conducting-full-scope-red-team-engagement

name	conducting-full-scope-red-team-engagement
description	Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","adversary-emulation","mitre-attack","penetration-testing","offensive-security","purple-team","ttp-mapping"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"]
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]

Conducting Full-Scope Red Team Engagement

Overview

A full-scope red team engagement simulates real-world adversary behavior across all phases of the cyber kill chain — from initial reconnaissance through data exfiltration — to evaluate an organization's detection, prevention, and response capabilities. Unlike penetration testing, red team operations prioritize stealth, persistence, and objective-based scenarios that mimic advanced persistent threats (APTs).

When to Use

• When conducting security assessments that involve conducting full scope red team engagement
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Written authorization (Rules of Engagement document) signed by executive leadership
• Defined scope including in-scope/out-of-scope systems, escalation contacts, and emergency stop procedures
• Threat intelligence on relevant adversary groups (e.g., APT29, FIN7, Lazarus Group)
• Red team infrastructure: C2 servers, redirectors, phishing domains, payload development environment
• Legal review confirming compliance with Computer Fraud and Abuse Act (CFAA) and local laws

Engagement Phases

Phase 1: Planning and Threat Modeling

Map the engagement to specific MITRE ATT&CK tactics and techniques based on the threat profile:

Kill Chain Phase	MITRE ATT&CK Tactic	Example Techniques
Reconnaissance	TA0043	T1593 Search Open Websites/Domains, T1589 Gather Victim Identity Info
Resource Development	TA0042	T1583.001 Acquire Infrastructure: Domains, T1587.001 Develop Capabilities: Malware
Initial Access	TA0001	T1566.001 Spearphishing Attachment, T1078 Valid Accounts
Execution	TA0002	T1059.001 PowerShell, T1204.002 User Execution: Malicious File
Persistence	TA0003	T1053.005 Scheduled Task, T1547.001 Registry Run Keys
Privilege Escalation	TA0004	T1068 Exploitation for Privilege Escalation, T1548.002 UAC Bypass
Defense Evasion	TA0005	T1055 Process Injection, T1027 Obfuscated Files
Credential Access