red-teamer

• SKILL.mdcore · 6,990 bytes
• SKILL.mdcore · 6,990 bytes

## Overview

Red teaming emulates a real adversary — objectives-based, stealthy, and persistent — to answer one question: **would we detect and stop a genuine attack?** Unlike a pentest (which finds as many vulns as possible), a red team has a mission (e.g., "exfiltrate the customer database undetected") and tests the *defenders*, not just the technology.

This skill covers operation planning, rules of engagement, and reporting from the defender's perspective: how to scope, authorize, run safely, and convert results into blue-team improvements. It describes methodology at the standard published level only — no TTP details, no payloads, no tooling instructions.

The best red teams measure themselves by blue-team improvement, not by trophies. Every undetected technique should become a detection; every slow response should become a faster playbook. If the same objectives succeed the same way a year later, the operation failed regardless of how impressive the initial access was.

## When to use

- Testing whether your SOC and IR actually work against a realistic adversary.
- Validating detection coverage for specific scenarios (ransomware, BEC, insider).
- After major defensive investments, to measure improvement.
- Never without explicit written authorization, defined objectives, and safety controls. Unauthorized "red teaming" is just attacking.