# mantvydasb/redteaming-tactics-and-techniques

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/mantvydasb-redteaming-tactics-and-techniques).**

4,620 stars · 1,133 forks · PowerShell

## Links

- GitHub: https://github.com/mantvydasb/RedTeaming-Tactics-and-Techniques
- Homepage: http://ired.team
- awesome-repositories: https://awesome-repositories.com/repository/mantvydasb-redteaming-tactics-and-techniques.md

## Topics

`offensive-security` `oscp` `pentesting` `redteam` `redteam-infrastructure` `redteaming`

## Description

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations.

The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory.

The capability surface extends to network penetration testing, malware analysis and engineering, and the deployment of offensive security infrastructure. It also includes methods for lateral movement, persistence, and data exfiltration across enterprise environments.

## Tags

### Part of an Awesome List

- [Active Directory Exploitation](https://awesome-repositories.com/f/awesome-lists/security/active-directory-exploitation.md) — Offers detailed instructions for exploiting Kerberos, escalating domain privileges, and enumerating identity within Active Directory.
- [Windows Internals Research](https://awesome-repositories.com/f/awesome-lists/devtools/windows-internals-research.md) — Explains Windows kernel and system-level structures to help understand how attackers interact with the OS. ([source](https://ired.team/))
- [Security Exploit Documentation](https://awesome-repositories.com/f/awesome-lists/devtools/windows-internals-research/security-exploit-documentation.md) — Provides technical documentation on manipulating kernel objects and bypassing antivirus for exploit development.
- [Red Team and Offensive Security](https://awesome-repositories.com/f/awesome-lists/learning/red-team-and-offensive-security.md) — Serves as a comprehensive knowledge base of offensive security tactics and technical guides for simulating adversary behavior.
- [Data Exfiltration](https://awesome-repositories.com/f/awesome-lists/security/data-exfiltration.md) — Details methods and tools for moving sensitive data out of a compromised network. ([source](http://ired.team/offensive-security-experiments/offensive-security-cheetsheets))
- [Domain Privilege Escalation](https://awesome-repositories.com/f/awesome-lists/security/domain-privilege-escalation.md) — Leverages misconfigured ACLs and certificate templates to escalate privileges to Enterprise Admin. ([source](http://ired.team/offensive-security-experiments/active-directory-kerberos-abuse))
- [Exploitation and Malware](https://awesome-repositories.com/f/awesome-lists/security/exploitation-and-malware.md) — Provides detailed analysis of how malware utilizes Windows internals and APIs for execution and evasion. ([source](http://ired.team))
- [Lateral Movement](https://awesome-repositories.com/f/awesome-lists/security/lateral-movement.md) — Moves across networks using administrative protocols and session hijacking to access remote systems. ([source](http://ired.team/offensive-security/lateral-movement))
- [Penetration Testing](https://awesome-repositories.com/f/awesome-lists/security/penetration-testing.md) — Implements comprehensive tactics for reconnaissance, lateral movement, and data exfiltration within networked environments.
- [Red Teaming Tools](https://awesome-repositories.com/f/awesome-lists/security/red-teaming-tools.md) — Provides guidance on deploying and managing the infrastructure required for red team operations. ([source](http://ired.team/offensive-security/red-team-infrastructure))
- [PE File Utilities](https://awesome-repositories.com/f/awesome-lists/devtools/pe-file-utilities.md) — Describes how to modify Portable Executable structures to inject binaries and backdoor executable files. ([source](http://ired.team/offensive-security/code-injection-process-injection))
- [System Object Enumeration](https://awesome-repositories.com/f/awesome-lists/security/local-system-enumeration-toolsets/kernel-object-enumerations/system-object-enumeration.md) — Identifies COM objects and scheduled tasks using stealthy methods to avoid command-line logging. ([source](http://ired.team/offensive-security/enumeration-and-discovery))
- [Credential Cracking](https://awesome-repositories.com/f/awesome-lists/security/password-cracking/credential-auditing/credential-cracking.md) — Details the use of brute-force and dictionary attacks to recover plaintext passwords from hashes. ([source](http://ired.team/offensive-security-experiments/offensive-security-cheetsheets))
- [Password Spraying Tools](https://awesome-repositories.com/f/awesome-lists/security/password-spraying-tools.md) — Automates the testing of common passwords across multiple accounts to gain unauthorized access. ([source](http://ired.team/offensive-security/initial-access))
- [Reconnaissance and OSINT](https://awesome-repositories.com/f/awesome-lists/security/reconnaissance-and-osint.md) — Provides methods for gathering open-source intelligence to map an organization's external attack surface. ([source](http://ired.team/offensive-security/red-team-infrastructure))

