Red Team
- 712 installs
- 23.5k repo stars
- Updated July 17, 2026
- alirezarezvani/claude-skills
red-team is an agent skill that plans red-team engagements by modeling MITRE ATT&CK attack paths, effort scores, and choke points toward crown-jewel assets for developers and security engineers who need structured offens
About
red-team is a Claude agent skill from alirezarezvani/claude-skills for planning structured red-team engagements using MITRE ATT&CK attack-path methodology. Developers and security engineers build directed graphs where nodes are techniques or system states, edges encode prerequisites, and edge weights represent effort scores toward crown-jewel assets. The skill finds paths from initial access to high-value targets and ranks choke points by betweenness centrality for effort-vs-impact prioritization. Reach for red-team when scoping tabletop exercises, penetration-test plans, or pre-release adversary simulations that need explicit ATT&CK technique chains instead of ad hoc vulnerability lists.
- Attack path directed graph: techniques, states, and crown-jewel nodes
- Effort score formula: detection_risk × (prerequisite_count + 1)
- Choke-point analysis via betweenness on high-value technique nodes
- Node-type table: starting state, technique, tactic state, crown jewel
- Engagement framing from initial access level to defined success targets
Red Team by the numbers
- 712 all-time installs (skills.sh)
- Ranked #442 of 2,203 Security skills by installs in the Skillselion catalog
- Security screen: HIGH risk (skills.sh audit)
- Data as of Jul 31, 2026 (Skillselion catalog sync)
npx skills add https://github.com/alirezarezvani/claude-skills --skill red-teamAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 712 |
|---|---|
| repo stars | ★ 23.5k |
| Security audit | 2 / 3 scanners passed |
| Last updated | July 17, 2026 |
| Repository | alirezarezvani/claude-skills ↗ |
How do you model MITRE ATT&CK attack paths for red teams?
Plan red-team engagements by modeling MITRE ATT&CK attack paths, effort scores, and choke points toward crown-jewel assets.
Who is it for?
Security engineers scoping red-team exercises who need ATT&CK-based attack-path graphs with effort and choke-point analysis.
Skip if: Developers seeking automated vulnerability scanning or compliance checkbox audits without adversary path modeling.
When should I use this skill?
The user needs red-team engagement planning with MITRE ATT&CK attack paths, effort scoring, or choke-point identification toward crown jewels.
What you get
Attack-path graphs, effort-weighted technique chains, choke-point rankings, and prioritized red-team engagement plans.
- Attack-path graph model
- Choke-point priority list
- Red-team engagement plan
Files
Red Team
Red team engagement planning and attack path analysis skill for authorized offensive security simulations. This is NOT vulnerability scanning (see security-pen-testing) or incident response (see incident-response) — this is about structured adversary simulation to test detection, response, and control effectiveness.
---
Table of Contents
- Overview
- Engagement Planner Tool
- Kill-Chain Phase Methodology
- Technique Scoring and Prioritization
- Choke Point Analysis
- OPSEC Risk Assessment
- Crown Jewel Targeting
- Attack Path Methodology
- Workflows
- Anti-Patterns
- Cross-References
---
Overview
What This Skill Does
This skill provides the methodology and tooling for red team engagement planning — building structured attack plans from MITRE ATT&CK technique selection, access level, and crown jewel targets. It scores techniques by effort and detection risk, assembles kill-chain phases, identifies choke points, and flags OPSEC risks.
Distinction from Other Security Skills
| Skill | Focus | Approach |
|---|---|---|
| red-team (this) | Adversary simulation | Offensive — structured attack planning and execution |
| security-pen-testing | Vulnerability discovery | Offensive — systematic exploitation of specific weaknesses |
| threat-detection | Finding attacker activity | Proactive — detect TTPs in telemetry |
| incident-response | Active incident management | Reactive — contain and investigate confirmed incidents |
Authorization Requirement
All red team activities described here require written authorization. This includes a signed Rules of Engagement (RoE) document, defined scope, and explicit executive approval. The engagement_planner.py tool will not generate output without the --authorized flag. Unauthorized use of these techniques is illegal under the CFAA, Computer Misuse Act, and equivalent laws worldwide.
---
Engagement Planner Tool
The engagement_planner.py tool builds a scored, kill-chain-ordered attack plan from technique selection, access level, and crown jewel targets.
