Red Team & Threat Intelligence

Prerequisites

Written Rules of Engagement (ROE) document signed by target organization
Defined scope: IP ranges, domains, user accounts, physical locations (if applicable)
Claude API key configured (Settings → AI Configuration)
Target environment type confirmed (Lab / Pre-Production / Production)
MITRE ATT&CK tactics approved for engagement (agreed with client)
Out-of-scope systems explicitly listed to prevent accidental impact
Org Profile configured with target tech stack for threat intelligence matching

1

Select Red Team from Home Screen

Click the 🎯 Red Team card on the Home Screen. Choose your campaign type from the selection panel:

Campaign Types: Full Red Team → End-to-end adversary simulation: initial access through exfiltration, all MITRE ATT&CK tactics, goal-based objectives Purple Team → Collaborative red/blue exercise: attack executes while defenders monitor, detection gap analysis, joint debrief Assumed Breach → Skip initial access: start from inside the network with domain credentials, test lateral movement + escalation Phishing Campaign → Social engineering: email phishing, credential harvesting, payload delivery, user awareness measurement Physical + Social → Physical security assessment: badge cloning, tailgating, USB drop, pretexting, dumpster diving (requires on-site ROE)

Each campaign type pre-configures the MITRE ATT&CK tactics, tools, and reporting templates appropriate for that engagement style.
2

Configure Adversary Profile

Select the threat actor profile that matches your engagement objectives. PhantomYerra emulates real-world adversary TTPs mapped to MITRE ATT&CK.

MITRE ATT&CK Tactics Selection (14 tactics): TA0043 Reconnaissance TA0042 Resource Development TA0001 Initial Access TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation TA0005 Defense Evasion TA0006 Credential Access TA0007 Discovery TA0008 Lateral Movement TA0009 Collection TA0011 Command and Control TA0010 Exfiltration TA0040 Impact Threat Actor Emulation Profiles: APT29 (Cozy Bear) → Russia / SolarWinds-style supply chain, stealthy C2 APT28 (Fancy Bear) → Russia / spearphishing, credential theft, VPN exploits Lazarus Group → North Korea / financial theft, destructive wiper payloads FIN7 (Carbanak) → Financial crime / POS malware, social engineering APT41 (Winnti) → China / dual espionage + financial, supply chain backdoors Sandworm → Russia / destructive OT/ICS attacks, NotPetya-style Scattered Spider → Social engineering, MFA fatigue, identity provider attacks Custom Profile → Define your own TTP selection from the full ATT&CK matrix
3

Define Target Environment

Configure the scope boundaries, rules of engagement, and approved techniques for the campaign.

Scope Configuration: IP Ranges → 10.0.0.0/8, 192.168.1.0/24, specific host IPs Domains → corp.target.com, *.internal.target.com User Accounts → test accounts for credential attacks (if approved) Cloud Tenants → AWS account ID, Azure tenant, GCP project (if in scope) Rules of Engagement: Approved TTPs → Check/uncheck each MITRE technique individually Out-of-Scope Systems → List IPs/hostnames that must never be touched Time Windows → Business hours only / after hours / 24x7 Notification Rules → Alert blue team on critical impact / silent operation Data Handling → No real data exfil / simulated exfil / hash-only proof Escalation Contact → Emergency phone number for accidental impact
4

Complete Mission Control Wizard with Red Team Settings

The wizard collects final configuration before campaign launch:

Wizard Steps for Red Team: Step 1: Environment → Lab / Pre-Production / Production Step 2: Mode → Automated AI (Claude drives the full campaign) Step 3: Campaign Type → Full Red Team / Purple Team / Assumed Breach / etc. Step 4: Adversary → Select threat actor profile or custom TTP set Step 5: Scope → IP ranges, domains, users, cloud tenants Step 6: ROE Upload → Attach signed Rules of Engagement document Step 7: Objectives → Define campaign goals (Domain Admin, data exfil, etc.) Step 8: Review + Launch→ Confirm full plan, set campaign duration, launch
5

AI Executes Campaign — 8-Phase Kill Chain

Claude autonomously executes the red team campaign through all approved MITRE ATT&CK phases. Each phase adapts based on findings from previous phases.

