Red team frameworks, tooling and reference

The basis of the field's shared vocabulary. Its real value is not the catalogue but that it lets the attacker's report and the defender's detections speak the same language and be cross-referenced.

The European Central Bank framework for intelligence-led testing in the financial sector, and the reference the TLPT required by article 26 of the DORA Regulation is built on. If your institution falls under DORA this is not background reading: it is the specification.

Command and control frameworks compared by capability. It saves the sterile argument about which is best: the right question is which one fits the threat scenario you agreed to emulate.

From Bishop Fox. Cross-platform, written in Go, with reasonable traffic profiling. The most sensible starting point today for anyone not paying for a licence.

Modular, with interchangeable agents. The advantage is operational: you can swap agents without rebuilding infrastructure when the defender starts catching you mid-engagement.

A modern alternative with decent evasion out of the box. Useful as a second channel, a practice that ought to be mandatory and almost never is.

The reference library for speaking Windows protocols at a low level. Half the discipline depends on it; it is worth reading rather than merely invoking.

The maintained successor to CrackMapExec. Network sweeping and execution across Windows estates. It is very fast, which is exactly why it is the easiest way to get caught: use it with judgement.

From SpecterOps. Turns an Active Directory into a graph of escalation paths. It changed the discipline: we used to hunt credentials, now we hunt routes. It serves the defender just as well, and there it is badly underused.

Enumeration and abuse of certificate services. The ESC paths remain open in an uncomfortable majority of domains that believe they are well configured.

Kerberos interaction across the board. One of the few places where you should understand the protocol before executing anything.

The most complete open reference there is. Vast and uneven: verify before applying.

More selective and better explained than HackTricks, particularly on Active Directory. When the two disagree, this one is usually right.

Lab notes with enough detail to reproduce. Strong on evasion and Windows internals.

A compendium of payloads and techniques by vulnerability class. A starting point to adapt, never to paste.

Signed Windows binaries that do things they should not. This is the list that explains why the antivirus sees nothing unusual.

The Unix equivalent. Required reading the moment a misconfigured sudo turns up.

A database of evasion and anti-analysis techniques, with code. It serves equally for building and for detecting.

From Red Canary. Atomic tests mapped to ATT&CK. The cheapest way for a client to check whether their detection actually works — and to check it themselves, which is the part that matters.

From MITRE. Automated adversary emulation. It covers the repeatable and frees the operator for the work that requires judgement.

A common detection rule format, translatable to any SIEM. Shipping Sigma rules alongside the report turns a finding into something the SOC can deploy the same day.