Red Team Assessment
What this domain tests
Red Team Assessment tests objective-driven adversary emulation under rules of engagement. It is not a vulnerability scan with a different name; the exam looks for scoping, operational security, attack-path thinking, and evidence quality.
Core rules
- Start with the objective and the rules of engagement: in-scope assets, prohibited actions, timing, emergency contacts, and deconfliction with defenders.
- OPSEC includes separated infrastructure, redirectors, controlled payloads, and awareness that actions are logged. Persistence and data exfiltration require explicit approval.
- Typical phases are initial access, execution, privilege escalation, credential access, discovery, lateral movement, and objective completion. Every step should support the objective.
- Report the attack path, evidence, business impact, and remediation. A pile of findings is not a red team report.
- Purple-team handoff turns detected and missed actions into detection engineering improvements.
Worked example
The objective is to read a finance share. You start from an assumed-breach workstation, enumerate AD, and find a service account with an SPN and a weak password. Kerberoasting yields a ticket; offline cracking recovers the password. The account can read the share but is not domain admin. You stop at the objective and document the path: workstation to service account to share. The reasoning is that objective completion, not maximum privilege, defines success. Remediation includes a managed service account, strong password policy, and share ACL review.
Traps
- Scope creep into production systems without approval.
- Installing persistence by habit.
- Confusing a penetration test with red teaming.
- Reporting exploited vulnerabilities without the chain or impact.