# Basic engagement plan — external access, specific techniques
python3 scripts/engagement_planner.py \
--techniques T1059,T1078,T1003 \
--access-level external \
--authorized --json
# Internal network access with crown jewel targeting
python3 scripts/engagement_planner.py \
--techniques T1059,T1078,T1021,T1550,T1003 \
--access-level internal \
--crown-jewels "Database,Active Directory,Payment Systems" \
--authorized --json
# Credentialed (assumed breach) scenario with scale
python3 scripts/engagement_planner.py \
--techniques T1059,T1078,T1021,T1550,T1003,T1486,T1048 \
--access-level credentialed \
--crown-jewels "Domain Controller,S3 Data Lake" \
--target-count 50 \
--authorized --json
# List all 29 supported MITRE ATT&CK techniques
python3 scripts/engagement_planner.py --list-techniquesAccess Level Definitions
| Level | Starting Position | Techniques Available |
|---|---|---|
| external | No internal access — internet only | External-facing techniques only (T1190, T1566, etc.) |
| internal | Network foothold — no credentials | Internal recon + lateral movement prep |
| credentialed | Valid credentials obtained | Full kill chain including priv-esc, lateral movement, impact |
Exit Codes
| Code | Meaning |
|---|---|
| 0 | Engagement plan generated successfully |
| 1 | Missing authorization or invalid technique |
| 2 | Scope violation — technique outside access-level constraints |
---
Kill-Chain Phase Methodology
The engagement planner organizes techniques into eight kill-chain phases and orders the execution plan accordingly.
Kill-Chain Phase Order
| Phase | Order | MITRE Tactic | Examples |
|---|---|---|---|
| Reconnaissance | 1 | TA0043 | T1595, T1596, T1598 |
| Resource Development | 2 | TA0042 | T1583, T1588 |
| Initial Access | 3 | TA0001 | T1190, T1566, T1078 |
| Execution | 4 | TA0002 | T1059, T1047, T1204 |
| Persistence | 5 | TA0003 | T1053, T1543, T1136 |
| Privilege Escalation | 6 | TA0004 | T1055, T1548, T1134 |
| Credential Access | 7 | TA0006 | T1003, T1110, T1558 |
| Lateral Movement | 8 | TA0008 | T1021, T1550, T1534 |
| Collection | 9 | TA0009 | T1074, T1560, T1114 |
| Exfiltration | 10 | TA0010 | T1048, T1041, T1567 |
| Impact | 11 | TA0040 | T1486, T1491, T1498 |
Phase Execution Principles
Each phase must be completed before advancing to the next unless the engagement scope specifies assumed breach (skip to a later phase). Do not skip persistence before attempting lateral movement — persistence ensures operational continuity if a single foothold is detected and removed.
---
Technique Scoring and Prioritization
Techniques are scored by effort (how hard to execute without detection) and prioritized in the engagement plan.
Effort Score Formula
effort_score = detection_risk × (len(prerequisites) + 1)Lower effort score = easier to execute without triggering detection.
Technique Scoring Reference
| Technique | Detection Risk | Prerequisites | Effort Score | MITRE ID |
|---|---|---|---|---|
| PowerShell execution | 0.7 | initial_access | 1.4 | T1059.001 |
| Scheduled task persistence | 0.5 | execution | 1.0 | T1053.005 |
| Pass-the-Hash | 0.6 | credential_access, internal_network | 1.8 | T1550.002 |
| LSASS credential dump | 0.8 | local_admin | 1.6 | T1003.001 |
| Spearphishing link | 0.4 | none | 0.4 | T1566.001 |
| Ransomware deployment | 0.9 | persistence, lateral_movement | 2.7 | T1486 |
---
Choke Point Analysis
Choke points are techniques required by multiple paths to crown jewel assets. Detecting a choke point technique detects all attack paths that pass through it.
Choke Point Identification
The engagement planner identifies choke points by finding techniques in credential_access and privilege_escalation tactics that serve as prerequisites for multiple subsequent techniques targeting crown jewels.
Prioritize detection rule development and monitoring density around choke point techniques — hardening a choke point has multiplied defensive value.
Common Choke Points by Environment
| Environment Type | Common Choke Points | Detection Priority |
|---|---|---|
| Active Directory domain | T1003 (credential dump), T1558 (Kerberoasting) | Highest |
| AWS environment | T1078.004 (cloud account), iam:PassRole chains | Highest |
| Hybrid cloud | T1550.002 (PtH), T1021.006 (WinRM) | High |
| Containerized apps | T1610 (deploy container), T1611 (container escape) | High |
Full methodology: references/attack-path-methodology.md
---
OPSEC Risk Assessment
OPSEC risk items identify actions that are likely to trigger detection or leave persistent artifacts.
OPSEC Risk Categories
| Tactic | Primary OPSEC Risk | Mitigation |
|---|---|---|
| Credential Access | LSASS memory access triggers EDR | Use LSASS-less techniques (DCSync, Kerberoasting) where possible |
| Execution | PowerShell command-line logging | Use AMSI bypass or alternative execution methods in scope |
| Lateral Movement | NTLM lateral movement generates event 4624 type 3 | Use Kerberos where possible; avoid NTLM over the network |
| Persistence | Scheduled tasks generate event 4698 | Use less-monitored persistence mechanisms within scope |
| Exfiltration | Large outbound transfers trigger DLP | Stage data and use slow exfil if stealth is required |
OPSEC Checklist Before Each Phase
1. Is the technique in scope per RoE? 2. Will it generate logs that blue team monitors actively? 3. Is there a less-detectable alternative that achieves the same objective? 4. If detected, will it reveal the full operation or only the current foothold? 5. Are cleanup artifacts defined for post-exercise removal?
---
Crown Jewel Targeting
Crown jewel assets are the high-value targets that define the success criteria of a red team engagement.
