red-team-engagement

Name: red-team-engagement
Author: briiirussell

112installs36forks

How to install red-team-engagement?

briiirussell/cybersecurity-skills/red-team-engagement

$npx -y skills add briiirussell/cybersecurity-skills --skill red-team-engagement

Installs into the current project.

Summary

Plan, scope, and execute an authorized red-team engagement — distinct from a penetration test. Covers engagement methodology, assumed-breach scenarios, ATT&CK emulation plans, rules of engagement, deconfliction with the blue team, post-engagement debriefs, and the program-level w

Files · 1

View on GitHub

SKILL.md

1	# Red Team Engagement — Authorized Adversary Emulation
2
3	This skill is for planning and executing an authorized red-team engagement against systems and an organization that has explicitly contracted for it. It is distinct from a penetration test (technique-focused; see `web-pentest`) and from threat hunting (defensive; see `threat-hunting`). A red-team engagement is multi-week, objective-based, often assumed-breach, and explicitly tries to test the blue team's detect-and-respond capability — not just to find vulnerabilities.
4
5	This is the most dual-use skill in this catalog. The skill refuses to help conduct unauthorized adversary simulation, regardless of how the request is framed. The authorization check below is enforced strictly.
6
7	## Authorization Check — required before any planning or execution
8
9	Before working with this skill at all, confirm:
10
11	1. Written authorization for this specific engagement, against this specific target, signed by an executive with authority to grant it. The "get-out-of-jail" letter — a physical / digital document the team can produce if challenged
12	2. Defined scope — what systems, what time windows, what techniques are in / out of scope
13	3. Identified target organization owns the target systems — not a third party (vendor, customer, sub-tenant) whose authorization has not been obtained
14	4. Defined success criteria — what does this engagement need to demonstrate or test
15	5. Identified deconfliction contact — a single internal person who can pause / abort the engagement and answer "is this you?" when the blue team finds activity
16	6. Legal review on file — engagement contract or internal authorization reviewed by counsel, including for any controlled-data exposure
17	7. Communication plan for unintended impact — what happens if production is affected, how is it reported, how fast
18
19	If any of the above is missing or unclear, stop. Ask the user to confirm. Do not proceed with planning, technique selection, or any execution work.
20
21	If the user describes a target that does not appear to belong to them or to a contracted client, refuse — this is not a misunderstanding to be cleared up by adding "for educational purposes" or "in a CTF." The skill refuses to help simulate an attack on systems whose authorization is not present.
22
23	## What red-team engagements are for (and what they are not for)
24
25	Red-team engagements exist to test the security program's response capability — not just to find vulnerabilities. A good red-team engagement answers questions like:
26
27	- If an attacker gets initial access, how long until the blue team notices?
28	- When the blue team notices, how fast and how completely do they contain it?
29	- Are the documented incident-response procedures actually used?
30	- Do detections that exist in theory actually fire in practice?
31	- Can a determined adversary escalate to the named crown-jewel objective?
32
33	Red-team engagements are not for:
34
35	- Vulnerability discovery — pentests do that with much less overhead
36	- Compliance check-box — engagements are designed to teach, not to pass
37	- Performance reviews — using a red-team engagement to evaluate individual blue-team employees creates incentive problems that distort everyone's behavior
38
39	If the goal is "find vulnerabilities," use `web-pentest` or the relevant audit skill. If the goal is "test whether our detection and response actually works," this is the right skill.
40
41	## Engagement model — three flavors
42
43	\| Model \| Description \| When to use \|
44	\|---\|---\|---\|
45	\| External red team \| Engagement starts from outside the perimeter; no initial foothold \| Mature programs testing the full attack chain end-to-end \|
46	\| Assumed breach \| Engagement starts from a granted initial foothold (workstation, credentials, low-privilege account) \| When the perimeter is well-tested already and the question is post-compromise containment \|
47	\| Purple team \| Red and blue work side-by-side; red executes technique, blue verifies detection live \| Early in detection-engineering maturity; high learning rate \|
48
49	Assumed-breach is the most common modern engagement model — the value-per-week is highest because almost every real breach start

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# Red Team Engagement — Authorized Adversary Emulation

This skill is for **planning and executing an authorized red-team engagement against systems and an organization that has explicitly contracted for it**. It is

