Skills red-team-tactics
📦
red-team-tactics
Content revision r1 Medium Risk ⚙️ External commands
Plan Authorized Red Team Exercises
Security teams need a clear structure for adversary simulation and reporting. This skill organizes MITRE ATT&CK concepts into planning, detection review, and report guidance.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "red-team-tactics" from https://skillstore.io/skills/sickn33-red-team-tactics.md and its manifest at https://skillstore.io/api/skills/sickn33-red-team-tactics/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "red-team-tactics". Explain the attack lifecycle for a security awareness session.
Expected outcome:
- The lifecycle starts with reconnaissance and initial access.
- Later phases focus on execution, privilege escalation, discovery, and movement.
- A defensive review should map each phase to expected controls and alerts.
Using "red-team-tactics". Create a report outline for an approved red team exercise.
Expected outcome:
- Executive summary with scope and safety limits.
- Attack narrative with observed detection gaps.
- Remediation plan with owners, priorities, and validation steps.
Using "red-team-tactics". Review detection coverage for simulated credential attacks.
Expected outcome:
- List the credential scenarios that were approved for testing.
- Compare expected alerts with observed evidence.
- Recommend control improvements and retest criteria.
Security Audit
Medium Riskv4 • 7/7/2026 Open versioned report
The apparent external command finding is a false positive caused by a Markdown code fence. The skill is prose-only, but it contains dual-use red team guidance around evasion, credential abuse, lateral movement, and Active Directory attack concepts.
1
Files scanned
200
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (4)
Medium
Defense Evasion Guidance
The skill lists evasion techniques such as LOLBins, obfuscation, timestomping, log clearing, encrypted channels, and blending with normal behavior.
The cited section directly names multiple evasion methods and operational security behaviors. The guidance is conceptual, so confidence is high but not maximal.
Medium
Credential Abuse And Lateral Movement Guidance
The skill describes credential types, pass-the-hash, pass-the-ticket, remote services, DCSync, and Golden Ticket concepts for movement and domain compromise.
The cited sections clearly describe credential-based movement and Active Directory attack categories. The content does not include commands or payloads, which limits severity.
Low
System reconnaissance
| **Defense Evasion** | Avoid detection |
The cited phase objective explicitly says defense evasion should avoid detection. It is high-level prose, but the intent can support unsafe tradecraft.
Low
System reconnaissance
| **Valid credentials** | Leaked or cracked |
The cited table lists leaked or cracked credentials as an initial access vector. It is not procedural, but it still frames credential misuse as an attack path.
Risk Factors
⚙️ External commands (1)
Detected Patterns
System reconnaissance×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-red-team-tactics/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-red-team-tactics?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-red-team-tactics?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-red-team-tactics/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-red-team-tactics.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). red-team-tactics security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-red-team-tactics/audits/4BibTeX citation
@techreport{sickn33-sickn33-red-team-tactics-2026,
author = {sickn33},
title = {red-team-tactics security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-red-team-tactics/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "red-team-tactics security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-red-team-tactics/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-red-team-tactics:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Exercise Planning
Create a high-level plan for an authorized adversary simulation with clear phases and objectives.
Detection Review
Map simulated techniques to expected alerts, control gaps, and follow-up improvements.
Report Structuring
Organize red team findings into an attack narrative, detection analysis, and practical remediation.
Try These Prompts
Explain The Lifecycle
Explain the MITRE ATT&CK attack lifecycle in simple terms for an authorized red team training session.
Draft A Scoped Plan
Create a high-level red team exercise outline for this approved scope: [scope]. Include phases, objectives, safety limits, and reporting needs.
Map Detection Gaps
Map these simulated techniques to expected detections and likely control gaps: [techniques]. Focus on defensive validation and improvement.
Review A Final Report
Review this red team report draft for clear attack narrative, detection gaps, remediation quality, scope control, and ethical boundaries: [report].
Best Practices
- Confirm authorization, scope, and safety limits before using the skill.
- Frame each technique as a defensive validation objective.
- Document actions, detections, impact, and remediation evidence.
Avoid
- Using the skill for unapproved systems or accounts.
- Treating high-level concepts as permission to perform intrusive testing.
- Reporting attack steps without detection gaps and remediation guidance.
Frequently Asked Questions
Is this skill for authorized security work only?
Yes. It should only be used within written scope and approved security testing rules.
Does it include exploit code or payloads?
No. The skill provides high-level concepts, planning structure, and reporting guidance.
Can detection engineers use it?
Yes. It can help map simulated techniques to alerts, controls, and detection gaps.
Does it replace MITRE ATT&CK documentation?
No. It summarizes common concepts and should be checked against current MITRE ATT&CK references.
Can it help write a red team report?
Yes. It outlines attack narrative, detection gap, and remediation sections.
What should users avoid?
Users should avoid unapproved testing, sensitive data retention, production damage, and out-of-scope access.