Phase 1 — Initial Access: → Spearphishing emails with custom payloads (T1566) → Exploit public-facing applications (T1190) → Valid account discovery via OSINT (T1078) → Supply chain compromise simulation (T1195) Phase 2 — Execution: → PowerShell/cmd payload execution (T1059) → Scheduled task creation (T1053) → WMI/DCOM remote execution (T1047) Phase 3 — Persistence: → Registry run keys, startup folder (T1547) → Scheduled tasks for callback (T1053) → DLL hijacking / search order abuse (T1574) → Web shell deployment (T1505.003) Phase 4 — Privilege Escalation: → Token impersonation (T1134) → Kerberoasting / AS-REP roasting (T1558) → Unquoted service paths (T1574.009) → UAC bypass techniques (T1548.002) Phase 5 — Defense Evasion: → AMSI bypass, ETW patching (T1562) → Process injection (T1055) → Timestomping, log clearing (T1070) → Living-off-the-land binaries (T1218) Phase 6 — Credential Access: → LSASS memory dump (T1003.001) → SAM database extraction (T1003.002) → DCSync attack (T1003.006) → Kerberos ticket harvesting (T1558) Phase 7 — Lateral Movement: → PsExec / SMB file copy (T1021.002) → WinRM / PowerShell remoting (T1021.006) → RDP hijacking (T1563.002) → Pass-the-Hash / Pass-the-Ticket (T1550) Phase 8 — Exfiltration: → Data staging and compression (T1074) → Exfiltration over C2 channel (T1041) → Exfiltration over alternative protocol (T1048) → Simulated data theft with hash-only proof
6

Monitor Campaign Dashboard

The Campaign Dashboard provides real-time visibility into the active red team operation.

Dashboard Panels: Kill Chain Progress → Visual MITRE ATT&CK matrix with completed techniques highlighted green (successful) or red (detected/blocked) Detection Status → Each technique marked: Evaded / Detected / Blocked Dwell Time Tracker → Time from initial access to detection (if detected) MITRE ATT&CK Map → Interactive heat map of all techniques attempted Attack Graph → Node graph showing the full attack path from entry to objective, with every pivot and escalation step Activity Feed → Chronological log of every action taken by Claude Objective Tracker → Progress toward campaign goals (Domain Admin: 72%)
7

Generate Red Team Report

Click Reports → Red Team Report to generate the full campaign deliverable.

Report Sections: Executive Summary → Business-impact narrative for C-level audience Kill Chain Narrative → Story-form walkthrough of the entire attack path MITRE ATT&CK Coverage → Matrix showing tested vs. detected vs. evaded techniques Detection Gap Analysis → Techniques that succeeded without triggering any alert Findings by Severity → Each finding with evidence, PoC steps, CVSS score Attack Path Diagram → Visual graph from initial access to objective Dwell Time Analysis → Time-to-detect metrics per phase Remediation Roadmap → Prioritized fix list: critical detections gaps first Appendix: Raw Evidence → Full HTTP captures, terminal output, screenshots

What Claude Tests (Red Team Campaign)

Initial Access: phishing payload delivery, exploit public apps, valid account reuse, drive-by compromise
Execution: PowerShell, cmd, WMI, DCOM, scheduled tasks, scripting engines
Persistence: registry keys, startup items, DLL hijacking, web shells, implant callbacks
Privilege Escalation: Kerberoasting, token impersonation, UAC bypass, unquoted paths, kernel exploits
Defense Evasion: AMSI bypass, process injection, timestomping, LOLBAS, obfuscation
Credential Access: LSASS dump, SAM extraction, DCSync, Kerberos ticket theft, credential spraying
Lateral Movement: PsExec, WinRM, RDP, SMB, Pass-the-Hash, Pass-the-Ticket
Collection & Exfiltration: data staging, compression, C2 channel exfil, DNS tunneling

⏱️ Campaign duration: 1–5 days for Full Red Team. Assumed Breach: 4–16 hours. Purple Team: 1–3 days. Phishing Campaign: 2–7 days (includes user response window).

CVE / Threat Intelligence Dashboard

The Threat Intelligence Dashboard provides real-time CVE monitoring, CISA KEV tracking, ExploitDB integration, and EPSS scoring — all filtered to your organization's specific technology stack.

