skills.rest
Acczdy
AcczdyCOMMUNITY
Explore all skills by this author →
GitHub

executing-red-team-exercise

Plan red-team exercises by mapping adversary techniques to actionable tasks.

2|Updated Apr 14, 2026
Search Tags:#planning#reporting#red-team#mitre-attack#adversary-emulation#attack-templates#detection-gap
One-click install
npx skills add https://github.com/Acczdy/MoZiSec --skill executing-red-team-exercise
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: executing-red-team-exercise
Source: https://github.com/Acczdy/MoZiSec/tree/main/penetration-testing/.claude/skills/executing-red-team-exercise
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill executing-red-team-exercise

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Plans and coordinates red-team exercises by mapping attacker techniques to actionable steps, enabling structured planning, execution tracking, and evidence collection.

Core Features & Use Cases

  • ATT&CK-aligned planning: automatically map emulated actor techniques to planned activities.
  • Automated operation plans: generate comprehensive red-team operation plans with objectives and timelines.
  • Detection-gap reporting: produce reports that compare executed techniques against detections to guide improvements.
  • Use Case: Emulate a real-world actor (e.g., FIN7) to test SOC detections across phishing, credential access, and lateral movement.

Quick Start

Run the agent with appropriate flags to generate a red-team operation plan and review the generated JSON report.

Frequently Asked Questions about executing-red-team-exercise

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I plan a red-team exercise mapped to MITRE ATT&CK techniques?▼

Generate red-team operation plans by mapping emulated adversary techniques to actionable tasks and timelines. This automatically aligns your exercise objectives with MITRE ATT&CK techniques, enabling structured execution tracking and evidence collection.

How does adversary emulation help identify SOC detection gaps?▼

Adversary emulation identifies detection gaps by comparing executed threat actor techniques against existing SOC detections. It generates reports highlighting missing security coverage to guide improvements across your infrastructure.

Can I generate automated red-team operation plans for specific threat actors like FIN7?▼

Generate automated operation plans for specific actors like FIN7 by mapping their known techniques to planned activities. This creates comprehensive timelines and objectives for testing phishing, credential access, and lateral movement detections.

Do I need Python and the requests library to run MITRE ATT&CK-based adversary emulation planning?▼

Python with the requests library and internet access are required to run adversary emulation planning and fetch MITRE ATT&CK data. Optional local caching of ATT&CK data is supported to optimize repeated execution runs.

What is the best way to track execution and collect evidence during a red-team exercise?▼

Track red-team execution and collect evidence by mapping attacker techniques to actionable steps with structured timelines. This produces JSON reports comparing executed techniques against detections to guide security improvements.

Related Skills

Explore More Content & Communication Skills→
BrunoSantanaDeveloperBrunoSantanaDeveloper

red-team-tactics

Automate adversary-simulation planning and reporting with MITRE ATT&CK tactics.

Community
Advanced
martinholovskymartinholovsky
12

sota-detection-engineering

Construct security detections and SOC workflows from threat intelligence.

Community
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
pckienuitpckienuit

red-team-tactics

Summarize red team tactics and attack lifecycle phases for security planning.

Community
Intermediate