RedTeaming

Resources

• SANSOffensiveOperations : https://www.youtube.com/@SANSOffensiveOperations

Notes

General

• The goal of a red team is to achieve an operational objective that has been pre-agreed with the client. This will vary between clients, but will often entail gaining access to business-critical systems or data. It should not be generic, such as “get domain admin”. One valuable outcome of a red team assessment is a clear indication of business risk by demonstrating the impact of compromise. Gaining access to a domain admin user (or the user of a privileged group) may be a stepping stone in achieving the operational objective, but it should not be the objective itself.

Do's and Don'ts

DO:

• Log Everything: Maintain strict timestamps and C2 logs. It is your only defense during deconfliction if the client blames you for a network outage.
• Understand Your Artifacts: Never run a tool if you don’t know exactly what registry keys, memory pages, or network traffic it generates.
• Situational Awareness: Map the host processes and EDR drivers the second a payload executes before taking offensive action.

DON’T:

• Run Pre-compiled GitHub Junk: Always read the source code and compile it yourself to avoid backdoors and system crashes.
• Use Plaintext C2: Never transmit credentials or commands over unencrypted channels.
• Steal Real PII/PCI Data: Capture non-sensitive Proof of Access (like a directory listing). Actually exfiltrating restricted data creates a legal breach.
• Turn Off Antivirus: Bypass security controls in memory; never permanently disable a client’s defenses and leave them exposed to real threat actors.

Tactics, Techniques, and Procedures (TTPs)

TTPs describe the why, the how, and the exact steps an adversary takes to achieve their operational objective. They form the foundational structure of threat emulation and frameworks like MITRE ATT&CK.

---

1. Tactics (The “Why”)

The overarching tactical goal or reason for performing an action. Adversaries chain multiple tactics together to progress through an attack lifecycle.

• Examples: Initial Access, Privilege Escalation, Credential Access, Lateral Movement, Defense Evasion.

2. Techniques (The “How”)

The method or mechanism used to accomplish a specific tactic. There are often dozens of different techniques to achieve a single tactical goal.

• Example (Credential Access): Dumping credentials directly from memory vs. searching for cleartext passwords in the Windows Registry or configuration files.

3. Procedures (The “Exact Steps”)

The precise step-by-step execution or specific software implementation of a technique.

• Example (Memory Dumping): Using Mimikatz vs. dumping the lsass.exe process via Task Manager or comsvcs.dll.

The Operator's Takeaway Procedures (like blocking the string mimikatz.exe). Professional Red Teams force defenses to evolve by changing procedures while maintaining realistic adversary Techniques and Tactics.

Blue Teams can easily write signatures for specific

Adversary Emulation vs. Simulation

While both approaches test organizational defenses, they serve entirely different strategic purposes during an engagement.

Feature	Adversary Emulation	Adversary Simulation
The Threat	A specific, known threat actor (e.g., FIN7, APT29).	A hypothetical, advanced threat.
The TTPs	Strictly mirrors known TTPs derived from Threat Intelligence.	Unrestricted; leverages custom, unique, or undocumented TTPs.
The Goal	Test if defenses can detect a highly likely, specific adversary.	Evaluate broad capabilities and uncover unknown security blind spots.
Scope	Narrow and highly focused.	Broad and creative.
OPSEC Priority	Lower (the goal is to see if the Blue Team catches the known indicators).	Extremely High (the goal is to achieve the objective completely unseen).

The Engineering Translation Emulation. Writing a custom C/MASM loader from scratch to bypass an undocumented EDR hook is Simulation.

Configuring a Cobalt Strike Team Server with a Malleable C2 profile pulled straight from a Mandiant report is

Cyber Attack Lifecycles & Frameworks

Attack frameworks structure the phases of an intrusion, allowing operators to plan campaigns and defensive teams to map detection coverage.

1. Lockheed Martin Cyber Kill Chain (Linear)

1. Reconnaissance: Scouting target infrastructure and employees.
2. Weaponisation: Creating the payload (e.g., coupling malware with an exploit).
3. Delivery: Sending the payload to the target (e.g., spear-phishing).
4. Exploitation: Executing code on the target system.
5. Installation: Establishing a backdoor on the compromise point.
6. Command & Control (C2): Opening a channel for remote administration.
7. Actions on Objectives: Executing the ultimate goal (exfiltration, destruction).

---

2. Mandiant Targeted Attack Lifecycle (Post-Exploitation)

• Initial Reconnaissance $\to$ Initial Compromise $\to$ Establish Foothold
• The Internal Loop: Escalate Privileges $\to$ Internal Reconnaissance $\to$ Move Laterally $\to$ Maintain Presence
• Complete Mission

---

3. MITRE ATT&CK Matrix (Behavioral Taxonomy)

• Replaces fixed sequences with a matrix of Tactics (Goals) and Techniques (Actions).

• Documents granular TTPs for post-compromise actions across modern enterprise platforms (Windows, Linux, Active Directory, Cloud).

Operational Takeaway Mandiant's model to understand campaign flow, MITRE ATT&CK to select specific techniques during execution, and the Cyber Kill Chain when explaining high-level intrusion paths to executive stakeholders.

Use

Nodes

• Evasion
• C2