creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-28 12:19:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit - 611 cybersecurity skills across all subdomains

Browse Source
This commit is contained in:
mukul975
2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/executing-red-team-engagement-planning/SKILL.md
+122
View File
@@ -0,0 +1,122 @@
---
name: executing-red-team-engagement-planning
description: Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.
domain: cybersecurity
subdomain: red-teaming
tags: [red-team, adversary-simulation, mitre-attack, exploitation, post-exploitation, engagement-planning, rules-of-engagement]
version: "1.0"
author: mahipal
license: MIT
---
# Executing Red Team Engagement Planning
## Overview
Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins. A well-structured engagement plan ensures the red team simulates realistic adversary behavior while maintaining safety guardrails that prevent unintended business disruption.
## Objectives
- Define clear engagement scope including in-scope and out-of-scope assets, networks, and personnel
- Establish Rules of Engagement (ROE) with emergency stop procedures, communication channels, and legal boundaries
- Select appropriate threat profiles from the MITRE ATT&CK framework aligned to the organization's threat landscape
- Create a detailed attack plan mapping adversary TTPs to engagement objectives
- Develop deconfliction procedures with the organization's SOC/blue team
- Produce a comprehensive engagement brief for stakeholder approval
## Core Concepts
### Engagement Types
| Type | Description | Scope |
|------|-------------|-------|
| Full Scope | Complete adversary simulation with physical, social, and cyber vectors | Entire organization |
| Assumed Breach | Starts from initial foothold, focuses on post-exploitation | Internal network |
| Objective-Based | Target specific crown jewels (e.g., domain admin, PII exfiltration) | Defined targets |
| Purple Team | Collaborative with blue team for detection improvement | Specific controls |
### Rules of Engagement Components
1. **Scope Definition**: IP ranges, domains, physical locations, personnel
2. **Restrictions**: Systems/networks that must not be touched (e.g., production databases, medical devices)
3. **Communication Plan**: Primary and secondary contact channels, escalation procedures
4. **Emergency Procedures**: Code word for immediate cessation, incident response coordination
5. **Legal Authorization**: Signed authorization letters, get-out-of-jail letters for physical tests
6. **Data Handling**: How sensitive data discovered during testing will be handled and destroyed
7. **Timeline**: Start/end dates, blackout windows, reporting deadlines
### Threat Profile Selection
Map organizational threats using MITRE ATT&CK Navigator to select relevant adversary profiles:
- **APT29 (Cozy Bear)**: Government/defense sector targeting via spearphishing, supply chain
- **APT28 (Fancy Bear)**: Government organizations, credential harvesting, zero-days
- **FIN7**: Financial sector, POS malware, social engineering
- **Lazarus Group**: Financial institutions, cryptocurrency exchanges, destructive malware
- **Conti/Royal**: Ransomware operators, double extortion, RaaS model
## Implementation Steps
### Phase 1: Pre-Engagement
1. Conduct initial scoping meeting with stakeholders
2. Identify crown jewels and critical business assets
3. Review previous security assessments and audit findings
4. Define success criteria and engagement objectives
5. Draft Rules of Engagement document
### Phase 2: Threat Modeling
1. Identify relevant threat actors using MITRE ATT&CK
2. Map threat actor TTPs to organizational attack surface
3. Select primary and secondary attack scenarios
4. Define adversary emulation plan with specific technique IDs
5. Establish detection checkpoints for purple team opportunities
### Phase 3: Operational Planning
1. Set up secure communication channels (encrypted email, Signal, etc.)
2. Create operational security (OPSEC) guidelines for the red team
3. Establish infrastructure requirements (C2 servers, redirectors, phishing domains)
4. Develop phased attack timeline with go/no-go decision points
5. Create deconfliction matrix with SOC/IR team
### Phase 4: Documentation and Approval
1. Compile engagement plan document
2. Review with legal counsel
3. Obtain executive sponsor signature
4. Brief red team operators on ROE and restrictions
5. Distribute emergency contact cards
## Tools and Resources
- **MITRE ATT&CK Navigator**: Threat actor TTP mapping and visualization
- **VECTR**: Red team engagement tracking and metrics platform
- **Cobalt Strike / Nighthawk**: C2 framework planning and infrastructure design
- **PlexTrac**: Red team reporting and engagement management platform
- **SCYTHE**: Adversary emulation platform for attack plan creation
## Validation Criteria
- [ ] Signed Rules of Engagement document
- [ ] Defined scope with explicit in/out boundaries
- [ ] Selected threat profile with mapped MITRE ATT&CK techniques
- [ ] Emergency stop procedures tested and verified
- [ ] Communication plan distributed to all stakeholders
- [ ] Legal authorization obtained and filed
- [ ] Red team operators briefed and acknowledged ROE
## Common Pitfalls
1. **Scope Creep**: Expanding testing beyond approved boundaries during execution
2. **Inadequate Deconfliction**: SOC investigating red team activity as real incidents