Dashboard Walkthrough

Time Filter Tabs (top of page): Past 24 Hours → Today's newly published or updated CVEs Past 48 Hours → Two-day window, catches missed items Past Week → Weekly threat digest for sprint reviews Past Month → Monthly exposure baseline for compliance Past Year → Full annual threat environment Metric Cards (8 summary tiles): Total CVEs → All CVEs published/updated in the selected window Critical → CVSS 9.0+ (red badge) — requires immediate action High → CVSS 7.0–8.9 (orange badge) — address within sprint CISA KEV → On CISA Known Exploited Vulnerabilities catalog Exploit Available → Public exploit exists (Metasploit, ExploitDB, GitHub) PoC Available → Proof-of-concept code published (GitHub, blog, advisory) Org-Relevant → Matched to your Org Profile tech stack Active Exploits → Actively exploited in the wild (CISA + threat intel) Data Tabs (3 views): CVEs Tab → Full CVE list: ID, title, severity, CVSS, EPSS, exploit status, CISA KEV indicator, publish date. Click to expand. Exploits Tab → Known exploits: type (Framework Module, PoC, GitHub), source link, reliability rating, platform, description CISA KEV Tab → CISA Known Exploited Vulnerabilities: vendor, product, date added, remediation due date

Org Profile Setup (4 Steps)

Step 1 — Add Technologies: Navigate to Org Profile (sidebar). Add every technology in your stack: frameworks, libraries, operating systems, databases, cloud providers, network equipment, IoT firmware. Be specific: "nginx 1.24" scores higher matches than "web server". Step 2 — Add Vendors: Add vendor names for commercial software: Microsoft, Cisco, Palo Alto, Fortinet, VMware, etc. CVEs are matched against the CPE vendor field. Step 3 — Configure Alerts: Set severity thresholds for notifications: Critical + Org-Relevant → Desktop notification + email CISA KEV addition → Desktop notification Exploit published → Dashboard badge update Step 4 — Set Filters: Default filter presets for the dashboard: Recommended: "Org Profile Only" + "Exploit Available" enabled This shows only CVEs that affect YOUR stack AND have a working exploit.

Exploit Wizard (4 Steps)

Step 1 — Select CVE: Click the ⚡ Exploit button on any CVE row where exploit_available = true or poc_available = true. The Exploit Wizard modal opens. Step 2 — Configure Target: Target URL → Full URL of the system to test (must be authorized) Auth Type → None / Bearer Token / API Key / Session Cookie / Basic Auth Notes → Optional engagement context for the report Step 3 — Launch Exploit: Click "Launch Exploit". The execution console streams 6 stages: 1. Reachability check → Confirms target is accessible 2. Vulnerability scan → Runs CVE-specific template with your auth headers 3. CVE detail lookup → Pulls exploit IDs, PoC URLs from local CVE database 4. PoC steps build → Constructs reproducible curl commands 5. Report save → Writes JSON report to data folder 6. Complete → Shows verdict: confirmed or not confirmed Step 4 — Review Results: Verdict banner (green = confirmed, grey = not triggered) Findings list with severity, matched URL, remediation, "Copy curl" button PoC Steps: numbered reproducible steps for report inclusion Exploit Links: direct links to exploit source and PoC repos Download Report / Run Again buttons

EPSS Scoring

EPSS (Exploit Prediction Scoring System) provides a probability score from 0.0 to 1.0 representing the likelihood that a CVE will be exploited in the wild within the next 30 days. PhantomYerra displays the EPSS score and percentile ranking on every CVE entry. Use EPSS alongside CVSS to prioritize: a CVSS 7.5 with EPSS 0.95 is more urgent than a CVSS 9.8 with EPSS 0.02.

Prerequisites

Same as Automated AI mode
Select "Semi-Automated" in Wizard Step 2
Operator available to review and approve each TTP before execution

1

Complete Wizard and Review Campaign Plan

Run the same wizard as Automated mode, selecting Semi-Automated at Step 2. Claude generates a phased campaign plan. Review each phase's proposed techniques before any execution begins.

Claude proposes campaign plan: "Red Team Campaign Plan — APT29 Emulation Phase 1: Reconnaissance (3 techniques) Phase 2: Initial Access via spearphishing (2 techniques) Phase 3: Persistence via registry + scheduled task (2 techniques) Phase 4: Privilege Escalation via Kerberoasting (1 technique) Phase 5: Lateral Movement via PsExec + WinRM (2 techniques) Phase 6: Exfiltration simulation (1 technique) Approve full plan? Or edit individual phases?" → [Approve Plan] / [Edit Phases]
2

Approve Each TTP Before Execution

Claude presents each technique individually with its MITRE ATT&CK ID, description, expected impact, and detection likelihood. You approve, modify, or skip each one.

