skills.rest
SnailSploit
SnailSploitCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

offensive-advanced-redteam

Guides full-lifecycle red team engagements covering C2 infrastructure, evasion, OPSEC, and reporting.

3.0k|491|Updated Mar 4, 2026
Search Tags:#Red Team#adversary simulation#mitre att&ck#c2 infrastructure#edr evasion#cobalt strike#OpSec
One-click install
npx skills add https://github.com/SnailSploit/Claude-Red --skill offensive-advanced-redteam
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-advanced-redteam
Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/infrastructure/offensive-advanced-redteam
Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill offensive-advanced-redteam

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Planning and executing an authorized red team engagement requires coordinating infrastructure, C2 tradecraft, evasion techniques, OPSEC discipline, and structured reporting, and mistakes in any phase create legal exposure or premature detection.

Core Features & Use Cases

  • Engagement Planning and ROE: Defines scope, rules of engagement, deconfliction procedures, and legal authorization requirements before any offensive action.
  • Tiered C2 Infrastructure: Covers domain aging, redirectors with traffic filtering, malleable C2 profiles, sleep/jitter tuning, and fallback channels mapped to MITRE ATT&CK.
  • Evasion and OPSEC: Documents AMSI bypass, ETW patching, direct syscalls, unhooking, LOLBin usage, indicator management, and cleanup procedures.
  • Use Case: An operator preparing an assumed-breach engagement uses this Skill to design a three-tier C2 architecture, configure a Microsoft 365-themed malleable profile, and produce an ATT&CK-mapped report with a purple team debrief plan.

Quick Start

Ask Claude to plan a red team engagement infrastructure with redirectors, malleable C2 profiles, and an OPSEC checklist for an authorized assumed-breach scenario.

Frequently Asked Questions about offensive-advanced-redteam

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up C2 infrastructure for a red team engagement?▼

Build a tiered architecture separating delivery, short-haul, and long-haul C2 across different domains and providers. Place nginx redirectors with URI and User-Agent filtering in front of a team server bound to localhost, accessed via Cloudflare tunnels or SSH.

What is a malleable C2 profile and how do I configure one?▼

A malleable C2 profile shapes Cobalt Strike beacon traffic to resemble legitimate application traffic such as Microsoft 365 API calls. Configure URIs, headers, User-Agent, sleep and jitter values, and disable staging to blend with the target's normal network activity.

How do red teams bypass AMSI and EDR hooks?▼

Common techniques include patching AmsiScanBuffer in memory, overwriting EtwEventWrite with a return instruction, and unhooking ntdll.dll by loading a clean copy from disk. Direct syscalls via SysWhispers3 or HellsGate bypass userland hooks entirely.

What should a red team rules of engagement document include?▼

The ROE must contain the authorization window, permitted techniques, notification thresholds, 24/7 emergency contacts, and explicit written legal authorization referencing applicable statutes. It is a signed legal document agreed upon before any activity begins.

When should I use an assumed-breach scenario instead of full external access?▼

Assumed breach starts with an internal foothold and focuses on lateral movement, privilege escalation, and objective completion. Use it when the client wants to test internal detection and response without spending engagement time on initial access.

Related Skills

Explore More Software Engineering Skills→
mahmutkamahmutka
13

Pentest Recon Expert

Run PTES-aligned reconnaissance workflows for authorized penetration testing engagements.

Community
Advanced
BrunoSantanaDeveloperBrunoSantanaDeveloper

red-team-tactics

Automate adversary-simulation planning and reporting with MITRE ATT&CK tactics.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

<skill-name>

Execute defined offensive security techniques against specified targets.

Official
Advanced
haJ1thaJ1t

purple-team-analyzer

Simulate attack paths and validate defense controls in a codebase.

Community
Advanced