Simulate Adversary Tactics for Defense Validation

Red Team Tactics is a skill for adversary simulation, structured around the MITRE ATT&CK framework's attack lifecycle: reconnaissance, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command-and-control, exfiltration, and impact, each with a stated objective (map the attack surface, get a first foothold, survive reboots, get admin/root, avoid detection, and so on). It is explicitly gated for authorized use only: the skill is for educational purposes or authorized security assessments, requires explicit written permission from the system owner before use, and treats misuse as illegal and strictly prohibited. Before any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, it requires a mandatory confirmation gate - state the exact target, confirm written authorization and permitted scope, show the exact commands and their expected effect, and wait for explicit confirmation - and stays read-only, defensive-guidance-only otherwise, preferring a sandbox, disposable VM, or controlled lab.

It covers reconnaissance trade-offs (passive: no target contact but limited information, versus active: direct contact but higher detection risk) and information targets (technology stack for vector selection, employee information for social engineering, network ranges for scanning scope, third parties for supply-chain attacks); initial access vector selection (phishing, public exploits against exposed vulnerable services, leaked or cracked valid credentials, supply-chain access); privilege escalation checks on Windows (unquoted service paths, weak service permissions, token privilege abuse, stored credentials) and Linux (SUID binaries, sudo misconfiguration, kernel vulnerabilities, writable cron jobs); defense evasion techniques (LOLBins, obfuscation, timestomping, log clearing) and operational security habits (working during business hours, mimicking legitimate traffic, encrypted channels, blending with normal behavior); lateral movement via password, hash (pass-the-hash), ticket (pass-the-ticket), or certificate authentication over admin shares and remote services like RDP, SSH, and WinRM; and Active Directory attacks including Kerberoasting, AS-REP Roasting, DCSync, and Golden Ticket persistence.

Reporting requires documenting the full attack narrative - how access was gained, what techniques worked, what objectives were reached, where detection failed - plus, for each successful technique, what should have detected it and how to close that gap. Ethical boundaries are explicit: always stay within scope, minimize impact, report immediately if a real (non-simulated) threat is found, and document all actions; never destroy production data, cause denial of service unless it is in scope, access beyond proof-of-concept, or retain sensitive data. Its stated anti-patterns are rushing to exploitation instead of following methodology, causing damage instead of minimizing impact, skipping reporting, and ignoring scope.

Use it only for authorized penetration tests, red team engagements, or controlled educational labs where written permission and a defined scope already exist - and even then, only after explicitly confirming the target and authorization in-conversation before any live action. Do not use it without that authorization: absent explicit confirmation, it is meant to stay read-only and provide defensive guidance only, never live exploitation.

Input is the authorized target, its confirmed scope, and the phase of the attack lifecycle being exercised. Output is the applicable tactic or check for that phase plus its objective, and, at the end of an engagement, a documented attack narrative with detection-gap analysis for the defenders.

Authorized penetration testers and red teamers running MITRE ATT&CK-aligned adversary simulations under explicit written permission, and defenders studying the same tactics to identify their own detection gaps.