Proposal: "T1566.001 — Spearphishing Attachment Target: 5 users from OSINT (LinkedIn). Payload: macro-enabled document. Expected: credential capture or code execution. Detection risk: Medium (email gateway may flag attachment)." → [Approve] → Phishing emails sent → 2 of 5 users clicked → credentials captured Proposal: "T1558.003 — Kerberoasting Target: Domain controller at 10.0.1.5. Tool: Rubeus. Expected: service account TGS tickets for offline cracking. Detection risk: Low (normal Kerberos traffic pattern)." → [Approve] → 12 service accounts found → 3 cracked within 2 hours Proposal: "T1003.006 — DCSync Target: DC using compromised service account. Expected: full domain hash dump. Detection risk: HIGH (generates replication events)." → [Skip — too noisy for this engagement] → Claude adjusts plan
3

Review Detection Results with Blue Team (Purple Team Mode)

If running in Purple Team mode, after each technique executes, review the detection status with the blue team. Mark each technique as Detected, Partially Detected, or Evaded.

Detection Review Panel: T1566.001 Spearphishing → Detected (email gateway blocked 3 of 5) T1059.001 PowerShell → Evaded (no alert triggered) T1558.003 Kerberoasting → Partially Detected (SIEM alert, not investigated) T1021.002 PsExec → Detected (EDR blocked lateral movement) Detection Score: 2/4 detected (50%) — significant gaps in post-exploitation
4

Complete Campaign and Generate Report

After all approved TTPs have been executed (or skipped), click Complete Campaign. Claude generates the full Red Team Report with detection gap analysis highlighting which techniques succeeded without triggering alerts.

⏱️ Typical duration: 2–5 days with active TTP approval cadence. Purple Team exercises: add 1–2 days for joint blue team review sessions.

Prerequisites

Written Rules of Engagement with approved TTPs
PhantomYerra tools installed (Settings → Tools)
Target credentials for Assumed Breach scenarios
C2 infrastructure prepared (if using command-and-control)
MITRE ATT&CK Navigator for TTP tracking

1

OSINT Reconnaissance

Gather intelligence on the target organization using passive techniques before any active engagement.

# PhantomYerra → Tools → Asset Discovery Engine # Domain: target.com → discover subdomains, email addresses, employee names # PhantomYerra → Tools → OSINT Collector # Inputs: company name, domain, key personnel # Sources: LinkedIn profiles, GitHub repos, Shodan, Censys, certificate # transparency logs, DNS history, WHOIS, Wayback Machine # PhantomYerra → Tools → Credential Breach Search # Input: target.com domain # Output: previously breached credentials (hash-only, ethical use) # PhantomYerra → Tools → Technology Fingerprinting # URL: https://target.com → identify web frameworks, CMS, WAF, CDN
2

Initial Access Techniques

Attempt to gain a foothold in the target environment using approved initial access methods.

# Phishing Campaign # PhantomYerra → Red Team → Phishing → Create Campaign # Template: credential harvesting / payload delivery / link click tracking # Targets: employee list from OSINT phase # Tracking: open rate, click rate, credential submission rate # Password Spray # PhantomYerra → Tools → Credential Testing Engine # Target: https://mail.target.com/owa OR VPN portal # Usernames: discovered employees Passwords: Season+Year, Company+123 # Rate limit: 1 attempt per 30 minutes per user (avoid lockout) # VPN / Edge Device Exploitation # PhantomYerra → Tools → Vulnerability Scan Engine → CVE templates # Target: vpn.target.com → check for CVE-2023-46805 (Ivanti), CVE-2024-3400 # (Palo Alto), CVE-2023-27997 (FortiGate), etc. # Web Application Exploitation # PhantomYerra → Web Pentest → target public-facing applications # Chain: SQLi → credential extraction → reuse on VPN/RDP
3

Privilege Escalation

Escalate from initial foothold to higher-privilege accounts, targeting Domain Admin in AD environments.

