How to Do Red Teaming: The Ultimate Adversary Simulation Playbook

Red Teaming is Not Penetration Testing

The most pervasive misconception in the cybersecurity industry is the conflation of Penetration Testing and Red Teaming. To understand how to do red teaming, you must first understand the fundamental philosophical and operational differences between the two.

A Penetration Test is vulnerability-centric. The objective is to identify and exploit as many vulnerabilities as possible within a strictly defined scope and a short timeframe (usually 1-2 weeks). The output is a list of technical flaws.

A Red Team Engagement is objective-centric and threat-led. The goal is not to find every missing patch; the goal is to emulate a specific Advanced Persistent Threat (APT) trying to achieve a specific objective (e.g., "Exfiltrate the Q3 financial projections without alerting the SOC"). Red teaming tests the holistic defensive capabilities of the organization: its People, its Processes, and its Technology.

Red teaming is stealthy, prolonged (lasting weeks or months), and highly realistic. This guide outlines the comprehensive methodology of a modern Red Team operation.

Phase 1: Threat Intelligence and Scenario Development

A red team engagement begins long before a single packet is sent. It begins with Intelligence.

Threat Modeling You must define who you are simulating. Are you simulating a financially motivated ransomware syndicate (like LockBit) or a state-sponsored espionage group (like APT29)? * **Ransomware Emulation:** Focuses on rapid lateral movement, disabling backups, and massive data exfiltration. * **Espionage Emulation:** Focuses on slow, "low-and-slow" persistence, evading EDR, and carefully accessing specific intellectual property over months.

Rules of Engagement (RoE) The RoE is the legal shield of the operation. It defines the exact scope, the "out of bounds" assets (e.g., "Do not target the ICU network in the hospital"), the allowed tactics (e.g., "Physical tailgating is allowed, but lockpicking is not"), and the emergency escalation contacts.

Phase 2: Weaponization and Infrastructure

A Red Team needs an untraceable, resilient attack infrastructure. You cannot simply use your home IP address.

Command and Control (C2) Architecture The C2 framework is the nervous system of the operation. Modern red teams use frameworks like Cobalt Strike, Mythic, or Sliver. However, setting up a C2 server requires deep OpSec (Operational Security). 1. **Team Servers:** The hidden backend servers where operators collaborate. 2. **Redirectors:** Disposable cloud instances (AWS, DigitalOcean) that sit between the target and the Team Server. If the Blue Team detects the traffic and blocks the IP, you only lose the redirector, not the backend server. 3. **Domain Fronting and CDN Evasion:** Hiding C2 traffic inside legitimate CDN traffic (like Cloudflare or Fastly) so that it appears the malware is communicating with a trusted website.

Payload Development Modern Endpoint Detection and Response (EDR) solutions (like CrowdStrike or SentinelOne) will immediately flag generic malware. Red Teamers must develop custom payloads. * **Obfuscation:** Encrypting the payload to evade static signatures. * **Direct Syscalls:** Bypassing user-land API hooks placed by EDRs by communicating directly with the Windows kernel. * **Living off the Land (LotL):** Using native tools like PowerShell or WMI to execute commands without dropping malicious binaries to the disk.

*Mastering infrastructure and payload dev is complex. Parasym Academy offers dedicated modules on C2 architecture, EDR evasion, and advanced payload engineering to fast-track your Red Team capabilities.*

Phase 3: Initial Compromise

How does an APT actually get into the network?

Spear Phishing Still the undisputed king of initial access. Red Teams do not send generic "click here" emails. They spend days researching a specific employee, cloning legitimate corporate login portals (using tools like Evilginx2 to bypass MFA), and crafting highly contextual lures (e.g., an "Urgent Policy Update" from the HR department).

Physical Breaches If the digital perimeter is too hard, attack the physical one. * **Tailgating:** Following an employee through a secure door. * **Badge Cloning:** Using long-range RFID readers (like the Proxmark3) to clone employee badges in the parking lot. * **Rogue Devices:** Planting a hidden Raspberry Pi or Hak5 LAN Turtle behind a printer in a corporate conference room to establish a persistent remote shell.

Supply Chain Attacks Compromising a less-secure third-party vendor (like an HVAC contractor or a marketing agency) that has trusted access into the primary target's network.

Phase 4: Persistence and Evasion

Once initial access is achieved, the Red Team must ensure they do not lose it when the user reboots their machine.

* Registry Run Keys & Scheduled Tasks: The traditional methods, though highly monitored by SOCs. * DLL Hijacking: Replacing a legitimate DLL loaded by a trusted application with a malicious one. * WMI Event Subscriptions: A stealthy, fileless persistence mechanism native to Windows.

During this phase, OpSec is paramount. Operators must execute commands slowly, avoid noisy port scans (like Nmap), and blend in with normal administrative traffic.

Phase 5: Lateral Movement and Privilege Escalation

The initial compromised user rarely has access to the objective data. The team must move laterally.

Active Directory Mastery Red teaming is largely an exercise in Active Directory abuse. * **BloodHound:** An essential tool that uses graph theory to map out complex relationships and find the shortest path to Domain Admin. * **Pass-the-Hash / Pass-the-Ticket:** Reusing stolen credentials to authenticate to other machines in the domain without needing to crack the password. * **Kerberoasting:** Requesting service tickets for accounts with Service Principal Names (SPNs) and cracking them offline to gain highly privileged credentials.

Phase 6: Actions on Objective and Exfiltration

The final step is achieving the goal defined in the Threat Model.

If the goal is data theft, the Red Team must exfiltrate the data without triggering Data Loss Prevention (DLP) alerts. * Data is often encrypted, compressed into small chunks, and exfiltrated slowly over protocols that are inherently trusted, such as DNS (DNS Tunneling) or ICMP. * Alternatively, data can be uploaded to legitimate cloud services (like a rogue Microsoft 365 tenant or Google Drive) which the firewall naturally permits.

Phase 7: The True Value - The Debrief

The operation is useless if it does not improve the defensive posture of the organization. The Debrief is a collaborative session where the Red Team (Offense) and the Blue Team (Defense) sit down together (often called Purple Teaming). The Red Team walks through every step of the attack chain: * "At 14:00, we executed this payload. Did you see an alert?" * "At 16:30, we created a Domain Admin account. Why didn't the SIEM trigger a high-priority incident?"

The output is actionable intelligence used to write new detection rules, reconfigure firewalls, and retrain the SOC.

Become a Red Teamer with Parasym Academy

Red Teaming is the pinnacle of offensive security. It requires a vast, multi-disciplinary skill set encompassing network engineering, malware development, social engineering, and strategic thinking.

To truly learn how to do red teaming, you need an environment that accurately simulates the chaos and complexity of an enterprise network defending itself.

Parasym Academy provides exactly this. Our advanced Red Team curriculum immerses you in fully modeled corporate environments. You will learn to construct scalable C2 infrastructure, bypass modern EDR, execute complex Active Directory attacks, and master the art of stealth.

If you are ready to transition from running vulnerability scanners to executing sophisticated adversary simulations, explore the cyber range courses at Parasym Academy today, and learn how our enterprise teams conduct full-scope Red Teaming & Adversary Simulation.

Related Briefings