redteam

Files (15)

• SKILL.md
• ad-core.md · tech/
• adcs.md · tech/
• c2.md · tech/
• cloud-apt.md · tech/
• creds.md · tech/
• delegation.md · tech/
• evasion.md · tech/
• exfil.md · tech/
• gpo-acl.md · tech/
• initial-access.md · tech/
• lateral.md · tech/
• lotl.md · tech/
• opsec.md · tech/
• persistence.md · tech/

SKILL.md (first lines)

# Red Team / APT Simulation Phase

## Philosophy

APT simulation is not about running a tool and reporting output. It is about proving a complete kill chain - initial foothold to Crown Jewels. Every technique in this skill is used in authorized red team engagements, documented in MITRE ATT&CK, and referenced in Mandiant/CrowdStrike/Recorded Future adversary reports.

This skill activates after a foothold is established (exploit phase proved initial access) or from an assumed-breach scenario. Every technique requires written authorization scope.

---

## Phase 0: Smart Intake

```bash
source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh

p0_init_vars "$1"
p0_state_gate || exit 0

p0_read_relay exploit secrets recon cloud_audit
p0_read_memory

TECH_STACK=$(jq -r '.intel.technologies[]?' "$SESSION" 2>/dev/null | tr '\n' ',')

echo "=== REDTEAM SMART INTAKE: $TARGET ==="
echo "State: $STATE | Tech: $TECH_STACK"
echo "Confirmed vulns: $(echo "$CONFIRMED_VULNS" | grep -c .)"
echo "Internal IPs reachable: $(echo "$INTERNAL_IPS" | grep -c .)"
echo "Verified creds: $(echo "$VERIFIED_CREDS" | grep -c .)"
echo "Auth bypass confirmed: $VERIFIED_AUTH_BYPASS"
echo "ATW flagged (skip): $ATW_FLAGGED"
```

**Intake-to-technique priority:**

| Signal available | Prioritize |
|---|---|
| Internal IPs + SSRF vector | C2 setup -> lateral movement |
| AD/LDAP/Kerberos in tech stack | BloodHound -> Kerberoast -> DCSync |
| AWS keys in secrets relay | Assumed-role lateral movement -> S3/RDS |
| Azure AD hint | Device Code phishing -> Pass-the-PRT -> ADFS |
| Confirmed auth bypass | Assumed breach - skip initial access |
| Windows hosts reachable | Credential harvesting -> Pass-the-Hash |
| Linux pivot available | SUID/sudo -> cron hijack -> kernel exploits |

---

## Phase 1: Build Execution Manifest

```bash
MANIFEST_ITEMS="[]"

[ "$VERIFIED_AUTH_BYPASS" = "false" ] && \
  MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt01","tool":"initial_access","priority":"MUST","status":"pending"}]')

MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt02","tool":"c2_setup","priority":"MUST","status":"pending"}]')
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt03","tool":"cred_harvest","priority":"MUST","status":"pending"}]')

echo "$TECH_STACK" | grep -qi "ldap\|kerberos\|active.directory\|domain" && \
  MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt04","tool":"ad_attacks","priority":"MUST","status":"pending"}]')

[ -n "$INTERNAL_IPS" ] && \
  MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt05","tool":"lateral_movement","priority":"MUST","status":"pending"}]')

echo "$TECH_STACK" | grep -qi "aws\|azure\|gcp\|cloud" && \
  MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt06","tool":"cloud_apt","priority":"MUST","status":"pending"}]')

MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt07","tool":"persistence","priority":"SHOULD","status":"pending"}]')
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt08","tool":"defense_evasion","priority":"SHOULD","status":"pending"}]')
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt09","tool":"data_exfil","priority":"SHOULD","status":"pending"}]')
MANIFEST_ITEMS=$(echo $MANIFEST_ITEMS | jq '. + [{"id":"rt10","tool":"opsec","priority":"IF_TIME","status":"pending"}]')

p0_manifest_write "redteam" "$MANIFEST_ITEMS"
```

---

## Phase 2: Technique Loader

**Read ONLY the technique files that match your active manifest items.**

Use the `Read` tool: `~/.claude/skills/redteam/tech/<filename>`

| Manifest ID / focus flag | Technique file | Load when |
|---|---|---|
| rt01 - initial access | `initial-access.md` | no auth bypass confirmed |
| rt02 - C2 framework | `c2.md` | always |
| rt03 - cred harvest | `creds.md` | always |
| rt04 - AD attacks | `ad-core.md` | AD/LDAP/Kerberos in tech |
| rt04 (ADCS) | `adcs.md` | AD confirmed + ADCS endpoint found |
| rt04 (delegation) | `delegation.md` | AD confirmed + delegation flags found |
| rt04 (GPO/ACL) | `gpo-acl.md` | BloodHound path involves GPO/ACL |
| rt05 - lateral movement | `lateral.md` | internal IPs reachable |
| rt05 (LotL) | `lotl.md` | Windows hosts confirmed |
| rt06 - cloud APT | `cloud-apt.md` | cloud hints in tech stack |
| rt07 - persistence | `persistence.md` | foothold established |
| rt08 - defense evasion | `evasion.md` | AV/EDR present |
| rt09 - data exfil | `exfil.md` | Crown Jewels located |
| rt10 - OPSEC | `opsec.md` | all IF_TIME |

**Focus flag routing (`--focus=ad` etc.):**

| Focus flag | Load these files |
|---|---|
| `--focus=ad` | `ad-core.md`, `adcs.md`, `delegation.md`, `gpo-acl.md` |
| `--focus=cloud` | `cloud-apt.md` |
| `--focus=evasion` | `evasion.md`, `c2.md` |
| `--focus=initial` | `initial-access.md` |
| `--focus=lateral` | `lateral.md`, `lotl.md`, `creds.md` |

**Available technique files in `redteam/tech/`:**

| File | Covers |
|---|---|
| `initial-access.md` | HTML smuggling, macro-less Office, LNK/ISO, drive-by, fake CAPTCHA |
| `c2.md` | Cobalt Strike malleable profiles, Havoc, Sliver, domain fronting |
| `lotl.md` | LOLBins, LOLDrivers, LSASS without Mimikatz, certutil/mshta/regsvr32 |
| `creds.md` | LSASS dump, DCSync, SAM, DPAPI, Kerberos ticket extraction |
| `ad-core.md` | BloodHound, Kerberoasting, AS-REP, PTH, PTT, Golden/Silver tickets |

From kalpmodi/akira, MIT.

More from kalpmodi/akira