Red Team Specialist

Red Team Specialist

When to Use

• Plan or lead authorized enterprise adversary simulation (assumed breach, full-scope red team, purple team)
• Define threat-informed objectives aligned to business risk and threat intelligence
• Select and sequence TTPs using MITRE ATT&CK framing (technique IDs, detection expectations)
• Draft rules of engagement, scope, OPSEC constraints, and emergency stop procedures
• Coordinate purple team exercises and detection validation with blue team / SOC
• Produce executive narratives, attack-path stories, and remediation handoff for defenders
• Capture lessons learned for detection engineering, tabletop, and control improvement

When NOT to Use

• Jailbreak LLMs, prompt injection, RAG/tool abuse, or AI safety harnesses → ai-redteam
• Execute hands-on web/API OWASP testing as primary deliverable → web-pentester
• Execute network/AD/infra pentest as primary deliverable → network-pentester
• Run a standard pentest engagement (recon → vuln → PoC → report) without campaign emulation → penetration-tester
• Triage SIEM/EDR alerts or SOC shift work → soc-analyst
• Proactive blue-team hunt campaigns (non-simulation) → threat-hunter
• Declare incidents, lead containment, or regulatory comms → incident-responder
• Define enterprise security strategy or GRC roadmaps → cybersecurity
• Implement SIEM rules, IAM, or guardrails from findings → information-security-engineer

Related skills

Core Workflows

1. Scope, authorization, and OPSEC

Do not operate without written authorization and defined scope.

1. Confirm signed SOW/ROE: assets, methods, windows, contacts, legal constraints 2. Define objectives (crown jewels, scenarios, kill-chain depth) and success criteria 3. Agree out-of-scope (third parties, prod PII, physical access, ransomware simulation unless approved) 4. Establish OPSEC: infrastructure, attribution, comms, artifact handling 5. Document emergency stop, escalation, and purple-team visibility rules

See `references/red_team_scope.md` and `references/scoping_roe_and_opsec.md`.

2. Campaign planning and objectives

1. Map threat actors or threat intelligence to relevant TTPs 2. Build campaign timeline (phases, injects, decision points) 3. Align objectives to detection validation or business narrative needs 4. Reserve execution slots for specialist testers where needed

See `references/campaign_planning_and_objectives.md`.

3. TTP selection and execution coordination

objectives → ATT&CK mapping → playbooks → specialist execution → evidence + timeline

• Delegate in-scope technical work to penetration-tester, web-pentester, or network-pentester as appropriate
• Maintain operator log: UTC timestamps, technique ID, host/account, outcome, detection observed (Y/N/unknown)
• Stop at agreed impact; remove persistence and test artifacts per ROE

See `references/ttp_selection_and_execution_coordination.md`.

4. Purple team and detection validation

1. Pre-brief blue team on expected telemetry and safe observation windows 2. Run inject schedule with optional blind vs collaborative modes 3. Document detection gaps (missed stage, delayed alert, wrong severity) 4. Hand off detection engineering recommendations to information-security-engineer / SOC

See `references/purple_team_and_detection_validation.md`.

5. Reporting and remediation handoff

Deliver: executive summary (risk story), technical timeline, ATT&CK heatmap, detection matrix, prioritized remediations, and blue-team actions. Schedule retest or purple re-run for critical gaps.

See `references/reporting_and_remediation_handoff.md`.

When to load references

Campaign Planning and Objectives

Planning flow

threat context → objectives → scenarios → phases → resources → metrics

Threat context

1. Identify relevant threat actors (industry, geography, capability) 2. Pull recent threat intelligence (reports, ISAC, internal incidents) 3. Select ATT&CK tactics that match actor behavior for this organization 4. Note defender maturity (SIEM, EDR, MFA, segmentation) from discovery or prior assessments

Objectives (SMART + measurable)

Write objectives so success/failure is auditable from logs and operator notes.

Scenario design

Build 1–3 scenarios per campaign; avoid scope creep.

Campaign phases (template)

Resource coordination

Red team lead owns timeline, OPSEC, and narrative—not every technical step.

Metrics

Track during campaign:

• Techniques executed (ATT&CK ID)
• Time per stage (dwell, lateral, objective)
• Detections: none / alert / human / blocked
• Mean time to detect (if purple windows defined)
• Open findings by severity

Risk register

Purple Team and Detection Validation

Modes

Document mode in ROE and kickoff slides.

Pre-exercise brief (purple)

Share with blue team / SOC (as agreed):

• UTC windows for injects
• High-level tactic list (not always exact timing)
• Deconfliction tokens (accounts, domains, file hashes)
• Escalation channel for false positives vs real chain
• No surprise destructive actions

Detection validation matrix

Score each executed technique:

• Detected — alert or analyst within SLA
• Missed — no timely detection
• Blocked — control prevented technique (note if objective still met another way)
• Unknown — insufficient logging

Working with SOC

• Do not ask soc-analyst to run the campaign; they consume telemetry
• Provide after-action IOC list and timeline for alert tuning
• Escalate to incident-responder only if a real incident occurs outside ROE

Detection engineering handoff

For each gap, specify:

Route implementation to information-security-engineer when building pipelines or content.

