Red Team Fundamentals

Red teaming is goal-oriented adversary simulation: reach an agreed objective against a real defence stack, and measure what the defenders saw while you did it. The objective is the unit of success, not the vulnerability count, which is why an engagement can succeed without a single exploit and fail with a dozen.

Core Principles

Red Team Methodology

Five phases, and each one has a gate: an artefact that must exist before the next phase starts. The gates are the part worth memorising, because every engagement that goes wrong went wrong at one of them.

Phase 1: Pre-Engagement

Everything that makes the rest of the engagement legal and safe happens here. The output is a document, not a toolchain.

• Objective stated as an outcome the client cares about, with the evidence that would prove it.
• Rules of engagement signed by the primary and alternate authoriser, with the asset list as an annex.
• Adversary profile selected from the client's own threat intelligence, mapped to ATT&CK techniques.
• Infrastructure inventoried: domains, collectors, certificates, owners, and teardown dates.
• Deconfliction channel and phrase issued to the SOC and help desk before anything runs.

Phase 2: Initial Access

The phase with the most ways to cause harm, so it is the one with the tightest controls. Prefer channels the client can measure over channels that impress.

• Consented phishing or pretexting against an approved pilot group, with no credential capture.
• Physical entry under the agreed escort, insurance, and local-law conditions.
• Perimeter validation limited to proof-of-exposure checks on listed assets.
• Every attempt recorded with a campaign ID so the SOC can correlate reports and alerts.

Phase 3: Establishment

Convert a foothold into something that survives normal operations — then write down how it comes out.

• Command channel on an approved domain, with the beacon interval and transport recorded.
• Persistence only under separately initialled approval, one register line per mechanism.
• Internal reconnaissance scoped to the asset list; unlisted systems are out of bounds even when reachable.
• Credential handling limited to approved test accounts and synthetic secrets.

Phase 4: Objective Completion

The objective proves reach and control response. Take the shortest path that produces evidence, not the most impressive one.

• Move toward the target with the least privilege that works, documenting each hop and its telemetry.
• Demonstrate access to the objective and prove the exfiltration path with canary records.
• Record which controls fired, which did not, and how long detection took at each step.
• Stop at the objective. Continuing past it adds client risk and no finding.

Phase 5: Post-Engagement

The engagement ends when the client can act on it. That means removal evidence first, narrative second.

• Persistence and infrastructure removed, with removal evidence attached to the register.
• Debrief with the defenders who were tested: timeline, decisions, alert latency, blind spots.
• Executive report framed around control gaps and the detection backlog, not the exploit chain.
• Follow-up purple team iterations to confirm the new detections actually fire.