Crown Jewel Classification
| Crown Jewel Type | Target Indicators | Attack Paths |
|---|---|---|
| Domain Controller | AD DS, NTDS.dit, SYSVOL | Kerberoasting → DCSync → Golden Ticket |
| Database servers | Production SQL, NoSQL, data warehouse | Lateral movement → DBA account → data staging |
| Payment systems | PCI-scoped network, card data vault | Network pivot → service account → exfiltration |
| Source code repositories | Internal Git, build systems | VPN → internal git → code signing keys |
| Cloud management plane | AWS management console, IAM admin | Phishing → credential → AssumeRole chain |
Crown jewel definition is agreed upon in the RoE — engagement success is measured by whether red team reaches defined crown jewels, not by the number of vulnerabilities found.
---
Attack Path Methodology
Attack path analysis identifies all viable routes from the starting access level to each crown jewel.
Path Scoring
Each path is scored by:
- Total effort score (sum of per-technique effort scores)
- Choke point count (how many choke points the path passes through)
- Detection probability (product of per-technique detection risks)
Lower effort + fewer choke points = path of least resistance for the attacker.
Attack Path Graph Construction
external
└─ T1566.001 (spearphishing) → initial_access
└─ T1059.001 (PowerShell) → execution
└─ T1003.001 (LSASS dump) → credential_access [CHOKE POINT]
└─ T1550.002 (Pass-the-Hash) → lateral_movement
└─ T1078.002 (domain account) → privilege_escalation
└─ Crown Jewel: Domain ControllerFor the full scoring algorithm, choke point weighting, and effort-vs-impact matrix, see references/attack-path-methodology.md.
---
Workflows
Workflow 1: Quick Engagement Scoping (30 Minutes)
For scoping a focused red team exercise against a specific target:
# 1. Generate initial technique list from kill-chain coverage gaps
python3 scripts/engagement_planner.py --list-techniques
# 2. Build plan for external assumed-no-access scenario
python3 scripts/engagement_planner.py \
--techniques T1566,T1190,T1059,T1003,T1021 \
--access-level external \
--crown-jewels "Database Server" \
--authorized --json
# 3. Review choke_points and opsec_risks in output
# 4. Present kill-chain phases to stakeholders for scope approvalDecision: If choke_points are already covered by detection rules, focus on gaps. If not, those are the highest-value exercise targets.
Workflow 2: Full Red Team Engagement (Multi-Week)
Week 1 — Planning: 1. Define crown jewels and success criteria with stakeholders 2. Sign RoE with defined scope, timeline, and out-of-scope exclusions 3. Build engagement plan with engagement_planner.py 4. Review OPSEC risks for each phase
Week 2 — Execution (External Phase): 1. Reconnaissance and target profiling 2. Initial access attempts (phishing, exploit public-facing) 3. Document each technique executed with timestamps 4. Log all detection events to validate blue team coverage
Week 3 — Execution (Internal Phase): 1. Establish persistence if initial access obtained 2. Execute credential access techniques (choke points) 3. Lateral movement toward crown jewels 4. Document when and how crown jewels were reached
Week 4 — Reporting: 1. Compile findings — techniques executed, detection rates, crown jewels reached 2. Map findings to detection gaps 3. Produce remediation recommendations prioritized by choke point impact 4. Deliver read-out to security leadership
Workflow 3: Assumed Breach Tabletop
Simulate a compromised credential scenario for rapid detection testing:
# Assumed breach — credentialed access starting position
python3 scripts/engagement_planner.py \
--techniques T1059,T1078,T1021,T1550,T1003,T1048 \
--access-level credentialed \
--crown-jewels "Active Directory,S3 Data Bucket" \
--target-count 20 \
--authorized --json | jq '.phases, .choke_points, .opsec_risks'
# Run across multiple access levels to compare path options
for level in external internal credentialed; do
echo "=== ${level} ==="
python3 scripts/engagement_planner.py \
--techniques T1059,T1078,T1003,T1021 \
--access-level "${level}" \
--authorized --json | jq '.total_effort_score, .phases | keys'
done---
Anti-Patterns
1. Operating without written authorization — Unauthorized red team activity against any system you don't own or have explicit permission to test is a criminal offense. The --authorized flag must reflect a real signed RoE, not just running the tool to bypass the check. Authorization must predate execution. 2. Skipping kill-chain phase ordering — Jumping directly to lateral movement without establishing persistence means a single detection wipes out the entire foothold. Follow the kill-chain phase order — each phase builds the foundation for the next. 3. Not defining crown jewels before starting — Engagements without defined success criteria drift into open-ended vulnerability hunting. Crown jewels and success conditions must be agreed upon in the RoE before the first technique is executed. 4. Ignoring OPSEC risks in the plan — Red team exercises test blue team detection. Deliberately avoiding all detectable techniques produces an unrealistic engagement that doesn't validate detection coverage. Use OPSEC risks to understand detection exposure, not to avoid it entirely. 5. Failing to document executed techniques in real time — Retroactive documentation of what was executed is unreliable. Log each technique, timestamp, and outcome as it happens. Post-engagement reporting must be based on contemporaneous records. 6. Not cleaning up artifacts post-exercise — Persistence mechanisms, new accounts, modified configurations, and staged data must be removed after engagement completion. Leaving red team artifacts creates permanent security risks and can be confused with real attacker activity. 7. Treating path of least resistance as the only path — Attackers adapt. Test multiple attack paths including higher-effort routes that may evade detection. Validating that the easiest path is detected is necessary but not sufficient.
