{"slug":"red-team-tactics","title":"red-team-tactics","summary":"Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.","platform":"Claude","tags":[],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-10-05T21:53:21.995569Z","repo":{"url":"https://github.com/VoDaiLocz/kilo-kit-mcp","stars":27,"forks":3,"license":"Apache-2.0","updatedAt":"2026-09-13T09:11:19Z"},"bodyHtml":"
\n

name: red-team-tactics\ndescription: Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.\nallowed-tools: Read, Glob, Grep

\n

Red Team Tactics

\n
\n

Adversary simulation principles based on MITRE ATT&CK framework.

\n
\n
\n

1. MITRE ATT&CK Phases

\n

Attack Lifecycle

\n
RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE\n       ↓              ↓              ↓            ↓\n   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY\n       ↓              ↓              ↓            ↓\nLATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT\n
\n

Phase Objectives

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PhaseObjective
ReconMap attack surface
Initial AccessGet first foothold
ExecutionRun code on target
PersistenceSurvive reboots
Privilege EscalationGet admin/root
Defense EvasionAvoid detection
Credential AccessHarvest credentials
DiscoveryMap internal network
Lateral MovementSpread to other systems
CollectionGather target data
C2Maintain command channel
ExfiltrationExtract data
\n
\n

2. Reconnaissance Principles

\n

Passive vs Active

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
TypeTrade-off
PassiveNo target contact, limited info
ActiveDirect contact, more detection risk
\n

Information Targets

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CategoryValue
Technology stackAttack vector selection
Employee infoSocial engineering
Network rangesScanning scope
Third partiesSupply chain attack
\n
\n

3. Initial Access Vectors

\n

Selection Criteria

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
VectorWhen to Use
PhishingHuman target, email access
Public exploitsVulnerable services exposed
Valid credentialsLeaked or cracked
Supply chainThird-party access
\n
\n

4. Privilege Escalation Principles

\n

Windows Targets

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CheckOpportunity
Unquoted service pathsWrite to path
Weak service permissionsModify service
Token privilegesAbuse SeDebug, etc.
Stored credentialsHarvest
\n

Linux Targets

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CheckOpportunity
SUID binariesExecute as owner
Sudo misconfigurationCommand execution
Kernel vulnerabilitiesKernel exploits
Cron jobsWritable scripts
\n
\n

5. Defense Evasion Principles

\n

Key Techniques

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
TechniquePurpose
LOLBinsUse legitimate tools
ObfuscationHide malicious code
TimestompingHide file modifications
Log clearingRemove evidence
\n

Operational Security

\n\n
\n

6. Lateral Movement Principles

\n

Credential Types

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
TypeUse
PasswordStandard auth
HashPass-the-hash
TicketPass-the-ticket
CertificateCertificate auth
\n

Movement Paths

\n\n
\n

7. Active Directory Attacks

\n

Attack Categories

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
AttackTarget
KerberoastingService account passwords
AS-REP RoastingAccounts without pre-auth
DCSyncDomain credentials
Golden TicketPersistent domain access
\n
\n

8. Reporting Principles

\n

Attack Narrative

\n

Document the full attack chain:

\n
    \n
  1. How initial access was gained
    2. \n
  2. What techniques were used
    3. \n
  3. What objectives were achieved
    4. \n
  4. Where detection failed
    5. \n
\n

Detection Gaps

\n

For each successful technique:

\n\n
\n

9. Ethical Boundaries

\n

Always

\n\n

Never

\n\n
\n

10. Anti-Patterns

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
❌ Don't✅ Do
Rush to exploitationFollow methodology
Cause damageMinimize impact
Skip reportingDocument everything
Ignore scopeStay within boundaries
\n
\n
\n

Remember: Red team simulates attackers to improve defenses, not to cause harm.

\n
\n","files":[{"path":"SKILL.md","sizeBytes":4405,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-10-05T22:03:28.467905Z","sha256":"1D098BE03B25D742EB12482E78493C0D3288928B176999F206B7E4404E11348F","sizeBytes":2101},"review":null,"source":{"repositoryUrl":"https://github.com/VoDaiLocz/kilo-kit-mcp","path":"skills/security/red-team-tactics","license":"Apache-2.0","commit":"0448e6c050b84e0c0be0030593bd51cabbce3c81","subtreeSha":"10F03E9E75C7EA5151BCAE038467DC85F67F40162C7D949A28036CC62AC77860","lastSyncedAt":"2026-10-05T21:52:59.855581Z"},"reviewedAt":"2026-10-05T22:24:37.641308Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/VoDaiLocz/kilo-kit-mcp/tree/main/skills/security/red-team-tactics"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install vodailocz-kilo-kit-mcp@llmmart"},{"target":"git","command":"git clone https://github.com/VoDaiLocz/kilo-kit-mcp.git"}]}