| name | conducting-full-scope-red-team-engagement |
| description | Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["red-team","adversary-emulation","mitre-attack","penetration-testing","offensive-security","purple-team","ttp-mapping"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Conducting Full-Scope Red Team Engagement
Overview
A full-scope red team engagement simulates real-world adversary behavior across all phases of the cyber kill chain — from initial reconnaissance through data exfiltration — to evaluate an organization's detection, prevention, and response capabilities. Unlike penetration testing, red team operations prioritize stealth, persistence, and objective-based scenarios that mimic advanced persistent threats (APTs).
When to Use
- When conducting security assessments that involve conducting full scope red team engagement
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Most Often Missed & How to Confirm
- No deconfliction / emergency-stop line agreed before kickoff. Capture SOC deconfliction contacts and the abort procedure in the RoE before any action, or a real incident gets confused with the test.
- Treating phishing failure as engagement failure. When initial access stalls, pivot to the agreed assumed-breach grant instead of burning the window on more lures.
- Not timestamping actions as you go. MTTD/MTTR and dwell-time metrics can't be reconstructed after the fact — log each TTP with a timestamp live.
- Skipping artifact/persistence cleanup and kill dates, leaving implants and scheduled tasks behind.
- Pursuing "crown jewels" that aren't actually in scope — re-verify objectives against the RoE.
- How to confirm: every phase produces an evidence artifact (screenshot + timestamp + host). An objective counts as achieved only when the concrete success signal is observed — e.g. membership in Domain Admins confirmed via
whoami /groups, or the crown-jewel file hash received at the C2 after exfil. Don't conclude an objective is unmet until the assumed-breach path has been tried; an initial-access miss is not an engagement miss.
Prerequisites
- Written authorization (Rules of Engagement document) signed by executive leadership
- Defined scope including in-scope/out-of-scope systems, escalation contacts, and emergency stop procedures
- Threat intelligence on relevant adversary groups (e.g., APT29, FIN7, Lazarus Group)
- Red team infrastructure: C2 servers, redirectors, phishing domains, payload development environment
- Legal review confirming compliance with Computer Fraud and Abuse Act (CFAA) and local laws
Engagement Phases
Phase 1: Planning and Threat Modeling