---
Cross-References
| Skill | Relationship |
|---|---|
| threat-detection | Red team technique execution generates realistic TTPs that validate threat hunting hypotheses |
| incident-response | Red team activity should trigger incident response procedures — detection and response quality is a primary success metric |
| cloud-security | Cloud posture findings (IAM misconfigs, S3 exposure) become red team attack path targets |
| security-pen-testing | Pen testing focuses on specific vulnerability exploitation; red team focuses on end-to-end kill-chain simulation to crown jewels |
Attack Path Methodology
Reference documentation for attack path graph construction, choke point scoring, and effort-vs-impact analysis used in red team engagement planning.
---
Attack Path Graph Model
An attack path is a directed graph where:
- Nodes are ATT&CK techniques or system states (initial access, crown jewel reached)
- Edges represent prerequisite relationships between techniques
- Weight on each edge is the effort score for the destination technique
The goal is to find all paths from the starting node (access level) to each crown jewel node, and to identify which nodes have the highest betweenness centrality (choke points).
Node Types
| Node Type | Description | Example |
|---|---|---|
| Starting state | Attacker's initial access level | external, internal, credentialed |
| Technique node | A MITRE ATT&CK technique | T1566.001, T1003.001, T1550.002 |
| Tactic state | Intermediate state achieved after completing a tactic | initial_access_achieved, persistence_established |
| Crown jewel node | Target asset — defines engagement success | Domain Controller, S3 Data Lake |
---
Effort Score Formula
Each technique is scored by how hard it is to execute in the environment without triggering detection:
effort_score = detection_risk × (prerequisite_count + 1)Where:
detection_riskis 0.0–1.0 (0 = trivial to execute, 1 = will be detected with high probability)prerequisite_countis the number of earlier techniques that must succeed before this one can be executed
A path's total effort score is the sum of effort scores for all techniques in the path.
Technique Effort Score Reference
| Technique | Detection Risk | Prerequisites | Effort Score | Tactic |
|---|---|---|---|---|
| T1566.001 Spearphishing Link | 0.40 | 0 | 0.40 | initial_access |
| T1190 Exploit Public-Facing Application | 0.55 | 0 | 0.55 | initial_access |
| T1078 Valid Accounts | 0.35 | 0 | 0.35 | initial_access |
| T1059.001 PowerShell | 0.70 | 1 | 1.40 | execution |
| T1047 WMI Execution | 0.60 | 1 | 1.20 | execution |
| T1053.005 Scheduled Task | 0.50 | 1 | 1.00 | persistence |
| T1543.003 Windows Service | 0.55 | 1 | 1.10 | persistence |
| T1003.001 LSASS Dump | 0.80 | 1 | 1.60 | credential_access |
| T1558.003 Kerberoasting | 0.65 | 1 | 1.30 | credential_access |
| T1110 Brute Force | 0.75 | 0 | 0.75 | credential_access |
| T1021.006 WinRM | 0.65 | 2 | 1.95 | lateral_movement |
| T1550.002 Pass-the-Hash | 0.60 | 2 | 1.80 | lateral_movement |
| T1078.002 Domain Account | 0.40 | 2 | 1.20 | lateral_movement |
| T1074.001 Local Data Staging | 0.45 | 3 | 1.80 | collection |
| T1048.003 Exfil via HTTP | 0.55 | 3 | 2.20 | exfiltration |
| T1486 Ransomware | 0.90 | 3 | 3.60 | impact |
---
Choke Point Identification
A choke point is a technique node that: 1. Lies on multiple paths to crown jewel assets, AND 2. Has no alternative technique that achieves the same prerequisite state
Choke Point Score
choke_point_score = (paths_through_node / total_paths_to_all_crown_jewels) × detection_riskTechniques with a high choke point score have high defensive leverage — a detection rule for that technique covers the most attack paths.
Common Choke Points by Environment
Active Directory Domain:
- T1003 (Credential Access) — required for Pass-the-Hash and most lateral movement
- T1558 (Kerberos Tickets) — Kerberoasting provides service account credentials for privilege escalation
AWS Cloud:
- iam:PassRole — required for most cloud privilege escalation paths
- T1078.004 (Valid Cloud Accounts) — credential compromise required for all cloud attack paths
Hybrid Environment:
- T1078.002 (Domain Accounts) — once domain credentials are obtained, both on-prem and cloud paths open
- T1021.001 (Remote Desktop Protocol) — primary lateral movement mechanism in Windows environments
---
Effort-vs-Impact Matrix
Plot each path on two dimensions to prioritize red team focus:
| Quadrant | Effort | Impact | Priority |
|---|---|---|---|
| High Priority | Low | High | Test first — easiest path to critical asset |
| Medium Priority | Low | Low | Test after high priority |
| Medium Priority | High | High | Test — complex but high-value if successful |
| Low Priority | High | Low | Test last — costly and low-value |
Effort is the path's total effort score (lower = easier). Impact is the crown jewel value (defined in RoE — Domain Controller = highest, individual workstation = lowest).
