红队战术指南：基于MITRE ATT&CK框架的对手模拟与渗透测试技能

red-team-tactics by sickn33/antigravity-awesome-skills

329 周安装量

27,100 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill red-team-tactics

方法论测试安全

🇨🇳中文介绍

红队战术

基于 MITRE ATT&CK 框架的对手模拟原则。

1. MITRE ATT&CK 阶段

攻击生命周期

RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
       ↓              ↓              ↓            ↓
   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
       ↓              ↓              ↓            ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT

阶段目标

阶段	目标
侦察	绘制攻击面
初始访问	获取首个立足点
执行	在目标上运行代码
持久化	在重启后存活
权限提升	获取管理员/root权限

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

类型	权衡
被动	不接触目标，信息有限
主动	直接接触，检测风险更高

类别	价值
技术栈	攻击向量选择
员工信息	社会工程学
网络范围	扫描范围
第三方	供应链攻击

3. 初始访问向量

向量	使用时机
钓鱼攻击	针对人员，有邮件访问权限
公开漏洞利用	暴露了易受攻击的服务
有效凭证	泄露或破解的凭证
供应链	第三方访问

4. 权限提升原则

检查项	机会
未加引号的服务路径	写入路径
弱服务权限	修改服务
令牌权限	滥用 SeDebug 等
存储的凭证	收集

检查项	机会
SUID 二进制文件	以所有者身份执行
Sudo 配置错误	命令执行
内核漏洞	内核漏洞利用
Cron 任务	可写脚本

5. 防御规避原则

技术	目的
LOLBins	使用合法工具
混淆	隐藏恶意代码
时间戳篡改	隐藏文件修改
日志清除	移除证据

在业务时间内工作
模仿合法流量模式
使用加密通道
与正常行为融合

6. 横向移动原则

类型	用途
密码	标准认证
哈希	哈希传递
票据	票据传递
证书	证书认证

管理共享
远程服务 (RDP, SSH, WinRM)
利用内部服务

7. Active Directory 攻击

攻击	目标
Kerberoasting	服务账户密码
AS-REP Roasting	无需预认证的账户
DCSync	域凭证
黄金票据	持久域访问

记录完整的攻击链：

如何获得初始访问权限
使用了哪些技术
实现了哪些目标
检测在何处失效

针对每个成功的技术：

本应如何检测到它？
为什么检测没有生效？
如何改进检测？

保持在授权范围内
最小化影响
如果发现真实威胁立即报告
记录所有操作

破坏生产数据
造成拒绝服务（除非在授权范围内）
超出概念验证的访问
保留敏感数据

❌ 不要	✅ 要做
急于利用漏洞	遵循方法论
造成损害	最小化影响
跳过报告	记录一切
忽视范围	保持在边界内

记住： 红队模拟攻击者是为了改进防御，而不是造成伤害。

此技能适用于执行概述中描述的工作流程或操作。

🇺🇸English

Red Team Tactics

Adversary simulation principles based on MITRE ATT&CK framework.

1. MITRE ATT&CK Phases

Attack Lifecycle

RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
       ↓              ↓              ↓            ↓
   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
       ↓              ↓              ↓            ↓
LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT

Phase Objectives

Phase	Objective
Recon	Map attack surface
Initial Access	Get first foothold
Execution	Run code on target
Persistence	Survive reboots
Privilege Escalation	Get admin/root
Defense Evasion	Avoid detection
Credential Access	Harvest credentials
Discovery	Map internal network
Lateral Movement	Spread to other systems
Collection	Gather target data
C2	Maintain command channel
Exfiltration	Extract data

2. Reconnaissance Principles

Passive vs Active

Type	Trade-off
Passive	No target contact, limited info
Active	Direct contact, more detection risk

Information Targets

Category	Value
Technology stack	Attack vector selection
Employee info	Social engineering
Network ranges	Scanning scope
Third parties	Supply chain attack

3. Initial Access Vectors

Selection Criteria

Vector	When to Use
Phishing	Human target, email access
Public exploits	Vulnerable services exposed
Valid credentials	Leaked or cracked
Supply chain	Third-party access

4. Privilege Escalation Principles

Windows Targets

Check	Opportunity
Unquoted service paths	Write to path
Weak service permissions	Modify service
Token privileges	Abuse SeDebug, etc.
Stored credentials	Harvest

Linux Targets

Check	Opportunity
SUID binaries	Execute as owner
Sudo misconfiguration	Command execution
Kernel vulnerabilities	Kernel exploits
Cron jobs	Writable scripts

5. Defense Evasion Principles

Key Techniques

Technique	Purpose
LOLBins	Use legitimate tools
Obfuscation	Hide malicious code
Timestomping	Hide file modifications
Log clearing	Remove evidence

Operational Security

Work during business hours
Mimic legitimate traffic patterns
Use encrypted channels
Blend with normal behavior

6. Lateral Movement Principles

Credential Types

Type	Use
Password	Standard auth
Hash	Pass-the-hash
Ticket	Pass-the-ticket
Certificate	Certificate auth

Movement Paths

Admin shares
Remote services (RDP, SSH, WinRM)
Exploitation of internal services

7. Active Directory Attacks

Attack Categories

Attack	Target
Kerberoasting	Service account passwords
AS-REP Roasting	Accounts without pre-auth
DCSync	Domain credentials
Golden Ticket	Persistent domain access

8. Reporting Principles

Attack Narrative

Document the full attack chain:

How initial access was gained
What techniques were used
What objectives were achieved
Where detection failed

Detection Gaps

For each successful technique:

What should have detected it?
Why didn't detection work?
How to improve detection

9. Ethical Boundaries

Always

Stay within scope
Minimize impact
Report immediately if real threat found
Document all actions

Never

Destroy production data
Cause denial of service (unless scoped)
Access beyond proof of concept
Retain sensitive data

10. Anti-Patterns

❌ Don't	✅ Do
Rush to exploitation	Follow methodology
Cause damage	Minimize impact
Skip reporting	Document everything
Ignore scope	Stay within boundaries

Remember: Red team simulates attackers to improve defenses, not to cause harm.

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

Weekly Installs

329

Repository

sickn33/antigra…e-skills

GitHub Stars

27.1K

First Seen

Jan 20, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykFail

Installed on

opencode261

gemini-cli256

claude-code235

cursor228

codex224

github-copilot203

OpenClaw 安全 Linux 云部署指南：私有优先、SSH隧道、Podman容器化

19,500 周安装

红队战术指南：基于MITRE ATT&CK框架的对手模拟与渗透测试技能

🇨🇳中文介绍

红队战术

1. MITRE ATT&CK 阶段

攻击生命周期

阶段目标

相关 Skills

2. 侦察原则

被动与主动

信息目标

3. 初始访问向量

选择标准