### Security & Cryptography

- [Red Teaming Frameworks](https://awesome-repositories.com/f/security-cryptography/red-teaming-frameworks.md) — Implements a comprehensive collection of red teaming primitives and adversary simulation techniques. ([source](http://ired.team))
- [Offensive Security Cheatsheets](https://awesome-repositories.com/f/security-cryptography/security/offensive-operations/penetration-testing-ethical-hacking/offensive-security-cheatsheets.md) — Serves as a comprehensive reference of practical techniques for simulating adversary behavior and executing offensive operations. ([source](https://ired.team/))
- [Persistence Mechanisms](https://awesome-repositories.com/f/security-cryptography/access-control-systems/persistence-mechanisms.md) — Provides techniques for ensuring continued system access after reboots via backdoors and scheduled tasks. ([source](http://ired.team/offensive-security/persistence))
- [Active Directory Enumeration](https://awesome-repositories.com/f/security-cryptography/active-directory-enumeration.md) — Maps users, groups, and permissions within Active Directory to identify attack paths and misconfigurations. ([source](http://ired.team/offensive-security-experiments/active-directory-kerberos-abuse))
- [Antivirus Detection Bypasses](https://awesome-repositories.com/f/security-cryptography/antivirus-detection-bypasses.md) — Uses API unhooking and direct syscalls to avoid detection by antivirus and security software. ([source](http://ired.team/offensive-security/defense-evasion))
- [Cached Credential Extractions](https://awesome-repositories.com/f/security-cryptography/cached-credential-extractions.md) — Provides methods to extract and decrypt cached domain credentials to facilitate lateral movement. ([source](http://ired.team/offensive-security/credential-access-and-credential-dumping))
- [Command and Control Frameworks](https://awesome-repositories.com/f/security-cryptography/command-and-control-frameworks.md) — Guides the use of platforms for managing remote agents and orchestrating adversary simulation tasks. ([source](http://ired.team/offensive-security/red-team-infrastructure))
- [Shellcode](https://awesome-repositories.com/f/security-cryptography/data-encryption/encrypted-persistence/object-store-encryption/payload-encryptions/shellcode.md) — Details the use of custom encoders and AES-CBC encryption to hide shellcode signatures from security software. ([source](http://ired.team/offensive-security/code-injection-process-injection))
- [Defense Evasion](https://awesome-repositories.com/f/security-cryptography/defense-evasion.md) — Details methods for bypassing antivirus and system monitoring through API unhooking and payload obfuscation.
- [Domain Persistence Techniques](https://awesome-repositories.com/f/security-cryptography/domain-persistence-techniques.md) — Establishes long-term domain access by backdooring sensitive Active Directory objects like AdminSDHolder. ([source](http://ired.team/offensive-security-experiments/active-directory-kerberos-abuse))
- [Active Directory Credential Extraction](https://awesome-repositories.com/f/security-cryptography/encryption-key-management/account-credential-management/active-directory-credential-extraction.md) — Implements Kerberoasting and AS-REP Roasting techniques to recover service account password hashes. ([source](http://ired.team/offensive-security-experiments/active-directory-kerberos-abuse))
- [Kerberos Ticket Forgers](https://awesome-repositories.com/f/security-cryptography/kerberos-authentication/kerberos-ticket-forgers.md) — Ships tools and guides for creating forged Golden and Silver Kerberos tickets for domain impersonation. ([source](http://ired.team/offensive-security-experiments/active-directory-kerberos-abuse))
- [Malware Analysis](https://awesome-repositories.com/f/security-cryptography/malware-analysis.md) — Provides detailed guides for studying malware behavior and developing custom shellcode to interact with operating system internals.
- [Capability Analyzers](https://awesome-repositories.com/f/security-cryptography/malware-analysis/capability-analyzers.md) — Provides tools to analyze malware binaries and catalog capabilities such as data exfiltration and anti-analysis techniques. ([source](https://ired.team/))
- [Memory Injection Techniques](https://awesome-repositories.com/f/security-cryptography/memory-injection-techniques.md) — Provides techniques for executing code directly in memory to bypass disk-based security controls. ([source](http://ired.team/offensive-security/defense-evasion))
- [Domain Hash Exfiltration](https://awesome-repositories.com/f/security-cryptography/password-hash-recovery/domain-hash-exfiltration.md) — Provides instructions for performing DCSync attacks to dump password hashes from Domain Controllers. ([source](http://ired.team/offensive-security-experiments/active-directory-kerberos-abuse))
- [Payload Obfuscators](https://awesome-repositories.com/f/security-cryptography/payload-obfuscation/executable-obfuscators/payload-obfuscators.md) — Provides techniques to mask payloads and obfuscate command-line execution to evade antivirus and EDR detection. ([source](http://ired.team/offensive-security/defense-evasion))
- [Kernel Privilege Escalations](https://awesome-repositories.com/f/security-cryptography/privilege-escalation-techniques/kernel-privilege-escalations.md) — Exploits kernel vulnerabilities to elevate permissions from a low-privileged user to root access. ([source](http://ired.team/offensive-security-experiments/offensive-security-cheetsheets))