---
Access Level Constraints
Not all techniques are available from all starting positions. The engagement planner enforces access level hierarchy:
| Access Level | Available Techniques | Blocked Techniques |
|---|---|---|
| external | Techniques requiring only internet access: T1190, T1566, T1110, T1078 (via credential stuffing) | Any technique requiring internal_network or local_admin |
| internal | All external + internal recon, lateral movement prep | Techniques requiring local_admin or domain_admin |
| credentialed | All techniques — full kill-chain available | None (assumes valid credentials = highest starting position) |
Scope Violation Detection
The engagement planner flags scope violations when a technique requires a prerequisite that is not reachable from the specified access level. Example: T1550.002 Pass-the-Hash requires credential_access as a prerequisite. If the plan specifies access-level external, the technique will generate a scope violation because credential access is not reachable from external without first completing initial access and execution phases.
---
OPSEC Risk Registry
| Tactic | Risk Description | Detection Likelihood | Mitigation in Engagement |
|---|---|---|---|
| credential_access | LSASS memory access logged by EDR | High | Use DCSync or Kerberoasting instead of direct LSASS dump |
| execution | PowerShell ScriptBlock logging enabled in most orgs | High | Use alternate execution (compiled binaries, COM objects) |
| lateral_movement | NTLM Event 4624 type 3 correlates source/destination | Medium | Use Kerberos; avoid NTLM over the wire where possible |
| persistence | Scheduled task creation generates Event 4698 | Medium | Use less-monitored persistence (COM hijacking, DLL side-load) within scope |
| exfiltration | Large outbound transfers trigger DLP | Medium | Use slow exfil (<100KB/min); leverage allowed cloud storage |
| collection | Staging directory access triggers file integrity monitoring | Low-Medium | Stage in user-writable directories not covered by FIM |
#!/usr/bin/env python3
"""
engagement_planner.py — Red Team Engagement Planner
Builds a structured red team engagement plan from target scope, MITRE ATT&CK
technique selection, access level, and crown jewel assets. Scores techniques
by detection risk and effort, assembles kill-chain phases, identifies choke
points, and generates OPSEC risk items.
IMPORTANT: Authorization is required. Use --authorized flag only after obtaining
signed Rules of Engagement (RoE) and written executive authorization.
Usage:
python3 engagement_planner.py --techniques T1059,T1078,T1003 --access-level external --authorized --json
python3 engagement_planner.py --techniques T1059,T1078 --crown-jewels "DB,AD" --access-level credentialed --authorized --json
python3 engagement_planner.py --list-techniques
Exit codes:
0 Engagement plan generated successfully
1 Missing authorization or invalid input
2 Scope violation or technique outside access-level constraints
"""
import argparse
import json
import sys
MITRE_TECHNIQUES = {
"T1059": {"name": "Command and Scripting Interpreter", "tactic": "execution",
"detection_risk": 0.7, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1059.001": {"name": "PowerShell", "tactic": "execution",
"detection_risk": 0.8, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1078": {"name": "Valid Accounts", "tactic": "initial_access",
"detection_risk": 0.3, "prerequisites": [], "access_level": "external"},
"T1078.004": {"name": "Valid Accounts: Cloud Accounts", "tactic": "initial_access",
"detection_risk": 0.3, "prerequisites": [], "access_level": "external"},
"T1003": {"name": "OS Credential Dumping", "tactic": "credential_access",
"detection_risk": 0.9, "prerequisites": ["initial_access", "privilege_escalation"], "access_level": "internal"},
"T1003.001": {"name": "LSASS Memory", "tactic": "credential_access",
"detection_risk": 0.95, "prerequisites": ["initial_access", "privilege_escalation"], "access_level": "credentialed"},
"T1021": {"name": "Remote Services", "tactic": "lateral_movement",
"detection_risk": 0.6, "prerequisites": ["initial_access", "credential_access"], "access_level": "internal"},
"T1021.002": {"name": "SMB/Windows Admin Shares", "tactic": "lateral_movement",
"detection_risk": 0.7, "prerequisites": ["initial_access", "credential_access"], "access_level": "internal"},
"T1055": {"name": "Process Injection", "tactic": "defense_evasion",
"detection_risk": 0.85, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1190": {"name": "Exploit Public-Facing Application", "tactic": "initial_access",
"detection_risk": 0.5, "prerequisites": [], "access_level": "external"},
"T1566": {"name": "Phishing", "tactic": "initial_access",
"detection_risk": 0.4, "prerequisites": [], "access_level": "external"},
"T1566.001": {"name": "Spearphishing Attachment", "tactic": "initial_access",
"detection_risk": 0.5, "prerequisites": [], "access_level": "external"},
"T1098": {"name": "Account Manipulation", "tactic": "persistence",
"detection_risk": 0.6, "prerequisites": ["initial_access", "privilege_escalation"], "access_level": "credentialed"},
