---
name: rt-rules-of-engagement
description: "Define and document Rules of Engagement (RoE) for the Red Team engagement. Covers testing permissions, prohibited actions, escalation procedures, emergency stop criteria, data handling, and evidence retention. Creates rules-of-engagement.md."
---

# rt-rules-of-engagement

# Rules of Engagement Workflow

## Step 1 — Testing Permissions Matrix
For each activity, confirm with client: Permitted / Not permitted / With conditions

**Automated Testing:**
- Vulnerability scanners (Nessus, Nuclei, OpenVAS)
- Web application scanners (Burp Suite, OWASP ZAP)
- Port scanners (Nmap, Masscan)
- Password spraying tools

**Manual Exploitation:**
- Web vulnerability exploitation
- Network exploitation
- Credential stuffing/brute force
- Privilege escalation attempts

**Advanced Techniques:**
- Social engineering (phishing, vishing)
- Physical security testing
- DoS/DDoS simulation (with prior notice)
- Persistent backdoors (document + remove)
- Data exfiltration PoC (minimum sample)

## Step 2 — Prohibited Actions (Always)
List activities NEVER permitted regardless of scope:
- Destroying or corrupting production data
- Taking production systems offline
- Accessing out-of-scope systems
- Sharing client data with third parties
- Storing credentials beyond engagement period

## Step 3 — Emergency Stop Criteria
Define conditions that require IMMEDIATE testing halt:
- Discovery of ongoing real-world attack
- Inadvertent access to systems outside scope
- Production system becomes unavailable
- Client requests immediate stop
- Discovery of criminal activity evidence

Emergency stop procedure:
1. Stop all testing immediately
2. Notify CISO/security contact
3. Preserve evidence of current state
4. Wait for written authorization to resume

## Step 4 — Escalation Procedures
When to escalate to CISO:
- Critical RCE found on production system
- Active data breach indicators found
- Credentials for extremely sensitive systems discovered
- Scope creep detected

## Step 5 — Save RoE Document
Create: `_rtexit-output/docs/engagement/rules-of-engagement.md`
