# Conducting Full Scope Red Team Engagement

Plan and execute a comprehensive red team engagement covering reconnaissance through...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill conducting-full-scope-red-team-engagement -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill conducting-full-scope-red-team-engagement -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill conducting-full-scope-red-team-engagement -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill conducting-full-scope-red-team-engagement -g -a gemini-cli -y`

## Description

Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Conducting Full-Scope Red Team Engagement

## Overview

A full-scope red team engagement simulates real-world adversary behavior across all phases of the cyber kill chain, from initial reconnaissance through data exfiltration, to evaluate an organization's detection, prevention, and response capabilities. Unlike penetration testing, red team operations prioritize stealth, persistence, and objective-based scenarios that mimic advanced persistent threats (APTs).


## When to Use

- When conducting security assessments that involve conducting full scope red team engagement
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing

## Prerequisites

- Written authorization (Rules of Engagement document) signed by executive leadership
- Defined scope including in-scope/out-of-scope systems, escalation contacts, and emergency stop procedures
- Threat intelligence on relevant adversary groups (e.g., APT29, FIN7, Lazarus Group)
- Red team infrastructure: C2 servers, redirectors, phishing domains, payload development environment
- Legal review confirming compliance with Computer Fraud and Abuse Act (CFAA) and local laws

## Engagement Phases

### Phase 1: Planning and Threat Modeling

Map the engagement to specific MITRE ATT&CK tactics and techniques based on the threat profile:

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/conducting-full-scope-red-team-engagement/SKILL.md