3. **Missing Legal Authorization**: Testing without proper signed authorization
4. **Unrealistic Threat Models**: Simulating threats irrelevant to the organization
5. **Poor Communication**: Failing to maintain contact with stakeholders during engagement
## Related Skills
- performing-open-source-intelligence-gathering
- conducting-adversary-simulation-with-atomic-red-team
- performing-assumed-breach-red-team-exercise
- building-red-team-infrastructure-with-redirectors
skills/executing-red-team-engagement-planning/assets/template.md
+279
View File
@@ -0,0 +1,279 @@
# Red Team Engagement Plan Template
## Document Control
| Field | Value |
|-------|-------|
| Document Title | Red Team Engagement Plan |
| Organization | [ORGANIZATION NAME] |
| Version | 1.0 |
| Classification | CONFIDENTIAL |
| Author | [RED TEAM LEAD] |
| Date Created | [DATE] |
| Last Modified | [DATE] |
| Engagement ID | RT-[ORG]-[YYYYMMDD] |
---
## 1. Engagement Overview
### 1.1 Purpose
[Describe the purpose of this red team engagement and the business drivers behind it]
### 1.2 Engagement Type
- [ ] Full Scope Red Team
- [ ] Assumed Breach
- [ ] Objective-Based
- [ ] Purple Team Collaborative
### 1.3 Key Stakeholders
| Role | Name | Department | Contact |
|------|------|------------|---------|
| Executive Sponsor | | | |
| Technical POC | | | |
| Legal Counsel | | | |
| SOC Manager | | | |
| Red Team Lead | | | |
---
## 2. Scope Definition
### 2.1 In-Scope Assets
#### Network Ranges
| CIDR Range | Description | Location |
|-----------|-------------|----------|
| | | |
#### Domains
| Domain | Description | Type |
|--------|-------------|------|
| | | External/Internal |
#### Cloud Environments
| Provider | Account/Subscription | Services |
|----------|---------------------|----------|
| | | |
#### Physical Locations
| Address | Building/Floor | Access Type |
|---------|---------------|-------------|
| | | |
### 2.2 Out-of-Scope
| Asset | Reason | Alternative |
|-------|--------|------------|
| | | |
### 2.3 Restrictions
- [ ] No Denial of Service
- [ ] No data destruction
- [ ] No production database access
- [ ] No social engineering of executives
- [ ] Custom: [SPECIFY]
---
## 3. Threat Profile
### 3.1 Selected Threat Actor
**Primary:** [THREAT ACTOR NAME]
**Aliases:** [LIST]
**Motivation:** [Financial/Espionage/Disruption]
### 3.2 Mapped MITRE ATT&CK Techniques
| Tactic | Technique ID | Technique Name | Priority |
|--------|-------------|----------------|----------|
| Initial Access | | | High/Medium/Low |
| Execution | | | |
| Persistence | | | |
| Privilege Escalation | | | |
| Defense Evasion | | | |
| Credential Access | | | |
| Discovery | | | |
| Lateral Movement | | | |
| Collection | | | |
| Exfiltration | | | |
| Command and Control | | | |
### 3.3 ATT&CK Navigator Layer
[Attach exported JSON layer file]
---
## 4. Attack Plan
### Phase 1: Reconnaissance
**Duration:** [X days]
**Objective:** [DESCRIBE]
| Activity | Tool/Method | Expected Outcome | Risk Level |
|----------|------------|-------------------|------------|
| | | | |
### Phase 2: Initial Access
**Duration:** [X days]
**Objective:** [DESCRIBE]
| Activity | Tool/Method | Expected Outcome | Risk Level |
|----------|------------|-------------------|------------|
| | | | |
### Phase 3: Establish Persistence
**Duration:** [X days]
**Objective:** [DESCRIBE]
| Activity | Tool/Method | Expected Outcome | Risk Level |
|----------|------------|-------------------|------------|
| | | | |
### Phase 4: Lateral Movement
**Duration:** [X days]
**Objective:** [DESCRIBE]
| Activity | Tool/Method | Expected Outcome | Risk Level |
|----------|------------|-------------------|------------|
| | | | |
### Phase 5: Privilege Escalation
**Duration:** [X days]
**Objective:** [DESCRIBE]
| Activity | Tool/Method | Expected Outcome | Risk Level |
|----------|------------|-------------------|------------|
| | | | |
### Phase 6: Objective Completion
**Duration:** [X days]
**Objective:** [DESCRIBE]
| Activity | Tool/Method | Expected Outcome | Risk Level |
|----------|------------|-------------------|------------|
| | | | |
### Phase 7: Cleanup and Reporting
**Duration:** [X days]
**Objective:** [DESCRIBE]
| Activity | Tool/Method | Expected Outcome | Risk Level |
|----------|------------|-------------------|------------|
| | | | |
---
## 5. Infrastructure Requirements
### 5.1 C2 Infrastructure
| Component | Provider | Domain/IP | Purpose |
|-----------|---------|-----------|---------|
| C2 Server | | | Primary command and control |
| Redirector | | | Traffic redirection |
| Phishing Server | | | Email delivery |
| Payload Host | | | Stage delivery |
### 5.2 Operator Equipment
| Item | Specification | Assigned To |
|------|-------------|-------------|
| Laptop | | |
| USB Devices | | |
| WiFi Adapter | | |
| Lock Pick Set | | |
---
## 6. Communication Plan
### 6.1 Channels
- **Primary:** [METHOD]
- **Secondary:** [METHOD]
- **Emergency:** [METHOD]
### 6.2 Check-in Schedule
| Frequency | Method | Participants | Time |
|-----------|--------|-------------|------|
| Daily | | | |
| Weekly | | | |
### 6.3 Emergency Stop Procedure
- **Code Word:** [WORD]
- **Activation Method:** [DESCRIBE]
- **Response Time:** [X minutes]
---
## 7. Legal Authorization
### 7.1 Authorization Statement
I hereby authorize [RED TEAM COMPANY/TEAM] to conduct the red team engagement
as described in this document against [ORGANIZATION NAME] assets.