# Active Directory Enumeration # PhantomYerra → Tools → AD Attack Framework # Domain: corp.target.com DC: 10.0.1.5 User: compromised_user # Enumerate: users, groups, GPOs, ACLs, trusts, SPNs, delegation # Kerberoasting # PhantomYerra → Tools → Kerberos Attack Suite # Request TGS tickets for service accounts → export → offline crack # Output: cracked service account passwords # AS-REP Roasting # Find accounts with "Do not require Kerberos preauthentication" # Request AS-REP → offline crack → compromised accounts # Token Impersonation # From compromised host: enumerate tokens → impersonate DA token # Tools: PhantomYerra Post-Exploitation → Token Manipulation # Local Privilege Escalation # Check: unquoted service paths, weak service permissions, AlwaysInstallElevated, # DLL hijacking, scheduled task abuse, kernel exploits (if approved)
4

Lateral Movement

Move across the network from the compromised system to other hosts, targeting high-value assets.

# PsExec (SMB-based) # PhantomYerra → Post-Exploitation → Lateral Movement → PsExec # Target: 10.0.1.50 Credentials: domain_admin Command: whoami # WMI Execution # PhantomYerra → Post-Exploitation → Lateral Movement → WMI # Target: 10.0.1.50 Command: execute payload via WMI process create # SMB File Copy + Scheduled Task # Copy payload to \\target\C$\Windows\Temp\ → create scheduled task → execute # WinRM / PowerShell Remoting # Enter-PSSession -ComputerName target -Credential $cred # Execute reconnaissance and data collection commands # RDP Hijacking # Query existing RDP sessions → hijack disconnected session without password # tscon [session_id] /dest:console (requires SYSTEM)
5

Data Discovery and Exfiltration

Locate sensitive data and demonstrate exfiltration capability (simulated or hash-only per ROE).

# Data Discovery # Search file shares: \\fileserver\share → look for PII, credentials, # financial data, source code, database backups # Search patterns: *.sql, *.bak, *.kdbx, password*, confidential*, *.pem # SharePoint / OneDrive / Teams # Access cloud storage with compromised credentials # Search for sensitive documents, API keys, connection strings # Database Access # Use compromised credentials to access SQL Server, Oracle, PostgreSQL # Extract sample records (minimum needed to prove access, per ROE) # Exfiltration Demonstration # Method 1: HTTPS POST to attacker-controlled server (encrypted) # Method 2: DNS tunneling (low and slow, evades DLP) # Method 3: Cloud storage upload (OneDrive, S3 with stolen creds) # NOTE: Use hash-only proof unless ROE explicitly permits data extraction
6

Reporting with MITRE ATT&CK Mapping

Document every technique used, map to MITRE ATT&CK IDs, and produce the final red team report.

# Log each finding in PhantomYerra # Press Ctrl+F → Finding Editor → fill MITRE ATT&CK technique ID # Attach: screenshot evidence, terminal output, HTTP captures # Generate MITRE ATT&CK Navigator layer # PhantomYerra → Reports → ATT&CK Navigator Export # Shows heat map of all techniques: attempted / succeeded / detected # Generate Full Red Team Report # PhantomYerra → Reports → Red Team Report → select format (PDF / HTML) # Includes: executive summary, kill chain narrative, attack path diagram, # detection gaps, dwell time metrics, remediation priorities # Cleanup # Remove all persistence mechanisms, implants, scheduled tasks # Delete staged files and tools from target systems # Document cleanup steps in report appendix

⏱️ Duration: 5–15 business days for a full manual red team engagement. Assumed Breach: 3–5 days. Phishing-only: 5–10 days including response window.

Options Reference

Option	Values	Default	Description
Campaign Type	Full Red Team, Purple Team, Assumed Breach, Phishing, Physical	Full Red Team	Overall campaign objective and scope
Adversary Profile	APT29, APT28, Lazarus, FIN7, APT41, Sandworm, Custom	Custom	Threat actor TTP emulation template
Intensity	Stealth, Standard, Aggressive	Standard	Noise level: Stealth avoids detection, Aggressive tests all TTPs
MITRE Tactics	14 checkboxes (TA0001–TA0043)	All enabled	Which ATT&CK tactics are approved for this engagement
Data Handling	No exfil, Hash-only, Simulated, Full (ROE required)	Hash-only	How discovered sensitive data is handled during exfiltration phase
Time Window	Business hours, After hours, 24x7	24x7	When active testing is permitted
Notification	Silent, Alert on critical, Real-time feed to blue team	Silent	Whether to notify defenders during campaign
CVE Time Filter	24h, 48h, Week, Month, Year	Week	Threat Intelligence dashboard time window
Org Profile Filter	On / Off	Off	Show only CVEs matching your tech stack
Exploit Available	On / Off	Off	Show only CVEs with known exploits or PoCs

Common Scenarios

Scenario 1: Annual Red Team Assessment
A financial services company requires an annual red team engagement to satisfy regulatory requirements. Select Full Red Team with APT29 profile, all 14 MITRE tactics approved, Standard intensity, Hash-only data handling. Run for 10 business days. Deliverable: executive report with ATT&CK Navigator layer showing coverage gaps.

