Red Team Tactics

This walks you through MITRE ATT&CK based red teaming with a focus on methodology over tools. You get the full attack lifecycle from reconnaissance through exfiltration, practical tables for privilege escalation checks on Windows and Linux, defense evasion principles like using LOLBins and blending with normal traffic, and a solid framework for reporting detection gaps. The ethical boundaries section is actually useful, not just CYA boilerplate. If you're simulating adversaries to test defenses or writing post-engagement reports, the structured approach to documenting what should have detected each technique and why it didn't is worth the price of admission alone.

skills.sh installs: 304
GitHub stars: 33.2K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add davila7/claude-code-templates --skill red-team-tactics --agent claude-code

Installs into .claude/skills of the current project.

Files

Red Team Tactics

Adversary simulation principles based on MITRE ATT&CK framework.

1. MITRE ATT&CK Phases

Attack Lifecycle

RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
       ↓              ↓              ↓            ↓
   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
       ↓              ↓              ↓            ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT

Phase Objectives

Phase	Objective
Recon	Map attack surface
Initial Access	Get first foothold
Execution	Run code on target
Persistence	Survive reboots
Privilege Escalation	Get admin/root
Defense Evasion	Avoid detection
Credential Access	Harvest credentials
Discovery	Map internal network
Lateral Movement	Spread to other systems
Collection	Gather target data
C2	Maintain command channel
Exfiltration	Extract data

Red Team Tactics

Install

Files

Red Team Tactics

1. MITRE ATT&CK Phases

Attack Lifecycle

Phase Objectives

2. Reconnaissance Principles

Passive vs Active

Details

More from davila7/claude-code-templates

Recommended