**Signature:** ___________________________
**Name:** ___________________________
**Title:** ___________________________
**Date:** ___________________________
### 7.2 Attached Documents
- [ ] Signed Rules of Engagement
- [ ] Master Services Agreement
- [ ] Non-Disclosure Agreement
- [ ] Get-Out-of-Jail Letters (physical testing)
- [ ] Insurance Certificate
---
## 8. Reporting
### 8.1 Deliverables
| Deliverable | Due Date | Format | Recipients |
|------------|----------|--------|------------|
| Daily Status Update | Daily | Email | Technical POC |
| Interim Report | Mid-engagement | PDF | Sponsor, CISO |
| Final Report | [DATE] | PDF | Full distribution |
| Executive Summary | [DATE] | PDF/PPT | Executive team |
| Technical Debrief | [DATE] | Presentation | Security team |
### 8.2 Report Sections
1. Executive Summary
2. Engagement Overview and Scope
3. Methodology
4. Attack Narrative (Timeline)
5. Findings and Observations
6. Risk Ratings and Impact Assessment
7. Recommendations
8. Appendices (Evidence, Tool List, IOCs)
---
## Appendix A: Engagement Checklist
### Pre-Engagement
- [ ] Scope defined and approved
- [ ] ROE signed by all parties
- [ ] Legal authorization obtained
- [ ] Insurance verified
- [ ] Infrastructure deployed and tested
- [ ] Operators briefed on ROE
- [ ] Emergency contacts distributed
- [ ] Deconfliction channel established
- [ ] Threat profile selected and mapped
### During Engagement
- [ ] Daily check-ins conducted
- [ ] Activity log maintained
- [ ] Evidence collected and secured
- [ ] Deconfliction matrix updated
- [ ] Phase transition approvals obtained
### Post-Engagement
- [ ] All implants and persistence removed
- [ ] Created accounts deleted
- [ ] Modified configurations restored
- [ ] Final report delivered
- [ ] Technical debrief completed
- [ ] Lessons learned session conducted
- [ ] Evidence securely archived
- [ ] Infrastructure decommissioned
skills/executing-red-team-engagement-planning/references/standards.md
+93
View File
@@ -0,0 +1,93 @@
# Standards and Framework References
## MITRE ATT&CK
- **Reconnaissance (TA0043)**: Pre-engagement intelligence gathering
- T1595 - Active Scanning
- T1592 - Gather Victim Host Information
- T1589 - Gather Victim Identity Information
- T1590 - Gather Victim Network Information
- T1591 - Gather Victim Org Information
- **Resource Development (TA0042)**: Infrastructure and capability preparation
- T1583 - Acquire Infrastructure
- T1584 - Compromise Infrastructure
- T1587 - Develop Capabilities
- T1588 - Obtain Capabilities
- T1608 - Stage Capabilities
## PTES (Penetration Testing Execution Standard)
### Pre-engagement Interactions
- Scope definition and boundaries
- Goals and objectives
- Rules of engagement
- Communication plan
- Emergency contacts
- Timeline and milestones
- Legal considerations
- Authorization documentation
### Intelligence Gathering
- OSINT requirements
- Threat actor identification
- Attack surface mapping
- Technology profiling
## OSSTMM (Open Source Security Testing Methodology Manual)
### Section 3: Rules of Engagement
- Test boundaries and limitations
- Test vectors classification
- Compliance requirements
- Reporting standards
### Section 4: Scope
- Physical security scope
- Wireless scope
- Telecommunications scope
- Data networks scope
- Social engineering scope
## NIST SP 800-115
### Technical Guide to Information Security Testing and Assessment
- Section 3: Review Techniques
- Section 4: Target Identification and Analysis
- Section 5: Target Vulnerability Validation
- Section 6: Security Assessment Planning
## CBEST Framework (Bank of England)
- Threat intelligence-led penetration testing
- Threat actor profile development
- Scenario-based adversary simulation
- Control validation and assessment
## TIBER-EU Framework
- European framework for threat intelligence-based ethical red teaming
- Phase 1: Generic Threat Landscape
- Phase 2: Threat Intelligence
- Phase 3: Red Team Testing
- Phase 4: Closure
## CREST STAR (Simulated Targeted Attack and Response)
- Intelligence-led red team testing standard
- Adversary simulation methodology
- Detection and response validation
- Structured reporting format
## Relevant CVE/CWE References
Not directly applicable for planning phase - CVE/CWE references will be mapped during the attack execution phase based on selected TTPs and target environment.
## Compliance Frameworks Impacting Scope
| Framework | Impact on Red Team Scope |
|-----------|--------------------------|
| PCI DSS | Cardholder data environment must be tested |
| HIPAA | PHI handling requires special data protections |
| SOX | Financial systems require specific authorization |
| GDPR | Personal data handling restrictions apply |
| CMMC | DoD contractor supply chain considerations |
skills/executing-red-team-engagement-planning/references/workflows.md
+190
View File
@@ -0,0 +1,190 @@
# Red Team Engagement Planning Workflows
## Workflow 1: Scoping and Threat Modeling
### Step 1: Stakeholder Meeting
```
1. Schedule kickoff with CISO, CTO, legal counsel, and engagement sponsor
2. Present red team capabilities and engagement type options
3. Discuss organizational threat landscape and prior incidents
4. Identify crown jewels (DC, financial systems, PII stores, IP repositories)
5. Agree on engagement type: Full-scope / Assumed Breach / Objective-based
6. Document initial scope boundaries
```
### Step 2: Threat Intelligence Review
```
1. Pull industry-specific threat reports (Mandiant M-Trends, CrowdStrike Global Threat Report)
2. Query MITRE ATT&CK for relevant threat groups:
- Financial: FIN7, FIN12, Carbanak
- Healthcare: APT41, Lazarus
- Government: APT29, APT28, Turla
- Technology: APT10, Hafnium
3. Map threat actor TTPs to ATT&CK Navigator
4. Export ATT&CK Navigator layer as JSON for engagement tracking
5. Identify top 10-15 techniques for emulation
```
### Step 3: Attack Surface Analysis
```
1. Review external attack surface using passive reconnaissance
2. Map network topology from provided documentation
3. Identify remote access points (VPN, RDP, Citrix)
4. Catalog cloud services (AWS, Azure, GCP, SaaS)
5. Review physical locations and access controls
6. Identify human targets for social engineering vectors
```
## Workflow 2: Rules of Engagement Development
### Step 1: Draft ROE Document
```
Sections to include:
1. Executive Summary
2. Engagement Objectives
3. Scope Definition
- In-scope IP ranges/domains
- In-scope physical locations
- In-scope personnel (for social engineering)
- Out-of-scope systems (production DBs, medical devices, SCADA)
4. Authorized Techniques
- Approved MITRE ATT&CK techniques
- Prohibited techniques (e.g., DoS, data destruction)
5. Communication Plan
- Primary POC: Name, phone, email
- Secondary POC: Name, phone, email
- Daily check-in schedule
- Encrypted communication channel details
6. Emergency Procedures
- Stop code word: [DEFINED]
