redteam-orchestration

Red team network simulation engagements can be fully automated from reconnaissance and initial access to lateral movement and reporting by dispatching the redteam-orchestration skill to initiate the workflow on a target domain.

Detection mode philosophy in adversarial simulation ensures the engagement operates strictly for detection without executing any actual exploitation or lateral movement, providing a controlled security testing environment.

Red team workflows can be customized for specific Active Directory attack scenarios using various engagement types such as AD Attack, Hybrid (AD+Net), External Network, and Internal Network configurations.

Active Directory enumeration during network exploitation simulations operates by utilizing the INDRA specialist agent for AD enumeration, while the GHATOTKACHA agent handles network exploitation tasks across the engagement lifecycle.

Manual scope validation is not required before starting an adversarial simulation because the full lifecycle automation includes scope validation as the initial phase before proceeding to reconnaissance and access steps.

A key limitation of automated red team orchestration is its detection-first philosophy, meaning it cannot perform actual exploitation or lateral movement, restricting its use to simulation and detection validation only.