1---2name: red-teaming3description: Use when planning or conducting adversarial red team engagements that test an organization's detection, response, and resilience capabilities beyond traditional penetration testing. Covers red team vs pen test distinctions, adversary simulation frameworks (MITRE ATT&CK, Cyber Kill Chain), purple teaming, C2 frameworks, and AI/LLM red teaming. USE FOR: red teaming, adversary simulation, MITRE ATT&CK, Cyber Kill Chain, purple teaming, C2 frameworks, assumed breach, attack path mapping, detection testing, AI red teaming, LLM red teaming, tabletop exercises DO NOT USE FOR: automated vulnerability scanning (use security-testing), initial vulnerability discovery (use penetration-testing), threat modeling during design (use threat-modeling)4license: MIT5---67# Red Teaming89## Overview1011Red teaming is an adversarial assessment that goes beyond penetration testing to evaluate an organization's **detection, response, and resilience** capabilities against realistic attack scenarios. While pen testing asks "can we get in?", red teaming asks "can you detect us, stop us, and recover?"1213Red teams operate with stealth, simulate real-world threat actors (APTs, insider threats, ransomware groups), and test the full kill chain — from initial access through lateral movement to objective completion. The goal is not just to find vulnerabilities, but to expose gaps in people, processes, and technology.1415> **Important**: Red team engagements require explicit written authorization from organizational leadership. Only a small group (the "white team" or "trusted agents") should know the engagement is occurring. Unauthorized adversarial activity is illegal.1617### Key References1819| Title | Author(s) | Focus |20|-------|-----------|-------|21| *Red Team Development and Operations* | Joe Vest & James Tubberville | Planning and executing red team engagements |22| *The Hacker Playbook 3* | Peter Kim | Red team field manual with practical TTPs |23| *Adversarial Tradecraft in Cybersecurity* | Dan Borges | Offensive and defensive techniques for red/blue teams |24| *MITRE ATT&CK Framework* | MITRE Corporation | Comprehensive knowledge base of adversary tactics and techniques |25| *Cyber Kill Chain* | Lockheed Martin | Seven-stage model of cyberattack progression |2627## Red Team vs Pen Test vs Vulnerability Assessment2829| Dimension | Vulnerability Assessment | Penetration Test | Red Team |30|-----------|------------------------|------------------|----------|31| **Goal** | Find known vulnerabilities | Exploit vulnerabilities to prove impact | Test detection and response against realistic attacks |32| **Scope** | Broad, automated scanning | Defined targets and systems | Objective-based (e.g., "exfiltrate customer database") |33| **Stealth** | None | Minimal | High — evade detection, mimic real threat actors |34| **Duration** | Hours to days | Days to weeks | Weeks to months |35| **Blue team awareness** | Yes | Usually yes | No (except white team) |36| **Tests people/process** | No | Limited | Yes — primary focus |37| **Methodology** | Scan and report | OWASP/PTES/OSSTMM | MITRE ATT&CK, Cyber Kill Chain |38| **Output** | Vulnerability list with severities | Exploit proof with business impact | Detection gaps, response failures, attack narratives |3940## Adversary Simulation Frameworks4142### MITRE ATT&CK4344The industry-standard knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations.4546| Tactic | Description | Example Techniques |47|--------|-------------|-------------------|48| **Reconnaissance** | Gathering information about the target | Active scanning, search open websites, gather victim identity info |49| **Resource Development** | Establishing infrastructure for the attack | Acquire infrastructure, develop capabilities, establish accounts |50| **Initial Access** | Getting into the target environment | Phishing, exploit public-facing application, supply chain compromise |51| **Execution** | Running adversary-controlled code | Command/scripting interpreter, exploitation for client execution |52| **Persistence** | Maintaining access across restarts | Boot/logon autostart, scheduled tasks, account manipulation |53| **Privilege Escalation** | Gaining higher-level permissions | Exploitation for privilege escalation, access token manipulation |54| **Defense Evasion** | Avoiding detection | Obfuscated files, indicator removal, masquerading |55| **Credential Access** | Stealing credentials | OS credential dumping, brute force, credentials from password stores |56| **Discovery** | Understanding the environment | Network service scanning, system information discovery |57| **Lateral Movement** | Moving through the environment | Remote services, exploitation of remote services, lateral tool transfer |58| **Collection** | Gathering data of interest | Data from local system, email collection, screen capture |59| **Command and Control** | Communicating with compromised systems | Application layer protocol, encrypted channel, proxy |60| **Exfiltration** | Stealing data | Exfiltration over C2 channel, exfiltration over web service |61| **Impact** | Disrupting, destroying, or manipulating systems | Data encrypted for impact (ransomware), defacement, data destruction |6263### Cyber Kill Chain (Lockheed Martin)6465A linear model of cyberattack progression:6667```681. Reconnaissance ──► 2. Weaponization ──► 3. Delivery ──► 4. Exploitation69 │ │70 │ 7. Actions on ◄── 6. Command ◄── 5. Installation71 │ Objectives & Control72 └──────────────────────────────────────────────────────────┘73 Defender can break the chain at any stage74```7576| Stage | Attacker Activity | Defender Response |77|-------|------------------|-------------------|78| **Reconnaissance** | Research targets, scan for vulnerabilities | Monitor for scanning, minimize public exposure |79| **Weaponization** | Create exploit payload, craft phishing lure | Threat intelligence, signature updates |80| **Delivery** | Send phishing email, exploit web app | Email filtering, web application firewall, user training |81| **Exploitation** | Execute exploit, trigger vulnerability | Patching, endpoint detection, application hardening |82| **Installation** | Install backdoor, establish persistence | EDR, application allowlisting, integrity monitoring |83| **Command & Control** | Establish C2 channel, beacon | Network monitoring, DNS filtering, egress controls |84| **Actions on Objectives** | Exfiltrate data, deploy ransomware, pivot | DLP, segmentation, incident response, backups |8586## Purple Teaming8788Purple teaming is the **collaborative integration** of red team (attack) and blue team (defense) to maximize learning and improve detection coverage.8990| Aspect | Traditional Red Team | Purple Team |91|--------|---------------------|-------------|92| **Collaboration** | Adversarial — red hides from blue | Cooperative — red and blue work together |93| **Goal** | Find gaps in detection and response | Improve detection and response in real-time |94| **Process** | Red attacks, writes report, blue reads later | Red executes technique, blue tunes detection, iterate |95| **Speed of improvement** | Slow (report → fix cycle) | Fast (immediate feedback loop) |96| **Best for** | Mature security programs | Building and validating detection capabilities |9798### Purple Team Exercise Flow991001. **Select ATT&CK technique** to test (e.g., T1059 — Command and Scripting Interpreter)1012. **Red team executes** the technique in a controlled environment1023. **Blue team observes** — did alerts fire? Were logs generated? Was the activity detected?1034. **Gap analysis** — identify what was missed and why1045. **Detection engineering** — blue team writes or tunes detection rules1056. **Re-execute** — red team runs the technique again to verify detection1067. **Document** — record the detection coverage and any remaining gaps1078. **Repeat** for the next technique108109## C2 Frameworks110111Command and Control (C2) frameworks provide the infrastructure for maintaining access to compromised systems during engagements. These tools must only be used in authorized engagements.112113| Framework | Type | Key Features | Best For |114|-----------|------|-------------|----------|115| **Cobalt Strike** | Commercial | Beacon payload, Malleable C2 profiles, team server, industry standard | Professional red teams, APT simulation |116| **Sliver** | Open source (BishopFox) | Cross-platform implants, mutual TLS, DNS/HTTP/WireGuard C2 | Modern open-source alternative to Cobalt Strike |117| **Havoc** | Open source | Demon agent, sleep obfuscation, token manipulation | Advanced evasion techniques |118| **Mythic** | Open source | Multi-agent support, containerized, extensible | Flexible multi-platform C2 |119| **Brute Ratel** | Commercial | Badger payload, EDR evasion focused, syscall-level evasion | EDR bypass testing |120| **Caldera** | Open source (MITRE) | ATT&CK-aligned automated adversary emulation | Automated purple team exercises |121122## Attack Path Mapping123124| Tool | Purpose | Type |125|------|---------|------|126| **BloodHound** | Active Directory attack path visualization | Open source |127| **PlumHound** | BloodHound