- Escalation matrix
- Incident response coordination
7. Legal Authorization
- Get-out-of-jail letter template
- Signed authorization from executive sponsor
8. Data Handling
- Sensitive data discovery procedures
- Data retention and destruction policy
9. Timeline
- Start date, end date
- Blackout periods
- Reporting deadline
```
### Step 2: Legal Review
```
1. Submit ROE to organization's legal counsel
2. Review liability and indemnification clauses
3. Ensure compliance with local laws (CFAA, Computer Misuse Act, etc.)
4. Verify insurance coverage for testing activities
5. Obtain signed legal authorization
```
### Step 3: Distribution and Acknowledgment
```
1. Distribute finalized ROE to all red team operators
2. Require written acknowledgment from each operator
3. Provide emergency contact cards to each operator
4. Brief operators on scope restrictions and prohibited actions
5. Archive signed copies in secure document management system
```
## Workflow 3: Operational Planning
### Step 1: Infrastructure Planning
```
1. Identify C2 framework requirements (Cobalt Strike, Sliver, Mythic)
2. Plan redirector architecture:
- HTTPS redirectors for web traffic
- DNS redirectors for DNS tunneling
- SMTP redirectors for phishing
3. Register domains that match target organization's naming patterns
4. Obtain SSL certificates for phishing and C2 domains
5. Configure domain categorization for web filtering bypass
6. Set up VPN/jump boxes for operator access
```
### Step 2: Phased Attack Plan
```
Phase 1: Reconnaissance (Days 1-3)
- OSINT collection on target organization
- External attack surface enumeration
- Social media profiling of target personnel
- Technology stack identification
Phase 2: Initial Access (Days 4-7)
- Spearphishing campaign delivery
- External service exploitation attempts
- Physical access attempts (if in scope)
- Supply chain attack vectors
Phase 3: Establish Persistence (Days 8-10)
- Deploy persistent implants
- Establish backup C2 channels
- Create local admin accounts
- Install backdoor services
Phase 4: Lateral Movement (Days 11-15)
- Internal network enumeration
- Credential harvesting
- Privilege escalation
- Domain controller targeting
Phase 5: Objective Completion (Days 16-18)
- Access crown jewels
- Demonstrate data exfiltration capability
- Document evidence of access
- Capture screenshots and proof
Phase 6: Cleanup and Reporting (Days 19-20)
- Remove all implants and persistence mechanisms
- Delete created accounts
- Restore modified configurations
- Compile evidence and findings
```
### Step 3: Deconfliction Planning
```
1. Establish deconfliction channel with SOC (separate from normal SOC comms)
2. Define red team IP addresses for SOC whitelisting (trusted agent model only)
3. Create deconfliction log template for real-time tracking
4. Schedule daily deconfliction calls during engagement
5. Define escalation criteria for when SOC must be notified
6. Agree on evidence preservation procedures if real incident overlaps
```
## Workflow 4: Engagement Execution Tracking
### Step 1: Daily Operations
```
1. Morning briefing with red team operators
2. Review previous day's activities and findings
3. Assign daily objectives aligned to attack plan
4. Execute assigned techniques with OPSEC considerations
5. Document all activities in engagement log with timestamps
6. Evening debrief and progress assessment
7. Update attack graph with new access and findings
```
### Step 2: Decision Points
```
Go/No-Go criteria for each phase transition:
- Phase 1 → 2: Sufficient reconnaissance data collected
- Phase 2 → 3: Initial access achieved, no detection alerts
- Phase 3 → 4: Persistence established, C2 communications stable
- Phase 4 → 5: Sufficient privileges and network access obtained
- Phase 5 → 6: Objectives achieved or engagement time expired
```
### Step 3: Metrics Collection
```
Track throughout engagement:
- Time to Initial Access (TTIA)
- Time to Domain Admin (TTDA)
- Time to Objective (TTO)
- Number of detections triggered
- Mean Time to Detect (MTTD) for blue team
- Techniques executed vs. detected ratio
- Number of unique hosts compromised
- Credentials harvested count
```
skills/executing-red-team-engagement-planning/scripts/process.py
+908
View File
@@ -0,0 +1,908 @@
#!/usr/bin/env python3
"""
Red Team Engagement Planning Automation Tool
Generates engagement planning documents including:
- Rules of Engagement (ROE) document
- Threat profile mapping from MITRE ATT&CK
- Attack plan timeline
- Deconfliction matrix
- Engagement metrics tracker
Usage:
python process.py --org "Target Corp" --type full-scope --duration 20 --output ./engagement_plan
python process.py --org "Target Corp" --threat-actor APT29 --generate-attack-plan
python process.py --template roe --output ./documents
Requirements:
pip install jinja2 requests pyyaml rich
"""
import argparse
import json
import os
import sys
from datetime import datetime, timedelta
from pathlib import Path
from typing import Any
try:
import yaml
from rich.console import Console
from rich.table import Table
from rich.panel import Panel
except ImportError:
print("[!] Missing dependencies. Install with: pip install pyyaml rich")
