Red Team · Offensive Security

Red Team Research

Offensive security methodology reference covering the attack lifecycle mapped to MITRE ATT&CK technique coverage by phase, C2 framework comparison and tool arsenal. All research in authorised engagements.

MITRE ATT&CK ↗·LOLBAS Project ↗·BloodHound Docs ↗

Attack Lifecycle — Techniques by Phase (MITRE ATT&CK-aligned)

Reconnaissance

T1590T1591T1592+3

▾

Techniques

·Passive OSINT (Shodan, Censys, LinkedIn, GitHub)
·Active scanning (nmap, masscan, nuclei)
·Certificate transparency log mining
·DNS zone walking and brute force
·Email harvesting (Hunter.io, theHarvester)
·Employee profiling via LinkedIn/social media

ATT&CK IDs

T1590 T1591 T1592 T1593 T1594 T1596

Initial Access

T1566T1190T1133+3

▾

Techniques

·Spearphishing with macro-enabled lures (T1566.001)
·Credential stuffing against VPN/OWA/O365
·Public-facing application exploitation (CISA KEV)
·Supply chain compromise via software update
·Watering hole attacks on sector-specific sites
·Trusted relationship abuse (MSP, IT vendor access)

ATT&CK IDs

T1566 T1190 T1133 T1195 T1189 T1199

Execution

T1059.001T1047T1053.005+3

▾

Techniques

·PowerShell with AMSI bypass (reflection, patching)
·WMI event subscription for execution
·Scheduled tasks via COM objects
·DLL sideloading (legitimate signed binary + malicious DLL)
·MSBuild / InstallUtil LOLBaS abuse
·Rundll32 for proxy execution

ATT&CK IDs

T1059.001 T1047 T1053.005 T1574.002 T1127 T1218

Persistence

T1547.001T1543.003T1053.005+3

▾

Techniques

·Registry run keys and startup folder
·Windows service creation/modification
·Scheduled task (SYSTEM account context)
·COM object hijacking (HKCU registry)
·Boot/logon autostart (logon scripts, AppInit_DLLs)
·Account creation (local admin, AD user)

ATT&CK IDs

T1547.001 T1543.003 T1053.005 T1546.015 T1547 T1136

Privilege Escalation

T1134.001T1548.002T1574.009+3

▾

Techniques

·Token impersonation (SeImpersonatePrivilege → SYSTEM)
·UAC bypass via fodhelper, eventvwr, CMSTPLUA
·Unquoted service path exploitation
·DLL hijacking in privileged paths
·AlwaysInstallElevated MSI abuse
·Kerberos delegation attacks (constrained, unconstrained)

ATT&CK IDs

T1134.001 T1548.002 T1574.009 T1574.001 T1574.010 T1558

Defence Evasion

T1055.012T1070T1027+3

▾

Techniques

·Direct syscall (ntdll bypassing hooks via Hell's Gate)
·NTDLL unhooking (fresh copy mapping)
·Process hollowing / Process doppelgänging
·Timestomping and log clearing
·Reflective DLL injection (no disk artefact)
·AMSI patching in memory

ATT&CK IDs

T1055.012 T1070 T1027 T1562.001 T1055.001 T1112

Credential Access

T1003.001T1558.003T1558.004+3

▾

Techniques

·LSASS memory dump (Task Manager, ProcDump, comsvcs.dll)
·Kerberoasting (request TGS for SPN accounts)
·AS-REP roasting (accounts without pre-auth)
·DCSync (replicating directory from any DC)
·DPAPI secret extraction (credential manager, browser)
·Password spray against AD using domain policy

ATT&CK IDs

T1003.001 T1558.003 T1558.004 T1003.006 T1555 T1110.003

Lateral Movement

T1550.002T1550.003T1021.006+3

▾

Techniques

·Pass-the-Hash via SMB (NTLMv2 relay)
·Pass-the-Ticket using stolen Kerberos tickets
·WinRM remote execution with stolen credentials
·PsExec / SC.exe service deployment
·DCOM lateral movement (MMC20.Application)
·RDP using extracted credentials or certificates

ATT&CK IDs

T1550.002 T1550.003 T1021.006 T1569.002 T1021.003 T1021.001

Tool Arsenal by Phase

Recon

ShodanBBOTtheHarvesterAmassSubfinderNuclei

Initial Access

GoPhishEvilginx3ModlishkamsfvenomLOLBAS

Post-Exploitation

Cobalt StrikeSliverHavocMetasploitNimbo-C2

Credential Access

MimikatzRubeusCrackMapExecImpacketLaZagne

Lateral Movement

ImpacketCrackMapExecBloodHound/SharpHoundEvil-WinRMligolo-ng

Active Directory

BloodHoundADExplorerPowerViewSharpHoundCertifyPKINITtools

C2 Framework Comparison

Framework	Language	Licence	Strengths	Detection Maturity
Cobalt Strike	Java	Commercial (per-user annual licence)	Industry standard, mature, excellent C2 profiles, team server, third-party integration	High (well-known beacon patterns; watermarking via CS version)
Sliver	Go	Open Source (GPL-3.0)	MTLS/gRPC/WireGuard C2, implant in Go/Rust, implant staging, armory plugins	Medium-low (newer; still establishing signatures)
Havoc	C/C++	Open Source	Evasion-focused, Ekko sleep obfuscation, indirect syscalls, kerberos support, Shift+F4 GUI	Low-medium (signature coverage increasing)
Nighthawk	C	Commercial (MDSec)	Maximum EDR evasion, hardware breakpoints, encrypted comms, BYOL (bring-your-own-loader)	Very low (expensive, limited distribution)

All C2 frameworks are dual-use. This material is for defenders and authorised red teams — only use these frameworks under a signed scope of engagement and applicable law.