- [Windows Privilege Escalations](https://awesome-repositories.com/f/security-cryptography/privilege-escalation-techniques/windows-privilege-escalations.md) — Executes DLL hijacking and token manipulation to elevate process privileges on Windows systems. ([source](http://ired.team/offensive-security/privilege-escalation))
- [Remote Code Execution Tools](https://awesome-repositories.com/f/security-cryptography/remote-code-execution-tools.md) — Provides tools and methods for achieving and managing arbitrary code execution on remote target systems. ([source](http://ired.team/offensive-security-experiments/offensive-security-cheetsheets))
- [Offensive Security Playbooks](https://awesome-repositories.com/f/security-cryptography/security/offensive-operations/penetration-testing-ethical-hacking/offensive-security-playbooks.md) — Ships a practical playbook of techniques for lateral movement and persistence across enterprise networks.
- [Adversary Artifact Analyses](https://awesome-repositories.com/f/security-cryptography/adversary-artifact-analyses.md) — Identifies forensic traces and footprints left on endpoints by specific attacking tools and malware techniques. ([source](http://ired.team))
- [Anti-Forensic Metadata Manipulations](https://awesome-repositories.com/f/security-cryptography/anti-forensic-metadata-manipulations.md) — Implements techniques to hide data and mislead forensics by manipulating file timestamps and alternate streams. ([source](http://ired.team/offensive-security/defense-evasion))
- [SMB Hash Captures](https://awesome-repositories.com/f/security-cryptography/authentication-hash-capture/smb-hash-captures.md) — Describes how to force target systems to send NetNTLMv2 hashes via rogue SMB servers. ([source](http://ired.team/offensive-security/initial-access))
- [Directory Reconnaissance](https://awesome-repositories.com/f/security-cryptography/directory-reconnaissance.md) — Dumps the Global Address List from Outlook Web Access to map organizational structures. ([source](http://ired.team/offensive-security/enumeration-and-discovery))
- [Living Off The Land Binaries](https://awesome-repositories.com/f/security-cryptography/living-off-the-land-binaries.md) — Uses signed system binaries to execute arbitrary code and bypass execution restrictions. ([source](http://ired.team/offensive-security/code-execution))
- [Network Identity Discovery](https://awesome-repositories.com/f/security-cryptography/network-identity-discovery.md) — Implements methods to discover hostnames and domain information using COM objects and RPC clients. ([source](http://ired.team/offensive-security/enumeration-and-discovery))
- [Password Routine Analyses](https://awesome-repositories.com/f/security-cryptography/password-routine-analyses.md) — Identifies password verification logic by observing register changes and execution flow during runtime debugging. ([source](http://ired.team/miscellaneous-reversing-forensics/reversing-password-checking-routine))
- [DNS Payload Delivery](https://awesome-repositories.com/f/security-cryptography/payload-encoders/dns-payload-delivery.md) — Implements methods for transferring and executing malicious code using DNS records. ([source](http://ired.team/offensive-security/exfiltration))
- [PowerShell Language Mode Bypasses](https://awesome-repositories.com/f/security-cryptography/remote-script-execution/powershell-language-mode-bypasses.md) — Provides techniques for bypassing PowerShell language mode constraints to execute restricted scripts. ([source](http://ired.team/offensive-security/code-execution))
- [File-Based Execution Bypasses](https://awesome-repositories.com/f/security-cryptography/security/offensive-operations/vulnerability-research-analysis/injection-exploitation-techniques/filter-bypasses/file-based-execution-bypasses.md) — Implements file-based execution bypasses to run unauthorized code by leveraging legitimate system tools. ([source](http://ired.team/offensive-security/code-execution))
- [Infrastructure Provisioning](https://awesome-repositories.com/f/security-cryptography/security/utilities/security-tools/offensive-red-team/offensive-security-frameworks/infrastructure-provisioning.md) — Provides instructions for automating the deployment of offensive security servers and proxy infrastructure.
- [Phishing Attack Tools](https://awesome-repositories.com/f/security-cryptography/security/utilities/security-tools/offensive-red-team/phishing-attack-tools.md) — Includes tools and guides for simulating phishing campaigns to trick users into executing payloads. ([source](http://ired.team/offensive-security/initial-access))
- [Credential Interception](https://awesome-repositories.com/f/security-cryptography/session-cookie-handlers/session-cookie-persistences/credential-interception.md) — Provides methods for capturing plaintext passwords during authentication by hooking system functions. ([source](http://ired.team/offensive-security/credential-access-and-credential-dumping))
- [PE Header Parsing](https://awesome-repositories.com/f/security-cryptography/windows-pe-memory-analyzers/pe-header-parsing.md) — Analyzes PE headers and memory execution flows to identify injected threads and payloads. ([source](http://ired.team/miscellaneous-reversing-forensics/windows-kernel-internals))
- [PE Header Injections](https://awesome-repositories.com/f/security-cryptography/windows-pe-memory-analyzers/pe-header-parsing/pe-header-injections.md) — Provides methods for inserting malicious code into legitimate binaries by modifying the Portable Executable header.