Scenario 2: Purple Team After Incident
After a real breach attributed to Scattered Spider, the security team wants to validate their detection improvements. Select Purple Team with Scattered Spider profile, Real-time feed to blue team notification, focus on social engineering + MFA fatigue + identity provider TTPs. Joint debrief after each phase.

Scenario 3: Assumed Breach for New SOC
A company has deployed a new SIEM/EDR stack and wants to validate detection capabilities. Select Assumed Breach, provide domain credentials, start from inside the network. Focus on Phases 4–8 (priv esc through exfil). Track detection rate per technique. Deliverable: detection gap analysis with SIEM rule recommendations.

Scenario 4: Threat Intel Daily Review
A security analyst reviews the Threat Intelligence Dashboard every morning. Configure Org Profile with the full tech stack. Set default filter to Past 24 Hours + Org Profile Only + Exploit Available. Review critical CVEs, check EPSS scores, run the Exploit Wizard against staging environment for any high-EPSS findings.

Common Issues

This usually means the target's perimeter defenses are strong. Verify that phishing emails are not being quarantined by checking the mail gateway logs (if Purple Team). Try alternative initial access vectors: VPN exploit, web application vulnerability, or credential spray against cloud services (O365, Azure AD). If all fail, consider switching to Assumed Breach mode to test internal defenses directly — this is a valid and common approach when perimeter security is mature.

In Automated mode, Claude may use sub-techniques within an approved parent tactic. For example, approving "Credential Access" (TA0006) enables all sub-techniques under it. To restrict specific sub-techniques, switch to Semi-Automated mode where each technique requires individual approval. You can also uncheck specific techniques in the MITRE ATT&CK tactics selection during wizard Step 2.

Your Org Profile is either empty or contains generic terms. Navigate to Org Profile in the sidebar and add specific technology names with version numbers: "nginx 1.24", "PostgreSQL 16", "React 18", "Ubuntu 22.04". The matching engine scores relevance by looking for these terms in CVE descriptions and CPE affected product lists. After updating your profile, return to the dashboard and enable the Org Profile Only filter.

The Exploit Wizard tests the specific target URL you provide. "Not confirmed" means the target is either patched, not running the vulnerable version, or has a WAF/IDS blocking the payload. Check: (1) the target is actually running the affected software version, (2) the correct endpoint path is being tested, (3) authentication credentials are valid if the vulnerable endpoint requires auth. Try running with different auth configurations or against a known-vulnerable test instance to verify the template works.

The dwell time tracker requires detection events to calculate time-to-detect. If running in Silent notification mode without a connected SIEM, no detection events are fed back into PhantomYerra. For accurate dwell time: (1) switch to Purple Team mode with blue team participation, (2) connect your SIEM via the Integrations page (Splunk, Elastic, Sentinel), or (3) manually mark detection timestamps for each technique in the Campaign Dashboard.

Red Team & Threat Intelligence

Prerequisites

Select Red Team from Home Screen

Configure Adversary Profile

Define Target Environment

Complete Mission Control Wizard with Red Team Settings

AI Executes Campaign — 8-Phase Kill Chain

Monitor Campaign Dashboard

Generate Red Team Report

What Claude Tests (Red Team Campaign)

CVE / Threat Intelligence Dashboard

Dashboard Walkthrough

Org Profile Setup (4 Steps)

Exploit Wizard (4 Steps)

EPSS Scoring

Prerequisites

Complete Wizard and Review Campaign Plan

Approve Each TTP Before Execution

Review Detection Results with Blue Team (Purple Team Mode)

Complete Campaign and Generate Report

Prerequisites

OSINT Reconnaissance

Initial Access Techniques

Privilege Escalation

Lateral Movement

Data Discovery and Exfiltration

Reporting with MITRE ATT&CK Mapping

Options Reference

Common Scenarios

Common Issues

Related Topics