<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-attack-infrastructure
description: >-
  Deploy and manage red team attack infrastructure including redirectors, DNS
  configurations, phishing domains, payload hosting, and C2 relay servers with
  proper operational security and teardown procedures.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - attack-infrastructure
  - redirectors
  - domain-fronting
  - operational-security
  - resource-development
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1583.001", "T1583.003", "T1583.006", "T1584.001"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["python3", "terraform", "nginx", "certbot"]
---

# Implementing Attack Infrastructure

## Overview

Attack infrastructure provides the operational backbone for adversary simulation
campaigns. Properly configured redirectors, domain categorization, and TLS
certificates make emulated attacks realistic while maintaining operational
security boundaries defined in the rules of engagement.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `terraform` | Security tooling |
| `nginx` | Security tooling |
| `certbot` | Security tooling |
| Cloud provider accounts for VPS deployment | Environment requirement |
| Domain registrar access for campaign domains | Environment requirement |
| Understanding of network traffic routing and proxying | Environment requirement |

## Workflow

### Step 1: Domain Acquisition and Categorization

```bash
# Check domain categorization and reputation
node scripts/agent.js check-domain --domain "example-cdn.com"

# Register and configure DNS
node scripts/agent.js setup-dns --domain "example-cdn.com" --provider cloudflare
```

### Step 2: Deploy Redirectors

```nginx
# NGINX redirector configuration
server {
    listen 443 ssl;
    server_name example-cdn.com;

    ssl_certificate /etc/letsencrypt/live/example-cdn.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example-cdn.com/privkey.pem;

    location /api/ {
        proxy_pass https://c2-backend:8443;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location / {
        return 301 https://legitimate-site.com;
    }
}
```

### Step 3: Infrastructure Deployment

```bash
# Deploy infrastructure with Terraform
node scripts/agent.js deploy --config infra.json --provider aws

# Verify all components are operational
node scripts/agent.js health-check --config infra.json
```

### Step 4: Teardown and Cleanup

```bash
# Destroy all infrastructure after engagement
node scripts/agent.js teardown --config infra.json --verify

# Verify no residual resources remain
node scripts/agent.js audit-cleanup --provider aws --tag "engagement-2026"
```

## Detection

```yaml
title: Attack Infrastructure Detection
id: e0d69c7e-113f-40d6-a19d-4097ed33664e
status: experimental
description: Detects suspicious activity related to implementing attack infrastructure techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*attack*"
  condition: selection
level: high
tags:
  - attack.t1583.001
  - attack.t1583.003
  - attack.t1583.006
  - attack.t1584.001
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Attack Infrastructure Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1583.001, T1583.003, T1583.006, T1584.001 |

## Verification

- [ ] Domains registered with appropriate categorization
- [ ] TLS certificates deployed and valid
- [ ] Redirectors routing traffic to C2 backend
- [ ] Non-matching traffic redirected to legitimate sites
- [ ] Teardown procedure verified — no residual resources

## References

- [Red Team Infrastructure Wiki](https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki) — Infrastructure patterns
- [Terraform](https://www.terraform.io/) — Infrastructure as code