report automation | Open source |128| **PingCastle** | AD security assessment and risk scoring | Free (community) |129| **ADExplorer** | AD snapshot and analysis | Free (Sysinternals) |130131## AI / LLM Red Teaming132133AI systems require specialized red teaming to test for vulnerabilities unique to language models and autonomous agents.134135| Concern | Test Approach | Tools |136|---------|--------------|-------|137| **Prompt injection** | Craft adversarial inputs to override system instructions | Garak, Promptfoo |138| **Data extraction** | Attempt to extract training data or PII from model responses | Manual probing, ARTKIT |139| **System prompt leakage** | Try to reveal hidden system prompts or instructions | Manual, Promptfoo |140| **Jailbreaking** | Bypass safety guardrails to produce harmful content | Garak, DeepTeam |141| **Excessive agency** | Test whether agent takes unauthorized actions | Scenario-based testing, sandboxed execution |142| **Hallucination exploitation** | Trick model into generating convincing false information | Domain-specific fact-checking probes |143| **Multi-turn manipulation** | Gradually shift model behavior across conversation turns | ARTKIT (multi-turn framework) |144145### AI Red Teaming Tools146147| Tool | Maintainer | Focus |148|------|-----------|-------|149| **Garak** | OWASP | 100+ attack modules for LLM vulnerability scanning |150| **ARTKIT** | — | Multi-turn adversarial interaction framework |151| **Promptfoo** | — | Prompt testing, comparison, and red teaming |152| **DeepTeam** | — | Comprehensive LLM red team framework |153| **Counterfit** | Microsoft | Adversarial ML attack framework (classical + generative AI) |154| **Caldera + MITRE ATLAS** | MITRE | ATT&CK-aligned adversarial ML tactics |155156## Tabletop Exercises157158Tabletop exercises simulate cyber incidents in a discussion-based format without touching live systems. They test incident response plans, communication, and decision-making.159160### Common Scenarios161162| Scenario | Tests | Participants |163|----------|-------|-------------|164| **Ransomware attack** | Containment, communication, ransom decision, recovery | Executive, IT, Legal, Comms |165| **Data breach** | Breach notification, forensics, regulatory response | Security, Legal, Compliance, Comms |166| **Insider threat** | Detection, investigation, HR/legal coordination | Security, HR, Legal, IT |167| **Supply chain compromise** | Vendor assessment, containment, customer notification | Security, Engineering, Legal, Comms |168| **Business email compromise** | Fraud detection, financial controls, employee training | Finance, Security, Executive |169170### Running a Tabletop1711721. **Define scenario and objectives** — what are you testing?1732. **Identify participants** — include leadership, not just technical staff1743. **Prepare injects** — time-sequenced events that escalate the scenario1754. **Facilitate discussion** — walk through decisions at each stage1765. **Document gaps** — record where plans broke down, who was unclear on their role1776. **Produce action items** — concrete improvements with owners and deadlines1787. **Schedule follow-up** — run the exercise again after improvements are implemented179180## Best Practices181182- **Distinguish red teaming from pen testing** — pen tests find vulnerabilities; red teams test your ability to detect and respond to real attacks.183- **Start with purple teaming** if your security program is still maturing — get collaborative value before going adversarial.184- **Map engagements to MITRE ATT&CK** to measure detection coverage systematically against known adversary techniques.185- **Use assumed breach as a starting point** for red team engagements — skip initial access and focus on lateral movement and detection gaps.186- **Conduct tabletop exercises** quarterly to test incident response without the cost and risk of live red team engagements.187- **Rotate between internal and external red teams** — external teams bring fresh TTPs; internal teams bring organizational knowledge.188- **Debrief collaboratively** — red team findings should lead to blue team improvements, not blame.189- **Invest in detection engineering** based on red team results — every missed detection is an opportunity to build a new rule.190- **Test AI systems with specialized AI red teaming** — traditional pen testing tools do not cover prompt injection, jailbreaking, or excessive agency.191- **Treat red team reports as highly confidential** — they contain detailed attack playbooks specific to your organization.
Tyler-R-Kendrick