scoping (~30 min):** enumerate the available techniques against kill-chain coverage gaps; build the plan for an assumed-external, no-access scenario against the named crown jewel; review the resulting choke points and OPSEC risks; present the kill-chain phases to stakeholders for scope approval. Decision rule: if the choke points are already covered by detection rules, focus the exercise on the gaps; if not, those choke points are the highest-value exercise targets.

**Full engagement (multi-week):** Week 1 planning — define crown jewels and success criteria with stakeholders, sign the RoE with defined scope/timeline/exclusions, build the engagement plan, review OPSEC risks per phase. Week 2 external execution — reconnaissance and target profiling, initial-access attempts (phishing, public-facing exploits), document every technique with timestamps, log detection events to validate blue-team coverage. Week 3 internal execution — establish persistence if initial access succeeded, execute credential-access techniques (the choke points), move laterally toward crown jewels, document when/how crown jewels were reached. Week 4 reporting — compile findings (techniques executed, detection rates, crown jewels reached), map findings to detection gaps, produce remediation recommendations prioritized by choke-point impact, deliver the read-out to security leadership.

**Assumed-breach tabletop:** simulate a compromised-credential scenario starting from the credentialed access level, targeting named crown jewels, to rapidly test detection; compare the resulting phases, choke points, and total effort score across external/internal/credentialed starting positions to see how much a credential leak shortens the attacker's path.

## Anti-Patterns

Operating without written authorization — unauthorized red team activity against any system without explicit permission is a criminal offense; authorization must be a real signed RoE predating execution, not a formality to bypass a check. Skipping kill-chain phase ordering — jumping straight to lateral movement without establishing persistence means a single detection wipes out the entire foothold. Not defining crown jewels before starting — engagements without defined success criteria drift into open-ended vulnerability hunting; crown jewels and success conditions belong in the RoE before the first technique executes. Ignoring OPSEC risk in the plan — deliberately avoiding every detectable technique produces an unrealistic engagement that doesn't validate detection coverage; use OPSEC risk to understand exposure, not to dodge it entirely. Failing to document executed techniques with timestamps — undermines both the after-action report and the blue team's ability to correlate their own detections against ground truth.