sys.exit(1)
console = Console()
# MITRE ATT&CK threat actor profiles with mapped TTPs
THREAT_ACTOR_PROFILES = {
"APT29": {
"aliases": ["Cozy Bear", "The Dukes", "NOBELIUM"],
"targets": ["Government", "Defense", "Technology", "Think Tanks"],
"techniques": {
"Initial Access": [
{"id": "T1566.001", "name": "Spearphishing Attachment"},
{"id": "T1566.002", "name": "Spearphishing Link"},
{"id": "T1195.002", "name": "Compromise Software Supply Chain"},
],
"Execution": [
{"id": "T1059.001", "name": "PowerShell"},
{"id": "T1059.005", "name": "Visual Basic"},
{"id": "T1204.002", "name": "Malicious File"},
],
"Persistence": [
{"id": "T1547.001", "name": "Registry Run Keys / Startup Folder"},
{"id": "T1053.005", "name": "Scheduled Task"},
{"id": "T1543.003", "name": "Windows Service"},
],
"Privilege Escalation": [
{"id": "T1068", "name": "Exploitation for Privilege Escalation"},
{"id": "T1055", "name": "Process Injection"},
],
"Defense Evasion": [
{"id": "T1027", "name": "Obfuscated Files or Information"},
{"id": "T1070.004", "name": "File Deletion"},
{"id": "T1140", "name": "Deobfuscate/Decode Files"},
],
"Credential Access": [
{"id": "T1003.001", "name": "LSASS Memory"},
{"id": "T1558.003", "name": "Kerberoasting"},
],
"Lateral Movement": [
{"id": "T1021.002", "name": "SMB/Windows Admin Shares"},
{"id": "T1021.001", "name": "Remote Desktop Protocol"},
],
"Collection": [
{"id": "T1560.001", "name": "Archive via Utility"},
{"id": "T1114.002", "name": "Remote Email Collection"},
],
"Exfiltration": [
{"id": "T1041", "name": "Exfiltration Over C2 Channel"},
{"id": "T1567.002", "name": "Exfiltration to Cloud Storage"},
],
"Command and Control": [
{"id": "T1071.001", "name": "Web Protocols"},
{"id": "T1573.002", "name": "Asymmetric Cryptography"},
{"id": "T1090.003", "name": "Multi-hop Proxy"},
],
},
},
"APT28": {
"aliases": ["Fancy Bear", "Sofacy", "STRONTIUM"],
"targets": ["Government", "Military", "Journalists", "Political Organizations"],
"techniques": {
"Initial Access": [
{"id": "T1566.001", "name": "Spearphishing Attachment"},
{"id": "T1190", "name": "Exploit Public-Facing Application"},
{"id": "T1078", "name": "Valid Accounts"},
],
"Execution": [
{"id": "T1059.001", "name": "PowerShell"},
{"id": "T1059.003", "name": "Windows Command Shell"},
],
"Persistence": [
{"id": "T1547.001", "name": "Registry Run Keys"},
{"id": "T1137.001", "name": "Office Template Macros"},
],
"Credential Access": [
{"id": "T1110.003", "name": "Password Spraying"},
{"id": "T1556.001", "name": "Domain Controller Authentication"},
{"id": "T1528", "name": "Steal Application Access Token"},
],
"Lateral Movement": [
{"id": "T1021.002", "name": "SMB/Windows Admin Shares"},
],
"Collection": [
{"id": "T1005", "name": "Data from Local System"},
{"id": "T1114", "name": "Email Collection"},
],
"Exfiltration": [
{"id": "T1048.002", "name": "Exfiltration Over Asymmetric Encrypted Non-C2"},
],
"Command and Control": [
{"id": "T1071.001", "name": "Web Protocols"},
{"id": "T1105", "name": "Ingress Tool Transfer"},
],
},
},
"FIN7": {
"aliases": ["Carbon Spider", "ELBRUS", "Sangria Tempest"],
"targets": ["Retail", "Hospitality", "Financial", "Restaurant"],
"techniques": {
"Initial Access": [
{"id": "T1566.001", "name": "Spearphishing Attachment"},
{"id": "T1566.002", "name": "Spearphishing Link"},
],
"Execution": [
{"id": "T1059.001", "name": "PowerShell"},
{"id": "T1059.005", "name": "Visual Basic"},
{"id": "T1059.007", "name": "JavaScript"},
],
"Persistence": [
{"id": "T1053.005", "name": "Scheduled Task"},
{"id": "T1547.001", "name": "Registry Run Keys"},
],
"Credential Access": [
{"id": "T1003", "name": "OS Credential Dumping"},
{"id": "T1555", "name": "Credentials from Password Stores"},
],
"Lateral Movement": [
{"id": "T1021.001", "name": "Remote Desktop Protocol"},
{"id": "T1570", "name": "Lateral Tool Transfer"},
],
"Collection": [
{"id": "T1005", "name": "Data from Local System"},
{"id": "T1113", "name": "Screen Capture"},
],
"Exfiltration": [
{"id": "T1041", "name": "Exfiltration Over C2 Channel"},
],
"Command and Control": [
{"id": "T1071.001", "name": "Web Protocols"},
{"id": "T1573.001", "name": "Symmetric Cryptography"},
],
},
},
"Lazarus": {
"aliases": ["HIDDEN COBRA", "Zinc", "Diamond Sleet"],
"targets": ["Financial", "Cryptocurrency", "Defense", "Media"],
"techniques": {
"Initial Access": [
{"id": "T1566.001", "name": "Spearphishing Attachment"},
{"id": "T1195.002", "name": "Compromise Software Supply Chain"},
{"id": "T1189", "name": "Drive-by Compromise"},
],
"Execution": [
{"id": "T1059.001", "name": "PowerShell"},
{"id": "T1059.006", "name": "Python"},
{"id": "T1204.002", "name": "Malicious File"},
],
"Persistence": [
{"id": "T1543.003", "name": "Windows Service"},
{"id": "T1547.001", "name": "Registry Run Keys"},
],
"Defense Evasion": [
{"id": "T1027", "name": "Obfuscated Files or Information"},
{"id": "T1036.005", "name": "Match Legitimate Name or Location"},
{"id": "T1070.004", "name": "File Deletion"},
],
"Credential Access": [
{"id": "T1003.001", "name": "LSASS Memory"},
{"id": "T1552.001", "name": "Credentials In Files"},
],
"Lateral Movement": [
{"id": "T1021.002", "name": "SMB/Windows Admin Shares"},