### Education & Learning Resources

- [Kernel Internals Tutorials](https://awesome-repositories.com/f/education-learning-resources/operating-system-tutorials/kernel-internals-tutorials.md) — Provides technical tutorials and research on kernel internals, memory management, and system call handling. ([source](http://ired.team/miscellaneous-reversing-forensics/windows-kernel-internals))

### Networking & Communication

- [Network Pivoting Tools](https://awesome-repositories.com/f/networking-communication/network-pivoting-tools.md) — Ships techniques for using compromised systems as relays to access internal network resources. ([source](http://ired.team/offensive-security-experiments/offensive-security-cheetsheets))
- [Service Enumeration Tools](https://awesome-repositories.com/f/networking-communication/service-enumeration-tools.md) — Uses scanning tools to identify active hosts and open ports to discover running network services. ([source](http://ired.team/offensive-security-experiments/offensive-security-cheetsheets))
- [Reverse Proxy Interceptors](https://awesome-repositories.com/f/networking-communication/traffic-interception/reverse-proxy-interceptors.md) — Uses reverse proxy interceptors to capture authentication tokens by intercepting real-time HTTP traffic.
- [Phishing Proxies](https://awesome-repositories.com/f/networking-communication/transparent-proxies/phishing-proxies.md) — Ships techniques for using reverse proxies to intercept real-time traffic for credential harvesting. ([source](http://ired.team/offensive-security/red-team-infrastructure))