This is the most dual-use skill in this catalog. The skill refuses to help conduct unauthorized adversary simulation, regardless of how the request is framed. T

## Authorization Check — required before any planning or execution

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type

red-team-engagement

112installs36forks

View on GitHub

How to install red-team-engagement?

briiirussell/cybersecurity-skills/red-team-engagement

$npx -y skills add briiirussell/cybersecurity-skills --skill red-team-engagement

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Red Team Engagement — Authorized Adversary Emulation
2
3	This skill is for planning and executing an authorized red-team engagement against systems and an organization that has explicitly contracted for it. It is distinct from a penetration test (technique-focused; see `web-pentest`) and from threat hunting (defensive; see `threat-hunting`). A red-team engagement is multi-week, objective-based, often assumed-breach, and explicitly tries to test the blue team's detect-and-respond capability — not just to find vulnerabilities.
4
5	This is the most dual-use skill in this catalog. The skill refuses to help conduct unauthorized adversary simulation, regardless of how the request is framed. The authorization check below is enforced strictly.
6
7	## Authorization Check — required before any planning or execution
8
9	Before working with this skill at all, confirm:
10
11	1. Written authorization for this specific engagement, against this specific target, signed by an executive with authority to grant it. The "get-out-of-jail" letter — a physical / digital document the team can produce if challenged
12	2. Defined scope — what systems, what time windows, what techniques are in / out of scope
13	3. Identified target organization owns the target systems — not a third party (vendor, customer, sub-tenant) whose authorization has not been obtained
14	4. Defined success criteria — what does this engagement need to demonstrate or test
15	5. Identified deconfliction contact — a single internal person who can pause / abort the engagement and answer "is this you?" when the blue team finds activity
16	6. Legal review on file — engagement contract or internal authorization reviewed by counsel, including for any controlled-data exposure
17	7. Communication plan for unintended impact — what happens if production is affected, how is it reported, how fast
18
19	If any of the above is missing or unclear, stop. Ask the user to confirm. Do not proceed with planning, technique selection, or any execution work.
20
21	If the user describes a target that does not appear to belong to them or to a contracted client, refuse — this is not a misunderstanding to be cleared up by adding "for educational purposes" or "in a CTF." The skill refuses to help simulate an attack on systems whose authorization is not present.
22
23	## What red-team engagements are for (and what they are not for)
24
25	Red-team engagements exist to test the security program's response capability — not just to find vulnerabilities. A good red-team engagement answers questions like:
26
27	- If an attacker gets initial access, how long until the blue team notices?
28	- When the blue team notices, how fast and how completely do they contain it?
29	- Are the documented incident-response procedures actually used?
30	- Do detections that exist in theory actually fire in practice?
31	- Can a determined adversary escalate to the named crown-jewel objective?
32
33	Red-team engagements are not for:
34
35	- Vulnerability discovery — pentests do that with much less overhead
36	- Compliance check-box — engagements are designed to teach, not to pass
37	- Performance reviews — using a red-team engagement to evaluate individual blue-team employees creates incentive problems that distort everyone's behavior
38
39	If the goal is "find vulnerabilities," use `web-pentest` or the relevant audit skill. If the goal is "test whether our detection and response actually works," this is the right skill.
40
41	## Engagement model — three flavors
42
43	\| Model \| Description \| When to use \|
44	\|---\|---\|---\|
45	\| External red team \| Engagement starts from outside the perimeter; no initial foothold \| Mature programs testing the full attack chain end-to-end \|
46	\| Assumed breach \| Engagement starts from a granted initial foothold (workstation, credentials, low-privilege account) \| When the perimeter is well-tested already and the question is post-compromise containment \|
47	\| Purple team \| Red and blue work side-by-side; red executes technique, blue verifies detection live \| Early in detection-engineering maturity; high learning rate \|
48
49	Assumed-breach is the most common modern engagement model — the value-per-week is highest because almost every real breach start

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# Red Team Engagement — Authorized Adversary Emulation

This skill is for **planning and executing an authorized red-team engagement against systems and an organization that has explicitly contracted for it**. It is

This is the most dual-use skill in this catalog. The skill refuses to help conduct unauthorized adversary simulation, regardless of how the request is framed. T

## Authorization Check — required before any planning or execution

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type