],
"Impact": [
{"id": "T1486", "name": "Data Encrypted for Impact"},
{"id": "T1485", "name": "Data Destruction"},
{"id": "T1496", "name": "Resource Hijacking"},
],
"Command and Control": [
{"id": "T1071.001", "name": "Web Protocols"},
{"id": "T1090", "name": "Proxy"},
{"id": "T1105", "name": "Ingress Tool Transfer"},
],
},
},
}
ENGAGEMENT_TYPES = {
"full-scope": {
"name": "Full Scope Red Team Engagement",
"description": "Complete adversary simulation covering physical, social, and cyber vectors",
"phases": [
"Reconnaissance",
"Initial Access",
"Establish Persistence",
"Lateral Movement",
"Privilege Escalation",
"Objective Completion",
"Cleanup & Reporting",
],
"vectors": ["Cyber", "Physical", "Social Engineering"],
},
"assumed-breach": {
"name": "Assumed Breach Engagement",
"description": "Starts from an initial foothold, focuses on internal post-exploitation",
"phases": [
"Internal Reconnaissance",
"Establish Persistence",
"Lateral Movement",
"Privilege Escalation",
"Objective Completion",
"Cleanup & Reporting",
],
"vectors": ["Cyber (Internal)"],
},
"objective-based": {
"name": "Objective-Based Red Team Engagement",
"description": "Focused on reaching specific crown jewels or objectives",
"phases": [
"Target Analysis",
"Attack Path Planning",
"Execution",
"Objective Validation",
"Cleanup & Reporting",
],
"vectors": ["Defined per objective"],
},
"purple-team": {
"name": "Purple Team Collaborative Engagement",
"description": "Collaborative red/blue team exercise for detection improvement",
"phases": [
"TTP Selection",
"Execute & Observe",
"Detection Gap Analysis",
"Tuning & Improvement",
"Validation & Reporting",
],
"vectors": ["Defined per detection scenario"],
},
}
def generate_roe_document(
org_name: str,
engagement_type: str,
duration_days: int,
start_date: str | None = None,
threat_actor: str | None = None,
) -> str:
"""Generate a Rules of Engagement document."""
if start_date:
start = datetime.strptime(start_date, "%Y-%m-%d")
else:
start = datetime.now() + timedelta(days=7)
end = start + timedelta(days=duration_days)
eng_type = ENGAGEMENT_TYPES.get(engagement_type, ENGAGEMENT_TYPES["full-scope"])
roe = f"""
# RULES OF ENGAGEMENT
## {eng_type['name']}
### CONFIDENTIAL - {org_name}
---
## 1. EXECUTIVE SUMMARY
This document defines the Rules of Engagement for the {eng_type['name']} to be
conducted against {org_name}. This engagement will simulate realistic adversary
behavior to test the organization's detection and response capabilities.
**Engagement Type:** {eng_type['name']}
**Description:** {eng_type['description']}
**Duration:** {duration_days} days
**Start Date:** {start.strftime('%Y-%m-%d')}
**End Date:** {end.strftime('%Y-%m-%d')}
**Document Version:** 1.0
**Classification:** CONFIDENTIAL
---
## 2. ENGAGEMENT OBJECTIVES
### Primary Objectives
1. Assess the organization's ability to detect and respond to targeted attacks
2. Identify security gaps in people, process, and technology controls
3. Validate the effectiveness of existing security monitoring and alerting
4. Test incident response procedures and communication workflows
### Secondary Objectives
1. Provide actionable recommendations for security improvements
2. Establish baseline metrics for future red team assessments
3. Identify critical attack paths to sensitive data and systems
4. Evaluate security awareness among targeted personnel
### Success Criteria
- [ ] Initial access achieved through authorized attack vector
- [ ] Lateral movement to at least 3 network segments
- [ ] Privilege escalation to domain administrator equivalent
- [ ] Access to defined crown jewels demonstrated
- [ ] Complete engagement report delivered within agreed timeline
---
## 3. SCOPE DEFINITION
### 3.1 In-Scope Assets
| Category | Details | Notes |
|----------|---------|-------|
| External IP Ranges | [TO BE DEFINED] | All externally facing assets |
| Internal Networks | [TO BE DEFINED] | Corporate and server networks |
| Domains | [TO BE DEFINED] | Primary and subsidiary domains |
| Cloud Environments | [TO BE DEFINED] | AWS/Azure/GCP accounts |
| Physical Locations | [TO BE DEFINED] | Office locations for physical tests |
| Personnel | [TO BE DEFINED] | Approved social engineering targets |
### 3.2 Out-of-Scope Assets
| Category | Details | Reason |
|----------|---------|--------|
| Production Databases | [TO BE DEFINED] | Business continuity risk |
| Medical/Safety Systems | [TO BE DEFINED] | Safety critical systems |
| Third-Party Systems | [TO BE DEFINED] | Legal/contractual restrictions |
| Executive Leadership | [TO BE DEFINED] | Unless specifically authorized |
### 3.3 Authorized Attack Vectors
{chr(10).join(f'- {v}' for v in eng_type['vectors'])}
---
## 4. AUTHORIZED TECHNIQUES
### 4.1 Approved MITRE ATT&CK Techniques
"""
if threat_actor and threat_actor in THREAT_ACTOR_PROFILES:
profile = THREAT_ACTOR_PROFILES[threat_actor]
roe += f"\n**Emulated Threat Actor:** {threat_actor} ({', '.join(profile['aliases'])})\n\n"
for tactic, techniques in profile["techniques"].items():
roe += f"\n#### {tactic}\n"
for t in techniques:
roe += f"- {t['id']}: {t['name']}\n"
else:
