offensive-advanced-redteam

# Advanced Red Team Operations

Red team engagements simulate real-world adversaries against an organization's people,
processes, and technology. Unlike penetration tests that maximize vulnerability discovery
in a fixed scope, red team operations test detection and response capabilities by pursuing
specific objectives while evading defenders. You operate under rules of engagement that
define what is in bounds, and every action you take must be deliberate, documented, and
reversible. This skill covers the full engagement lifecycle from initial planning through
final debrief.

## Quick Workflow

1. Negotiate scope, rules of engagement, and deconfliction procedures with the client.
2. Build tiered attack infrastructure with redirectors, aged domains, and valid TLS.
3. Configure C2 profiles to blend with the target's legitimate traffic patterns.
4. Execute the attack chain while maintaining strict OPSEC and logging every action.
5. Collect and stage data with encryption; maintain chain of custody throughout.
6. Evade endpoint and network defenses using tested bypass techniques.
7. Document findings with MITRE ATT&CK mappings and deliver structured reporting.
8. Conduct purple team debrief to validate detection gaps and remediation.

---

## Engagement Planning

Every red team engagement begins with planning that protects both the operator and the
client. Skipping this phase leads to scope disputes, legal exposure, and operational
failures.

### Scope and Objectives

Define what you are testing and what success looks like. Common objective types include
data exfiltration (retrieve specific records from a database), domain dominance (obtain
Domain Admin or equivalent), business process disruption (demonstrate ability to halt a
critical workflow), and physical access (gain entry to a restricted area).

Document explicitly what is out of scope: production systems that cannot tolerate
downtime, third-party SaaS platforms without authorization, destructive actions, and
social engineering of specific individuals (executives, legal counsel).

### Rules of Engagement (ROE)

The ROE is a signed legal document. It must contain:

- **Authorization window**: exact dates and hours of permitted activity.
- **Authorized techniques**: which ATT&CK tactics are permitted (e.g., no physical access, no supply chain attacks).
- **Notification thresholds**: conditions under which you must pause and notify the client (e.g., discovering active threat actor, finding child exploitation material, accidental data destruction).
- **Emergency contacts**: a 24/7 phone number for immediate deconfliction, not just email.
- **Legal shield**: explicit written authorization referencing the Computer Fraud and Abuse Act (US), Computer Misuse Act (UK), or equivalent local statute.

### Deconfliction

Establish a deconfliction process so defenders can verify whether observed activity is
your operation or a real threat. Common approaches:

- **Trusted agent model**: one or two individuals on the defender side who know the engagement is happening and can confirm or deny your activity via a secure channel.
- **Code word system**: a unique code word embedded in your tooling or traffic that defenders can query the trusted agent about.
- **Deconfliction log**: a timestamped record of every action you take, shared with the trusted agent in near-real-time via an encrypted channel.

```text
# Example deconfliction log entry
2026-08-25T14:32:00Z | OPERATOR: kai | ACTION: lateral-movement
  TARGET: 10.10.5.22 (WORKSTATION-FIN03)
  TECHNIQUE: T1021.006 (Windows Remote Management)
  TOOL: evil-winrm via SOCKS proxy
  NOTES: creds from LSASS dump on WORKSTATION-FIN01
  DECONF-CODE: REDTIGER-4482
```

### Communications Security

All operator communications use end-to-end encrypted channels. Never discuss target
details over unencrypted email or Slack. Use a dedicated encrypted messaging platform
(Signal, Wire, or a self-hosted Matrix instance) for real-time coordination. Transfer
files and logs over mutually authenticated TLS or via GPG-encrypted archives.

---

## Infrastructure Setup

Your infrastructure is what separates a red team engagement from a penetration test
run out of a Kali VM. Invest time in building infrastructure that is resilient,
attributable only to your cover identity, and segmented so that burning one asset does
not compromise the operation. Map infrastructure actions to MITRE ATT&CK Resource
Development (TA0042).

### Tiered Architecture

Segment infrastructure into at least three tiers:

| Tier | Purpose | Burn Tolerance | Example |
|------|---------|----------------|---------|
| T1 - Delivery | Phishing, payload hosting | High (expect burn) | Aged domain + Mailgun |
| T2 - Short-haul C2 | Interactive operator sessions | Medium | VPS + Cloudflare tunnel |
| T3 - Long-haul C2 | Persistence callbacks | Low (protect at all costs) | DNS-over-HTTPS beacon |

Each tier uses separate domains, separate VPS providers, and separate operator accounts.
If T2 is burned, you re-establish interactive access through T3 without re-phishing.

### Domain Aging and Reputation

Register domains at least 14-30 days before the engagement. During the aging period:

```bash
# Set up a basic landing page to build categorization
sudo certbot certonly --standalone -d ops-portal.example.com
echo "<html><body>Coming soon</body></html>" > /var/www/html/index.html

# Submit to categorization services
# Visit: https://sitereview.bluecoat.com/
# Visit: https://www.fortiguard.com/webfilter
# Categorize as "Business" or "Technology" - never "Uncategorized"

# Verify categorization after 7-10 days
curl -s "https://sitereview.bluecoat.com/resource/lookup" \
  -d "url=ops-portal.example.com" | jq .
```

Choose domain names that blend with the target's industry. If the target is a financial
firm, domains resembling fintech SaaS products are more plausible than gaming sites.

### Redirectors and Traffic Filtering

Never expose your team server directly to the in