# Redteam Operations

> Red Team Operations

- Skill: `j4flmao/redteam-operations` (Agent Skill)
- Install (CLI): `npx skillmds@latest add j4flmao/redteam-operations`
- Raw SKILL.md: https://api.skillmd.com/api/skills/j4flmao/redteam-operations/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: j4flmao (https://skillmd.com/u/j4flmao)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/j4flmao/redteam-operations

---

# Red Team Operations

> [!WARNING]
> **DISCLAIMER: EDUCATIONAL & DEFENSIVE PURPOSES ONLY**
> This skill and its technical methodologies are strictly for authorized adversary simulation, defensive posture validation, and educational purposes. Do not use for unauthorized access.

## 1. Skill Context
**Focus**: Adversary simulation methodology, OSINT, C2 architecture, and defense evasion (educational).
**Triggers**: simulate attack, red team strategy, bypass edr concept, lateral movement, c2 infrastructure

## 2. Advanced Strategy and Execution
Red Team operations simulate sophisticated adversaries (APTs). The agent must focus on providing architectural and strategic insights into:

### Command & Control (C2) Architecture
- **Redirectors**: Utilizing Nginx/HAProxy reverse proxies with domain fronting or CDN pivoting to mask the true C2 backend (e.g., Cobalt Strike Teamserver, Mythic, Sliver).
- **Malleable C2 Profiles**: Modifying beacon signatures, jitter, HTTP headers, and sleeping patterns to blend in with normal network traffic (e.g., mimicking jQuery or Windows Update).

### Initial Access & Payload Delivery
- **Phishing & Execution**: Macro-enabled Office documents (VBA), HTML Smuggling, and malicious LNK files. 
- **Defense Evasion (In-Memory execution)**:
  - **Process Injection**: Shellcode injection via `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
  - **Process Hollowing**: Spawning a legitimate suspended process, unmapping its memory, and replacing it with a malicious payload.
  - **AMSI/ETW Patching**: Hooking and modifying `AmsiScanBuffer` or `EtwEventWrite` in memory to return `AMSI_RESULT_CLEAN`.

### Lateral Movement & Privilege Escalation
- **Living off the Land (LOLBins)**: Using native Windows tools (`wmic`, `powershell`, `certutil`, `rundll32`) to avoid dropping custom binaries.
- **Credential Dumping**: Extracting LSASS memory (via `procdump` or MiniDumpWriteDump), DCSync attacks, and Pass-the-Hash.

## 3. Output Format
- Detail the simulated attack vector step-by-step.
- Explain the underlying API calls or protocols abused.
- **Mandatory**: Conclude with Blue Team detection strategies (e.g., monitoring `CreateRemoteThread` telemetry, hunting for anomalous child processes of `winword.exe`).