"T1136": {"name": "Create Account", "tactic": "persistence",
"detection_risk": 0.7, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1053": {"name": "Scheduled Task/Job", "tactic": "persistence",
"detection_risk": 0.6, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1486": {"name": "Data Encrypted for Impact", "tactic": "impact",
"detection_risk": 0.99, "prerequisites": ["initial_access", "lateral_movement"], "access_level": "credentialed"},
"T1530": {"name": "Data from Cloud Storage", "tactic": "collection",
"detection_risk": 0.4, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1041": {"name": "Exfiltration Over C2 Channel", "tactic": "exfiltration",
"detection_risk": 0.65, "prerequisites": ["initial_access", "collection"], "access_level": "internal"},
"T1048": {"name": "Exfiltration Over Alternative Protocol", "tactic": "exfiltration",
"detection_risk": 0.5, "prerequisites": ["initial_access", "collection"], "access_level": "internal"},
"T1083": {"name": "File and Directory Discovery", "tactic": "discovery",
"detection_risk": 0.3, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1082": {"name": "System Information Discovery", "tactic": "discovery",
"detection_risk": 0.2, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1057": {"name": "Process Discovery", "tactic": "discovery",
"detection_risk": 0.25, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1068": {"name": "Exploitation for Privilege Escalation", "tactic": "privilege_escalation",
"detection_risk": 0.8, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1484": {"name": "Domain Policy Modification", "tactic": "privilege_escalation",
"detection_risk": 0.85, "prerequisites": ["initial_access", "privilege_escalation"], "access_level": "credentialed"},
"T1562": {"name": "Impair Defenses", "tactic": "defense_evasion",
"detection_risk": 0.9, "prerequisites": ["initial_access", "privilege_escalation"], "access_level": "credentialed"},
"T1070": {"name": "Indicator Removal", "tactic": "defense_evasion",
"detection_risk": 0.75, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1195": {"name": "Supply Chain Compromise", "tactic": "initial_access",
"detection_risk": 0.2, "prerequisites": [], "access_level": "external"},
"T1218": {"name": "System Binary Proxy Execution", "tactic": "defense_evasion",
"detection_risk": 0.6, "prerequisites": ["initial_access"], "access_level": "internal"},
"T1105": {"name": "Ingress Tool Transfer", "tactic": "command_and_control",
"detection_risk": 0.55, "prerequisites": ["initial_access"], "access_level": "internal"},
}
ACCESS_LEVEL_HIERARCHY = {"external": 0, "internal": 1, "credentialed": 2}
OPSEC_RISKS = [
{"risk": "C2 beacon interval too frequent", "severity": "high",
"mitigation": "Use jitter (25-50%) on beacon intervals; minimum 30s base interval for stealth",
"relevant_tactics": ["command_and_control"]},
{"risk": "Infrastructure reuse across engagements", "severity": "critical",
"mitigation": "Provision fresh C2 infrastructure per engagement; never reuse domains or IPs",
"relevant_tactics": ["command_and_control", "initial_access"]},
{"risk": "Scanning during business hours from non-business IP", "severity": "medium",
"mitigation": "Schedule active scanning to match target business hours and geographic timezone",
"relevant_tactics": ["discovery"]},
{"risk": "Known tool signatures in memory or on disk", "severity": "high",
"mitigation": "Use custom-compiled tools or obfuscated variants; avoid default Cobalt Strike profiles",
"relevant_tactics": ["execution", "lateral_movement"]},
{"risk": "Credential dumping without EDR bypass", "severity": "critical",
"mitigation": "Assess EDR coverage before credential dumping; use protected-mode aware approaches",
"relevant_tactics": ["credential_access"]},
{"risk": "Large data transfer without staging", "severity": "high",
"mitigation": "Stage data locally, compress and encrypt before exfil; avoid single large transfers",
"relevant_tactics": ["exfiltration", "collection"]},
{"risk": "Operating outside authorized time window", "severity": "critical",
"mitigation": "Confirm maintenance and testing windows with client before operational phases",
"relevant_tactics": []},
{"risk": "Leaving artifacts in temp directories", "severity": "medium",
"mitigation": "Clean up all dropped files and created accounts before disengaging",
"relevant_tactics": ["execution", "persistence"]},
]
KILL_CHAIN_PHASE_ORDER = [
"initial_access", "execution", "persistence", "privilege_escalation",
"defense_evasion", "credential_access", "discovery", "lateral_movement",
"collection", "command_and_control", "exfiltration", "impact"
]
def list_techniques():
"""Print a formatted table of all MITRE techniques and exit."""
print(f"{'ID':<12} {'Name':<45} {'Tactic':<25} {'Det.Risk':<10} {'Access'}")
print("-" * 110)
for tid, data in sorted(MITRE_TECHNIQUES.items()):
print(
f"{tid:<12} {data['name']:<45} {data['tactic']:<25} "
f"{data['detection_risk']:<10.2f} {data['access_level']}"
)
sys.exit(0)
def build_engagement_plan(techniques_input, access_level, crown_jewels, target_count):
"""
Core planning algorithm. Returns (plan_dict, scope_violations_count).
