agentleFS
Sign inStart free
xenitV1xenitV1/Antigravity-Workflows/skills/red-team-tactics/SKILL.md

red-team-tactics

Skill130 starsChanged 10 months agoMITView on GitHub

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

We split this skill into the rules it gives an agent

1 rule. 1 is common, 0 are distinctive, and 0 are very specific to this project.

  • 1

    Common

    Most of the 4 edited versions we read keep these.

  • 0

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Common:

    Document the full attack chain:

    line 155

“Common” is measured: kept by at least 6 in 10 of the 4 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Red Team Tactics

Adversary simulation principles based on MITRE ATT&CK framework.

1. MITRE ATT&CK Phases

Attack Lifecycle

RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
       ↓              ↓              ↓            ↓
   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
       ↓              ↓              ↓            ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT

Phase Objectives

PhaseObjective
ReconMap attack surface
Initial AccessGet first foothold
ExecutionRun code on target
PersistenceSurvive reboots
Privilege EscalationGet admin/root
Defense EvasionAvoid detection
Credential AccessHarvest credentials
DiscoveryMap internal network
Lateral MovementSpread to other systems
CollectionGather target data
C2Maintain command channel
ExfiltrationExtract data

2. Reconnaissance Principles

Passive vs Active

TypeTrade-off
PassiveNo target contact, limited info
ActiveDirect contact, more detection risk

Information Targets

CategoryValue
Technology stackAttack vector selection
Employee infoSocial engineering
Network rangesScanning scope
Third partiesSupply chain attack

3. Initial Access Vectors

Selection Criteria

VectorWhen to Use
PhishingHuman target, email access
Public exploitsVulnerable services exposed
Valid credentialsLeaked or cracked
Supply chainThird-party access

4. Privilege Escalation Principles

Windows Targets

CheckOpportunity
Unquoted service pathsWrite to path
Weak service permissionsModify service
Token privilegesAbuse SeDebug, etc.
Stored credentialsHarvest

Linux Targets

CheckOpportunity
SUID binariesExecute as owner
Sudo misconfigurationCommand execution
Kernel vulnerabilitiesKernel exploits
Cron jobsWritable scripts

5. Defense Evasion Principles

Key Techniques

TechniquePurpose
LOLBinsUse legitimate tools
ObfuscationHide malicious code
TimestompingHide file modifications
Log clearingRemove evidence

Operational Security

  • Work during business hours
  • Mimic legitimate traffic patterns
  • Use encrypted channels
  • Blend with normal behavior

6. Lateral Movement Principles

Credential Types

TypeUse
PasswordStandard auth
HashPass-the-hash
TicketPass-the-ticket
CertificateCertificate auth

Movement Paths

  • Admin shares
  • Remote services (RDP, SSH, WinRM)
  • Exploitation of internal services

7. Active Directory Attacks

Attack Categories

AttackTarget
KerberoastingService account passwords
AS-REP RoastingAccounts without pre-auth
DCSyncDomain credentials
Golden TicketPersistent domain access

8. Reporting Principles

Attack Narrative

Document the full attack chain:

  1. How initial access was gained
  2. What techniques were used
  3. What objectives were achieved
  4. Where detection failed

Detection Gaps

For each successful technique:

  • What should have detected it?
  • Why didn't detection work?
  • How to improve detection

9. Ethical Boundaries

Always

  • Stay within scope
  • Minimize impact
  • Report immediately if real threat found
  • Document all actions

Never

  • Destroy production data
  • Cause denial of service (unless scoped)
  • Access beyond proof of concept
  • Retain sensitive data

10. Anti-Patterns

❌ Don't✅ Do
Rush to exploitationFollow methodology
Cause damageMinimize impact
Skip reportingDocument everything
Ignore scopeStay within boundaries

Remember: Red team simulates attackers to improve defenses, not to cause harm.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free