roe += "\n[Techniques to be defined based on threat profile selection]\n"
roe += f"""
### 4.2 Prohibited Actions
- Denial of Service attacks against production systems
- Data destruction or modification of production data
- Exploitation of vulnerabilities that could cause system instability
- Social engineering of C-suite executives (unless authorized)
- Physical damage to any property or equipment
- Access to or exfiltration of actual sensitive data (demonstrate access only)
- Testing during defined blackout periods
---
## 5. COMMUNICATION PLAN
### 5.1 Points of Contact
| Role | Name | Phone | Email | Availability |
|------|------|-------|-------|--------------|
| Engagement Sponsor | [TBD] | [TBD] | [TBD] | Business hours |
| Technical POC | [TBD] | [TBD] | [TBD] | 24/7 during engagement |
| Red Team Lead | [TBD] | [TBD] | [TBD] | 24/7 during engagement |
| Legal Counsel | [TBD] | [TBD] | [TBD] | Business hours |
| SOC Manager | [TBD] | [TBD] | [TBD] | 24/7 during engagement |
### 5.2 Communication Channels
- **Primary:** Encrypted email (PGP/S-MIME)
- **Secondary:** Signal messenger group
- **Emergency:** Direct phone call to Technical POC
- **Deconfliction:** Dedicated Slack/Teams channel (invite-only)
### 5.3 Check-in Schedule
- **Daily:** Status update via encrypted email by 17:00
- **Weekly:** Video call progress review with engagement sponsor
- **Ad-hoc:** Immediate notification for critical findings or incidents
---
## 6. EMERGENCY PROCEDURES
### 6.1 Emergency Stop
- **Code Word:** [TO BE DEFINED - e.g., "LIGHTNING STRIKE"]
- **Activation:** Any authorized contact can invoke emergency stop
- **Response:** All red team activity ceases immediately
- **Notification:** Red team lead confirms cessation within 15 minutes
### 6.2 Escalation Matrix
| Severity | Description | Action | Timeline |
|----------|-------------|--------|----------|
| Critical | System outage or data breach suspected | Emergency stop + immediate call | Immediate |
| High | Unexpected system impact detected | Pause affected activity + notify | Within 1 hour |
| Medium | Blue team investigating red team activity | Continue with caution + monitor | Within 4 hours |
| Low | General questions or clarifications | Respond via normal channels | Within 24 hours |
### 6.3 Real Incident Overlap
If a real security incident is detected during the engagement:
1. Red team immediately pauses all operations
2. Red team lead notifies SOC manager via emergency channel
3. Red team provides deconfliction data to distinguish red team activity
4. Engagement resumes only after explicit authorization from sponsor
---
## 7. ENGAGEMENT TIMELINE
### Phase Schedule
"""
days_per_phase = duration_days // len(eng_type["phases"])
current_day = 0
for i, phase in enumerate(eng_type["phases"]):
phase_start = start + timedelta(days=current_day)
if i == len(eng_type["phases"]) - 1:
phase_end = end
else:
phase_end = phase_start + timedelta(days=days_per_phase - 1)
roe += f"| {phase} | {phase_start.strftime('%Y-%m-%d')} | {phase_end.strftime('%Y-%m-%d')} |\n"
current_day += days_per_phase
roe += f"""
### Blackout Periods
- [TO BE DEFINED - e.g., Change freeze windows, major events]
---
## 8. DATA HANDLING
### 8.1 Sensitive Data Discovery
- If sensitive data (PII, PHI, financial) is discovered, document metadata only
- Do not copy, store, or exfiltrate actual sensitive data
- Take screenshots showing access capability without exposing data content
- Notify engagement sponsor of sensitive data exposure findings
### 8.2 Evidence Retention
- All evidence stored on encrypted drives (AES-256)
- Evidence retained for 90 days post-engagement
- Evidence destroyed via secure wipe after retention period
- Chain of custody maintained for all evidence items
### 8.3 Report Handling
- Final report classified as CONFIDENTIAL
- Distributed only to authorized recipients
- Stored in organization's secure document management system
- Red team retains no copies after final delivery confirmation
---
## 9. LEGAL AUTHORIZATION
### 9.1 Authorization Statement
I, [SPONSOR NAME], [TITLE], hereby authorize [RED TEAM COMPANY] to conduct
a {eng_type['name']} against {org_name} as described in this
Rules of Engagement document.
**Authorized Signature:** _________________________
**Print Name:** _________________________
**Title:** _________________________
**Date:** _________________________
### 9.2 Get-Out-of-Jail Letter
A separate authorization letter will be provided to each red team operator
for physical security testing activities. This letter authorizes the bearer
to conduct authorized security testing and provides emergency contact
information for verification.
---
## 10. DOCUMENT APPROVAL
| Role | Name | Signature | Date |
|------|------|-----------|------|
| Engagement Sponsor | | | |
| CISO | | | |
| Legal Counsel | | | |
| Red Team Lead | | | |
---
*Document generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}*
*Engagement ID: RT-{org_name.replace(' ', '').upper()[:6]}-{start.strftime('%Y%m%d')}*
"""
return roe
def generate_attack_plan(
threat_actor: str, engagement_type: str, duration_days: int
) -> str:
"""Generate a phased attack plan based on threat actor profile."""
