Name: Conducting Full Scope Red Team Engagement
Author: mukul975

Overview

A full-scope red team engagement simulates real-world adversary behavior across all phases of the cyber kill chain — from initial reconnaissance through data exfiltration — to evaluate an organization's detection, prevention, and response capabilities. Unlike penetration testing, red team operations prioritize stealth, persistence, and objective-based scenarios that mimic advanced persistent threats (APTs).

When to Use

When conducting security assessments that involve conducting full scope red team engagement
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Written authorization (Rules of Engagement document) signed by executive leadership
Defined scope including in-scope/out-of-scope systems, escalation contacts, and emergency stop procedures
Threat intelligence on relevant adversary groups (e.g., APT29, FIN7, Lazarus Group)

Overview

When to Use

When conducting security assessments that involve conducting full scope red team engagement
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Written authorization (Rules of Engagement document) signed by executive leadership
Defined scope including in-scope/out-of-scope systems, escalation contacts, and emergency stop procedures
Threat intelligence on relevant adversary groups (e.g., APT29, FIN7, Lazarus Group)

Kill Chain Phase	MITRE ATT&CK Tactic	Example Techniques
Reconnaissance	TA0043	T1593 Search Open Websites/Domains, T1589 Gather Victim Identity Info
Resource Development	TA0042	T1583.001 Acquire Infrastructure: Domains, T1587.001 Develop Capabilities: Malware
Initial Access	TA0001	T1566.001 Spearphishing Attachment, T1078 Valid Accounts
Execution	TA0002	T1059.001 PowerShell, T1204.002 User Execution: Malicious File
Persistence	TA0003	T1053.005 Scheduled Task, T1547.001 Registry Run Keys
Privilege Escalation	TA0004	T1068 Exploitation for Privilege Escalation, T1548.002 UAC Bypass
Defense Evasion	TA0005	T1055 Process Injection, T1027 Obfuscated Files
Credential Access	TA0006	T1003.001 LSASS Memory, T1558.003 Kerberoasting
Discovery	TA0007	T1087 Account Discovery, T1018 Remote System Discovery
Lateral Movement	TA0008	T1021.002 SMB/Windows Admin Shares, T1550.002 Pass the Hash
Collection	TA0009	T1560 Archive Collected Data, T1213 Data from Information Repositories
Exfiltration	TA0010	T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol
Impact	TA0040	T1486 Data Encrypted for Impact, T1489 Service Stop

Metric	Description
Mean Time to Detect (MTTD)	Average time from action to SOC detection
Mean Time to Respond (MTTR)	Average time from detection to containment
TTP Coverage	Percentage of executed techniques detected
Objective Achievement Rate	Percentage of defined objectives completed
Dwell Time	Total time red team maintained access undetected

Conducting Full Scope Red Team Engagement

Overview

When to Use

Prerequisites

Conducting Full Scope Red Team Engagement

Overview

When to Use

Prerequisites

Engagement Phases

Phase 1: Planning and Threat Modeling

Phase 2: Reconnaissance (OSINT)

Phase 3: Initial Access

Phase 4: Post-Exploitation and Lateral Movement

Phase 5: Objective Achievement

Phase 6: Reporting and Debrief

Metrics and KPIs

Tools and Frameworks

References

Things Mac

Trello

Production Scheduling

Jira Integration

Production Scheduling

Cost Aware Llm Pipeline