conducting-full-scope-red-team-engagement

name	conducting-full-scope-red-team-engagement
description	Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","adversary-emulation","mitre-attack","penetration-testing","offensive-security","purple-team","ttp-mapping"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"]
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]

Conducting Full-Scope Red Team Engagement

Overview

A full-scope red team engagement simulates real-world adversary behavior across all phases of the cyber kill chain — from initial reconnaissance through data exfiltration — to evaluate an organization's detection, prevention, and response capabilities. Unlike penetration testing, red team operations prioritize stealth, persistence, and objective-based scenarios that mimic advanced persistent threats (APTs).

When to Use

• When conducting security assessments that involve conducting full scope red team engagement
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Most Often Missed & How to Confirm

• No deconfliction / emergency-stop line agreed before kickoff. Capture SOC deconfliction contacts and the abort procedure in the RoE before any action, or a real incident gets confused with the test.
• Treating phishing failure as engagement failure. When initial access stalls, pivot to the agreed assumed-breach grant instead of burning the window on more lures.
• Not timestamping actions as you go. MTTD/MTTR and dwell-time metrics can't be reconstructed after the fact — log each TTP with a timestamp live.
• Skipping artifact/persistence cleanup and kill dates, leaving implants and scheduled tasks behind.
• Pursuing "crown jewels" that aren't actually in scope — re-verify objectives against the RoE.
• How to confirm: every phase produces an evidence artifact (screenshot + timestamp + host). An objective counts as achieved only when the concrete success signal is observed — e.g. membership in Domain Admins confirmed via whoami /groups, or the crown-jewel file hash received at the C2 after exfil. Don't conclude an objective is unmet until the assumed-breach path has been tried; an initial-access miss is not an engagement miss.

Prerequisites

• Written authorization (Rules of Engagement document) signed by executive leadership
• Defined scope including in-scope/out-of-scope systems, escalation contacts, and emergency stop procedures
• Threat intelligence on relevant adversary groups (e.g., APT29, FIN7, Lazarus Group)
• Red team infrastructure: C2 servers, redirectors, phishing domains, payload development environment
• Legal review confirming compliance with Computer Fraud and Abuse Act (CFAA) and local laws

Engagement Phases

Phase 1: Planning and Threat Modeling