"""
provided_level = ACCESS_LEVEL_HIERARCHY[access_level]
valid_techniques = []
scope_violations = []
not_found = []
for tid in techniques_input:
tid = tid.strip().upper()
if tid not in MITRE_TECHNIQUES:
not_found.append(tid)
continue
tech = MITRE_TECHNIQUES[tid]
required_level = ACCESS_LEVEL_HIERARCHY[tech["access_level"]]
if required_level > provided_level:
scope_violations.append({
"technique_id": tid,
"technique_name": tech["name"],
"reason": (
f"Requires '{tech['access_level']}' access; "
f"provided access level is '{access_level}'"
),
})
continue
effort_score = round(tech["detection_risk"] * (len(tech["prerequisites"]) + 1), 4)
valid_techniques.append({
"id": tid,
"name": tech["name"],
"tactic": tech["tactic"],
"detection_risk": tech["detection_risk"],
"prerequisites": tech["prerequisites"],
"effort_score": effort_score,
})
# Group by tactic and order phases by kill chain
tactic_map = {}
for t in valid_techniques:
tactic_map.setdefault(t["tactic"], []).append(t)
phases = []
tactics_present = set(tactic_map.keys())
for phase_name in KILL_CHAIN_PHASE_ORDER:
if phase_name in tactic_map:
techniques_in_phase = sorted(
tactic_map[phase_name], key=lambda x: x["effort_score"], reverse=True
)
phases.append({
"phase": phase_name,
"techniques": techniques_in_phase,
})
# Identify choke points
# A choke point is a credential_access or privilege_escalation technique
# that other selected techniques list as a prerequisite dependency,
# especially relevant when crown jewels are specified.
choke_tactic_set = {"credential_access", "privilege_escalation"}
choke_points = []
for t in valid_techniques:
if t["tactic"] not in choke_tactic_set:
continue
# Count how many other techniques depend on this tactic
dependents = [
other["id"]
for other in valid_techniques
if t["tactic"] in other["prerequisites"] and other["id"] != t["id"]
]
# If crown jewels are specified, flag anything in those choke tactics
crown_jewel_relevant = bool(crown_jewels)
if dependents or crown_jewel_relevant:
choke_points.append({
"technique_id": t["id"],
"technique_name": t["name"],
"tactic": t["tactic"],
"dependent_technique_count": len(dependents),
"dependent_techniques": dependents,
"crown_jewel_relevant": crown_jewel_relevant,
"note": (
"Blocking this technique disrupts the downstream kill-chain. "
"Priority hardening target."
),
})
# Collect OPSEC risks for tactics present in the selected techniques
seen_risks = set()
applicable_opsec = []
for risk_item in OPSEC_RISKS:
relevant = risk_item["relevant_tactics"]
# Include universal risks (empty relevant_tactics list) always
if not relevant or tactics_present.intersection(relevant):
key = risk_item["risk"]
if key not in seen_risks:
seen_risks.add(key)
applicable_opsec.append(risk_item)
# Estimate duration: sum detection_risk * 2 days per phase, minimum 3 days
raw_duration = sum(
tech["detection_risk"] * 2
for t in valid_techniques
for tech in [t] # flatten
)
# Per-phase minimum: ensure at least 0.5 day per phase
phase_count = len(phases)
estimated_days = max(3.0, round(raw_duration + phase_count * 0.5, 1))
# Scale by target_count (each additional target adds 20% duration)
if target_count and target_count > 1:
estimated_days = round(estimated_days * (1 + (target_count - 1) * 0.2), 1)
# Required authorizations list
required_authorizations = [
"Signed Rules of Engagement (RoE) document",
"Written executive/CISO authorization",
"Defined scope and out-of-scope assets list",
"Emergency stop contact and escalation path",
"Deconfliction process with SOC/Blue Team",
]
if "impact" in tactics_present:
required_authorizations.append(
"Specific written authorization for destructive/impact techniques (T14xx)"
)
if "credential_access" in tactics_present:
required_authorizations.append(
"Written authorization for credential capture and handling procedures"
)
plan = {
"engagement_summary": {
"access_level": access_level,
"crown_jewels": crown_jewels,
"target_count": target_count or 1,
"techniques_requested": len(techniques_input),
"techniques_valid": len(valid_techniques),
"techniques_not_found": not_found,
"estimated_duration_days": estimated_days,
},
"phases": phases,
"choke_points": choke_points,
"opsec_risks": applicable_opsec,
"scope_violations": scope_violations,
"required_authorizations": required_authorizations,
}
return plan, len(scope_violations)
def main():
parser = argparse.ArgumentParser(
description="Red Team Engagement Planner — Builds structured engagement plans from MITRE ATT&CK techniques.",
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog=(
"Examples:\n"
" python3 engagement_planner.py --techniques T1059,T1078,T1003 --access-level external --authorized --json\n"
" python3 engagement_planner.py --techniques T1059,T1078 --crown-jewels 'DB,AD' --access-level credentialed --authorized --json\n"
