Redteam Fundamentals

Red team engagement

A red team engagement shall test the blue team capabilities. The engagement does not only look for vulnerabilities like Pentesting, but simulates an actual attack.

• Try to hide, keep low profile
• Do lateral movements
• Real hack into machines
• Blue team is not informed about it
• Usage of social engineering and even physical penetration tactics
• Red team might emulate an existing APT group like APT38 by using the TTPs (Technics, Tactics and Procedures) of this particular group.

The Rules of Engagement (RoE) is the legally binding agreement about scope, expectations goal and limits of an engagement.

Cyber kill chain (Lockheed Martin)

Technique	Purpose	Examples
Reconnaissance	Obtain information on the target	Harvesting emails, OSINT
Weaponization	Combine the objective with an exploit. Commonly results in a deliverable payload.	Exploit with backdoor, malicious office document
Delivery	How will the weaponized function be delivered to the target	Email, web, USB
Exploitation	Exploit the target’s system to execute code	MS17-010, Zero-Logon, etc.
Installation	Install malware or other tooling	Mimikatz, Rubeus, etc.
Command & Control	Control the compromised asset from a remote central controller	Empire, Cobalt Strike, etc.
Actions on Objectives	Any end objectives: ransomware, data exfiltration, etc.	Conti, LockBit2.0, etc.