### Operating Systems & Systems Programming

- [Credential Memory Dumping](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-memory-dumping/structured-memory-dumping/credential-memory-dumping.md) — Provides methods for extracting plaintext passwords and hashes directly from active process memory. ([source](http://ired.team/offensive-security/credential-access-and-credential-dumping))
- [Direct System Call Invocations](https://awesome-repositories.com/f/operating-systems-systems-programming/direct-system-call-invocations.md) — Implements direct system call invocations to bypass user-mode API hooks and security monitoring software.
- [Offensive Kernel Drivers](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-driver-implementation/offensive-kernel-drivers.md) — Provides technical guides for developing kernel drivers to manipulate system internals and execute exploits. ([source](http://ired.team/miscellaneous-reversing-forensics/windows-kernel-internals))
- [Kernel Object Manipulations](https://awesome-repositories.com/f/operating-systems-systems-programming/privileged-kernel-operations/kernel-object-manipulations.md) — Provides techniques for modifying kernel objects to hide malicious processes and elevate system privileges.
- [Process Space Injection](https://awesome-repositories.com/f/operating-systems-systems-programming/process-space-injection.md) — Implements mechanisms for loading DLLs into remote process address spaces via thread hijacking or hollowing. ([source](http://ired.team/offensive-security/code-injection-process-injection))
- [Service Boot Persistence](https://awesome-repositories.com/f/operating-systems-systems-programming/service-boot-persistence.md) — Implements persistence mechanisms by creating malicious services that automatically start during system boot. ([source](http://ired.team/offensive-security-experiments/offensive-security-cheetsheets))
- [System-Call Interception](https://awesome-repositories.com/f/operating-systems-systems-programming/system-call-interception.md) — Implements IAT hooking to monitor and redirect system function calls for behavioral alteration. ([source](http://ired.team/offensive-security/code-injection-process-injection))
- [Executable Header Injections](https://awesome-repositories.com/f/operating-systems-systems-programming/executable-header-reconstruction/executable-header-injections.md) — Implements code injection by modifying the structural metadata of the executable file format.

### Software Engineering & Architecture

- [Kerberos Delegation Exploitation Techniques](https://awesome-repositories.com/f/software-engineering-architecture/account-delegation-strategies/entity-delegations/moderation-delegation/kerberos-delegation-exploitation-techniques.md) — Provides detailed techniques for exploiting Kerberos constrained and unconstrained delegation to impersonate privileged users. ([source](http://ired.team/offensive-security-experiments/active-directory-kerberos-abuse))
- [Shellcode Execution via Fibers](https://awesome-repositories.com/f/software-engineering-architecture/concurrent-task-execution/fiber-based-concurrent-execution/shellcode-execution-via-fibers.md) — Implements fiber-based execution to run shellcode within local processes and evade API monitoring. ([source](http://ired.team/offensive-security/code-injection-process-injection))
- [Import Address Table Overwrites](https://awesome-repositories.com/f/software-engineering-architecture/reference-management/symbolic-reference-tracing/symbol-to-address-mapping/pe-export-table-resolvers/import-address-table-overwrites.md) — Implements Import Address Table overwrites to redirect function calls to custom detour routines.

### System Administration & Monitoring

- [Monitoring Evasion](https://awesome-repositories.com/f/system-administration-monitoring/security-event-monitoring/monitoring-evasion.md) — Disables event logging and spoofs process identities to conceal activity from security defenders. ([source](http://ired.team/offensive-security/defense-evasion))
- [Detection Evasion](https://awesome-repositories.com/f/system-administration-monitoring/security-monitoring/detection-evasion.md) — Includes tactics for identifying security monitoring tools to maintain operational stealth on target hosts. ([source](http://ired.team/offensive-security/enumeration-and-discovery))
- [Raw Registry Hive Parsing](https://awesome-repositories.com/f/system-administration-monitoring/system-registry-managers/raw-registry-hive-parsing.md) — Details the process of parsing raw registry hives to extract SAM hashes and LSA secrets. ([source](http://ired.team/offensive-security/credential-access-and-credential-dumping))