" python3 engagement_planner.py --list-techniques\n"
"\nExit codes:\n"
" 0 Engagement plan generated successfully\n"
" 1 Missing authorization or invalid input\n"
" 2 Scope violation or technique outside access-level constraints"
),
)
parser.add_argument(
"--techniques",
type=str,
default="",
help="Comma-separated MITRE ATT&CK technique IDs (e.g. T1059,T1078,T1003)",
)
parser.add_argument(
"--access-level",
choices=["external", "internal", "credentialed"],
default="external",
help="Attacker access level for this engagement (default: external)",
)
parser.add_argument(
"--crown-jewels",
type=str,
default="",
help="Comma-separated crown jewel asset labels (e.g. 'DB,AD,PaymentSystem')",
)
parser.add_argument(
"--target-count",
type=int,
default=1,
help="Number of target systems/segments (affects duration estimate, default: 1)",
)
parser.add_argument(
"--authorized",
action="store_true",
help="Confirms signed RoE and executive authorization have been obtained",
)
parser.add_argument(
"--json",
action="store_true",
dest="output_json",
help="Output results as JSON",
)
parser.add_argument(
"--list-techniques",
action="store_true",
help="Print all available MITRE techniques and exit",
)
args = parser.parse_args()
if args.list_techniques:
list_techniques() # exits internally
# Authorization gate
if not args.authorized:
msg = (
"Authorization required: obtain signed RoE before planning. "
"Use --authorized flag only after legal sign-off."
)
if args.output_json:
print(json.dumps({"error": msg, "exit_code": 1}, indent=2))
else:
print(f"ERROR: {msg}", file=sys.stderr)
sys.exit(1)
if not args.techniques.strip():
msg = "No techniques specified. Use --techniques T1059,T1078,... or --list-techniques."
if args.output_json:
print(json.dumps({"error": msg, "exit_code": 1}, indent=2))
else:
print(f"ERROR: {msg}", file=sys.stderr)
sys.exit(1)
techniques_input = [t.strip() for t in args.techniques.split(",") if t.strip()]
crown_jewels = [c.strip() for c in args.crown_jewels.split(",") if c.strip()]
plan, violation_count = build_engagement_plan(
techniques_input=techniques_input,
access_level=args.access_level,
crown_jewels=crown_jewels,
target_count=args.target_count,
)
if args.output_json:
print(json.dumps(plan, indent=2))
else:
summary = plan["engagement_summary"]
print("\n=== RED TEAM ENGAGEMENT PLAN ===")
print(f"Access Level : {summary['access_level']}")
print(f"Crown Jewels : {', '.join(crown_jewels) if crown_jewels else 'Not specified'}")
print(f"Techniques : {summary['techniques_valid']}/{summary['techniques_requested']} valid")
print(f"Est. Duration : {summary['estimated_duration_days']} days")
if summary["techniques_not_found"]:
print(f"Not Found : {', '.join(summary['techniques_not_found'])}")
print("\n--- Kill-Chain Phases ---")
for phase in plan["phases"]:
print(f"\n [{phase['phase'].upper()}]")
for t in phase["techniques"]:
print(f" {t['id']:<12} {t['name']:<45} risk={t['detection_risk']:.2f} effort={t['effort_score']:.3f}")
print("\n--- Choke Points ---")
if plan["choke_points"]:
for cp in plan["choke_points"]:
print(f" {cp['technique_id']} {cp['technique_name']} — {cp['note']}")
else:
print(" None identified.")
print("\n--- OPSEC Risks ---")
for risk in plan["opsec_risks"]:
print(f" [{risk['severity'].upper()}] {risk['risk']}")
print(f" Mitigation: {risk['mitigation']}")
if plan["scope_violations"]:
print("\n--- SCOPE VIOLATIONS ---")
for sv in plan["scope_violations"]:
print(f" {sv['technique_id']}: {sv['reason']}")
print("\n--- Required Authorizations ---")
for auth in plan["required_authorizations"]:
print(f" - {auth}")
print()
if violation_count > 0:
sys.exit(2)
sys.exit(0)
if __name__ == "__main__":
main()
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets476k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.475k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.78.9k204
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.77.7k388
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.64.9k85How it compares
Use red-team for ATT&CK attack-path planning and choke-point prioritization; use vulnerability scanners for automated CVE discovery.
FAQ
How does red-team model attack paths?
red-team models attack paths as directed graphs where nodes are MITRE ATT&CK techniques or system states and weighted edges represent prerequisite relationships and effort scores from initial access to crown-jewel targets.
What are choke points in red-team planning?
Choke points are graph nodes with high betweenness centrality where many attack paths converge. red-team ranks these nodes so defenders prioritize controls that disrupt the most effort-efficient routes to crown-jewel assets.
Is Red Team safe to install?
skills.sh reports 2 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.