# Offensive Advanced Redteam

Comprehensive red team operations methodology covering full engagement lifecycle from...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Design
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-advanced-redteam -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-advanced-redteam -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-advanced-redteam -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-advanced-redteam -g -a gemini-cli -y`

## Description

Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Advanced Red Team Operations

Red team engagements simulate real-world adversaries against an organization's people,
processes, and technology. Unlike penetration tests that maximize vulnerability discovery
in a fixed scope, red team operations test detection and response capabilities by pursuing
specific objectives while evading defenders. You operate under rules of engagement that
define what is in bounds, and every action you take must be deliberate, documented, and
reversible. This skill covers the full engagement lifecycle from initial planning through
final debrief.

## Quick Workflow

1. Negotiate scope, rules of engagement, and deconfliction procedures with the client.
2. Build tiered attack infrastructure with redirectors, aged domains, and valid TLS.
3. Configure C2 profiles to blend with the target's legitimate traffic patterns.
4. Execute the attack chain while maintaining strict OPSEC and logging every action.
5. Collect and stage data with encryption; maintain chain of custody throughout.
6. Evade endpoint and network defenses using tested bypass techniques.
7. Document findings with MITRE ATT&CK mappings and deliver structured reporting.
8. Conduct purple team debrief to validate detection gaps and remediation.

---

## Engagement Planning

Every red team engagement begins with planning that protects both the operator and the
client. Skipping this phase leads to scope disputes, legal exposure, and operational
failures.

### Scope and Objectives

Define what you are testing and what success looks like. Common objective types include
data exfiltration (retrieve specific records from a database), domain dominance (obtain
Domain Admin or equivalent), business process disruption (demonstrate ability to halt a
critical workflow), and physical access (gain entry to a restricted area).

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/infrastructure/offensive-advanced-redteam/SKILL.md