Red Team Operations

Adversary simulation, TTPs, purple teaming, and red team methodologies.

Overview

Red teams simulate real-world attackers to test defenses.

Red Team Phases

1. Reconnaissance → Information gathering
2. Weaponization → Create payloads
3. Delivery → Initial access
4. Exploitation → Gain foothold
5. Installation → Persistence
6. Command & Control → Remote access
7. Actions on Objectives → Achieve goals

MITRE ATT&CK for Red Teams

Tactics:
├── Reconnaissance
├── Resource Development
├── Initial Access
├── Execution
├── Persistence
├── Privilege Escalation
├── Defense Evasion
├── Credential Access
├── Discovery
├── Lateral Movement
├── Collection
├── Command and Control
├── Exfiltration
└── Impact

Purple Teaming

# Purple team exercise
exercise:
  name: "Lateral Movement Test"
  red_team:
    - test_credential_theft
    - attempt_lateral_movement
    - escalate_privileges
  blue_team:
    - monitor_for_anomalies
    - detect_lateral_movement
    - respond_to_incident
  objectives:
    - measure_detection_time
    - validate_response_procedures

Common Tools

Reporting

# Red Team Report

## Executive Summary
- Objective: Test detection and response capabilities
- Duration: 2 weeks
- Results: Partial success

## Findings
### Critical
- Lateral movement via compromised credentials
- Lack of network segmentation

### High
- Unpatched vulnerabilities
- Weak password policies

## Recommendations
1. Implement network segmentation
2. Deploy EDR solution
3. Enhance monitoring

Practice

Conduct a purple team exercise focusing on lateral movement detection.