Hotwash (within 48h)

1. Timeline walkthrough (red + blue) 2. Top 3 detection wins and top 3 gaps 3. Process issues (escalation, comms, tooling) 4. Agreed actions with owners and dates 5. Optional: re-run selected TTPs after fixes

Metrics for leadership

• % techniques detected within SLA
• Critical path stages missed
• Time to contain (if exercise includes response)
• Trend vs prior purple exercises

Red Team Scope

Purpose

Define what enterprise adversary simulation covers in this skill versus adjacent roles.

In scope

Out of scope (route elsewhere)

Engagement types

Success criteria (examples)

• Demonstrate path to objective (e.g., domain admin, sensitive data access) within ROE
• Document detection coverage per ATT&CK stage
• Deliver prioritized remediations with owners
• No unauthorized targeting, no out-of-scope systems touched

Deliverables

• Signed ROE and scope appendix
• Campaign plan and operator log
• ATT&CK technique matrix (executed vs detected)
• Executive summary + technical appendix
• Purple-team / blue-team readout and tracked actions

Reporting and Remediation Handoff

Report structure

Executive summary (1–2 pages)

• Engagement type, dates, authorization reference
• Risk narrative: what an adversary could achieve in scope
• Top 3 business-relevant findings (plain language)
• Detection program strengths and gaps (summary)
• Recommended strategic investments (people, process, technology)

Technical appendix

• Scope and ROE summary
• Campaign timeline (UTC)
• ATT&CK heatmap: executed vs detected
• Attack paths (diagram or ordered steps)
• Operator log excerpts (redacted)
• Evidence index (hashes, queries, screenshots)

Purple-team / blue-team section

• Detection validation matrix
• SOC process observations (escalation, tuning, noise)
• Tabletop or comms gaps if applicable

Finding format

Remediation handoff

Do not assign legal or regulatory conclusions—flag for legal/compliance review.

Cleanup attestation

Before final report sign-off:

• [ ] Persistence removed
• [ ] Test accounts disabled or deleted
• [ ] C2 infra torn down per schedule
• [ ] Artifacts removed from endpoints (or list exceptions)
• [ ] Blue team confirms no outstanding red-team access

Retest and continuous improvement

1. Schedule retest for critical detection gaps (30–90 days typical) 2. Track remediation tickets to closure 3. Archive operator logs per evidence retention in ROE 4. Feed lessons into next campaign plan and threat model update

What not to include

• Exploit code or weaponized payloads beyond what client needs
• Unredacted credentials or live session tokens
• Out-of-scope system data
• Attribution of real threat actors as fact (use "informed by" language)

Scoping, Rules of Engagement, and OPSEC

Authorization (mandatory)

1. Obtain written authorization (SOW, letter, or signed ROE) before any activity 2. Record approver name, date, validity window, and scope identifiers 3. Confirm emergency stop contact and procedure with client/security operations 4. If scope is unclear, stop and clarify—do not probe adjacent assets

ROE checklist

OPSEC principles

• Minimize attribution to red team infrastructure when stealth is required
• Use dedicated redirectors, domains, and hosting per ROE—not personal assets
• Segregate operator accounts, keys, and logs from production admin paths
• Avoid storing client secrets on unsecured endpoints; use encrypted vaults
• Coordinate blocklist / allowlist with blue team to prevent accidental IR escalation
• Plan deconfliction identifiers (canary accounts, DNS names, file markers)

Communication

Document cadence: kickoff, mid-campaign check-in, hotwash, final readout.

Emergency stop

On stop signal (client or lead):

1. Cease all active operations immediately 2. Notify operators and blue team per ROE 3. Preserve logs per evidence policy; do not delete without approval 4. Document stop reason and residual access for cleanup

Safe testing defaults

• Prefer non-production or designated test tenants when available
• Use synthetic data for exfil demonstrations
• Remove persistence, scheduled tasks, and test accounts before closeout
• Validate cleanup with blue team or asset owner

TTP Selection and Execution Coordination

ATT&CK-driven selection

1. Start from campaign objectives and threat actor profile 2. Map required outcomes to tactics (e.g., Initial Access → Execution → Persistence → Lateral Movement → Collection → Exfiltration) 3. Pick techniques with technique IDs (e.g., T1566.001, T1021.001) 4. For each technique, define:

• Preconditions (access level, network position)
• Expected telemetry (process, auth, network, cloud audit)
• Detection hypothesis (rule name, data source, expected alert)
• Abort criteria if impact exceeds ROE

Prioritization

Avoid "checklist dumping"—sequence TTPs into a coherent story.

Operator log (required fields)

Coordinating execution specialists

Red team lead provides: objective, technique ID, OPSEC constraints, stop conditions, and log format. Specialist returns: repro steps, evidence, cleanup list.

In-scope execution rules

• Use minimal steps to prove the path; avoid gratuitous exploitation
• Prefer documented playbooks over ad-hoc tooling for repeatability
• Do not chain into out-of-scope systems—even if reachable
• Record every privilege change and persistence mechanism for cleanup

C2 and infrastructure (if allowed)

• Register domains/IPs in ROE appendix
• Use TLS profiles and redirectors per OPSEC plan
• Plan teardown dates for infra and certificates
• Never reuse production admin channels for C2

Post-execution

1. Confirm detection outcome with blue team (purple mode) 2. Update ATT&CK coverage matrix 3. Queue remediation or detection tickets with severity 4. Schedule retest for failed detections on critical techniques