redteam

Red Team / APT Simulation Phase

Philosophy

APT simulation is not about running a tool and reporting output. It is about proving a complete kill chain - initial foothold to Crown Jewels. Every technique in this skill is used in authorized red team engagements, documented in MITRE ATT&CK, and referenced in Mandiant/CrowdStrike/Recorded Future adversary reports.

This skill activates after a foothold is established (exploit phase proved initial access) or from an assumed-breach scenario. Every technique requires written authorization scope.

---

Phase 0: Smart Intake

source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh

p0_init_vars "$1"
p0_state_gate || exit 0

p0_read_relay exploit secrets recon cloud_audit
p0_read_memory

TECH_STACK=$(jq -r '.intel.technologies[]?' "$SESSION" 2>/dev/null | tr '\n' ',')

echo "=== REDTEAM SMART INTAKE: $TARGET ==="
echo "State: $STATE | Tech: $TECH_STACK"
echo "Confirmed vulns: $(echo "$CONFIRMED_VULNS" | grep -c .)"
echo "Internal IPs reachable: $(echo "$INTERNAL_IPS" | grep -c .)"
echo "Verified creds: $(echo "$VERIFIED_CREDS" | grep -c .)"
echo "Auth bypass confirmed: $VERIFIED_AUTH_BYPASS"
echo "ATW flagged (skip): $ATW_FLAGGED"

Intake-to-technique priority:

Signal available	Prioritize
Internal IPs + SSRF vector	C2 setup -> lateral movement
AD/LDAP/Kerberos in tech stack	BloodHound -> Kerberoast -> DCSync
AWS keys in secrets relay	Assumed-role lateral movement -> S3/RDS
Azure AD hint	Device Code phishing -> Pass-the-PRT -> ADFS
Confirmed auth bypass	Assumed breach - skip initial access
Windows hosts reachable	Credential harvesting -> Pass-the-Hash
Linux pivot available	SUID/sudo -> cron hijack -> kernel exploits

---

Phase 1: Build Execution Manifest

MANIFEST_ITEMS="[]"

[ "$VERIFIED_AUTH_BYPASS" = "false" ] && \
  MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt01","tool":"initial_access","priority":"MUST","status":"pending"}]')

MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt02","tool":"c2_setup","priority":"MUST","status":"pending"}]')
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt03","tool":"cred_harvest","priority":"MUST","status":"pending"}]')

echo "$TECH_STACK" | grep -qi "ldap\|kerberos\|active.directory\|domain" && \
  MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt04","tool":"ad_attacks","priority":"MUST","status":"pending"}]')

[ -n "$INTERNAL_IPS" ] && \
  MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt05","tool":"lateral_movement","priority":"MUST","status":"pending"}]')

echo "$TECH_STACK" | grep -qi "aws\|azure\|gcp\|cloud" && \
  MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt06","tool":"cloud_apt","priority":"MUST","status":"pending"}]')

MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt07","tool":"persistence","priority":"SHOULD","status":"pending"}]')
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt08","tool":"defense_evasion","priority":"SHOULD","status":"pending"}]')
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt09","tool":"data_exfil","priority":"SHOULD","status":"pending"}]')
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt10","tool":"opsec","priority":"IF_TIME","status":"pending"}]')

p0_manifest_write "redteam" "$MANIFEST_ITEMS"