if threat_actor not in THREAT_ACTOR_PROFILES:
console.print(
f"[red][-] Unknown threat actor: {threat_actor}[/red]"
)
console.print(
f"[yellow]Available: {', '.join(THREAT_ACTOR_PROFILES.keys())}[/yellow]"
)
return ""
profile = THREAT_ACTOR_PROFILES[threat_actor]
eng_type = ENGAGEMENT_TYPES.get(engagement_type, ENGAGEMENT_TYPES["full-scope"])
plan = f"""
# ATTACK PLAN
## Adversary Emulation: {threat_actor} ({', '.join(profile['aliases'])})
### Engagement Type: {eng_type['name']}
### Duration: {duration_days} days
### Target Sectors: {', '.join(profile['targets'])}
---
## Emulated Techniques by Phase
"""
for i, phase in enumerate(eng_type["phases"], 1):
plan += f"### Phase {i}: {phase}\n\n"
plan += "| ATT&CK ID | Technique | Tool/Method | Detection Checkpoint |\n"
plan += "|-----------|-----------|-------------|---------------------|\n"
# Map phase to relevant tactics
tactic_mapping = {
"Reconnaissance": ["Initial Access"],
"Initial Access": ["Initial Access", "Execution"],
"Internal Reconnaissance": ["Credential Access", "Lateral Movement"],
"Establish Persistence": ["Persistence", "Defense Evasion"],
"Lateral Movement": ["Lateral Movement", "Credential Access"],
"Privilege Escalation": ["Privilege Escalation", "Defense Evasion"],
"Objective Completion": ["Collection", "Exfiltration"],
"Cleanup & Reporting": [],
"Target Analysis": ["Initial Access"],
"Attack Path Planning": ["Initial Access"],
"Execution": ["Execution", "Lateral Movement"],
"Objective Validation": ["Collection", "Exfiltration"],
"TTP Selection": ["Initial Access"],
"Execute & Observe": ["Execution", "Lateral Movement"],
"Detection Gap Analysis": [],
"Tuning & Improvement": [],
"Validation & Reporting": [],
}
relevant_tactics = tactic_mapping.get(phase, [])
for tactic in relevant_tactics:
if tactic in profile["techniques"]:
for tech in profile["techniques"][tactic]:
plan += f"| {tech['id']} | {tech['name']} | [Operator Choice] | [Blue Team Check] |\n"
if not relevant_tactics:
plan += "| N/A | Administrative phase | N/A | N/A |\n"
plan += "\n"
plan += """
## Operational Security (OPSEC) Requirements
1. Use dedicated testing infrastructure only (no personal devices)
2. Route all traffic through authorized VPN/redirectors
3. Encrypt all communications between operators
4. Use separate credentials for each engagement
5. Clear browser history and cache after each session
6. Rotate C2 infrastructure on detection or at phase transitions
7. Use timestomping and log cleanup only on red team infrastructure
## Evidence Collection Requirements
For each technique executed, document:
- Timestamp (UTC)
- Source and destination IP/hostname
- User account used
- Tool/command executed
- Screenshot or log evidence
- Detection status (detected/undetected)
- Time to detection (if detected)
"""
return plan
def generate_deconfliction_matrix(org_name: str, duration_days: int) -> str:
"""Generate a deconfliction tracking matrix."""
matrix = f"""
# DECONFLICTION MATRIX
## {org_name} Red Team Engagement
### Purpose
This matrix tracks all red team activities for deconfliction with the SOC/IR team.
Entries should be updated in real-time during engagement execution.
---
## Red Team Infrastructure
| Asset Type | IP Address | Domain | Purpose | Active Period |
|-----------|------------|--------|---------|---------------|
| C2 Server | [TBD] | [TBD] | Primary C2 | Engagement duration |
| Redirector | [TBD] | [TBD] | HTTPS redirect | Engagement duration |
| Phishing Server | [TBD] | [TBD] | Email delivery | Phase 2 only |
| VPN Gateway | [TBD] | [TBD] | Operator access | Engagement duration |
## Red Team Accounts
| Account Name | Account Type | System | Purpose | Active Period |
|-------------|-------------|--------|---------|---------------|
| [TBD] | Local Admin | [TBD] | Persistence | Phase 3+ |
| [TBD] | Domain User | [TBD] | Lateral movement | Phase 4+ |
## Activity Log Template
| Date | Time (UTC) | Operator | Source IP | Destination | Action | Technique ID | Notes |
|------|-----------|----------|-----------|-------------|--------|-------------|-------|
| | | | | | | | |
## Deconfliction Contacts
| Time Period | Red Team Contact | SOC Contact | Channel |
|------------|-----------------|-------------|---------|
| 0800-1700 | [TBD] | [TBD] | Slack/Teams |
| 1700-0800 | [TBD] | [TBD] | Phone |
| Weekend | [TBD] | [TBD] | Phone |
## Escalation Procedures
1. SOC detects suspicious activity
2. SOC checks deconfliction matrix for matching red team activity
3. If match found: Log as red team activity, continue monitoring
4. If no match: Treat as potential real incident, notify red team lead
5. Red team lead confirms or denies activity within 30 minutes
6. If not red team activity: Initiate incident response procedures
"""
return matrix
def generate_metrics_template(engagement_type: str) -> str:
"""Generate an engagement metrics tracking template."""
template = """
# RED TEAM ENGAGEMENT METRICS
## Time-Based Metrics
| Metric | Value | Notes |
|--------|-------|-------|
| Time to Initial Access (TTIA) | | Hours from engagement start |
| Time to Privilege Escalation | | Hours from initial access |
| Time to Domain Admin (TTDA) | | Hours from initial access |
| Time to Crown Jewels (TTO) | | Hours from initial access |
| Total Engagement Duration | | Days |
| Active Testing Hours | | Hours |
## Detection Metrics
| Metric | Value | Notes |
|--------|-------|-------|
| Total Techniques Executed | | Count of unique ATT&CK techniques |
| Techniques Detected | | Count detected by blue team |
| Detection Rate | | Percentage |
| Mean Time to Detect (MTTD) | | Hours from execution to detection |
| Mean Time to Respond (MTTR) | | Hours from detection to containment |
| False Positive Rate | | Blue team alerts not related to red team |
## Access Metrics
| Metric | Value | Notes |
|--------|-------|-------|
| Hosts Compromised | | Unique hosts with access |
| Accounts Compromised | | Unique credentials obtained |
| Network Segments Reached | | Number of VLANs/subnets |
| Persistence Mechanisms | | Number of persistence methods established |
| Data Access Demonstrated | | Categories of data accessible |
## Technique Execution Log
| # | ATT&CK ID | Technique | Executed | Detected | Time to Detect | Tool Used |
|---|-----------|-----------|----------|----------|---------------|-----------|
| 1 | | | [ ] | [ ] | | |
| 2 | | | [ ] | [ ] | | |
| 3 | | | [ ] | [ ] | | |
## Phase Completion Tracking
| Phase | Start Date | End Date | Status | Key Findings |
|-------|-----------|----------|--------|-------------|
| | | | Not Started / In Progress / Complete | |
"""
return template
def display_threat_actor_table():
"""Display available threat actor profiles."""
table = Table(title="Available Threat Actor Profiles")
table.add_column("Actor", style="red bold")
table.add_column("Aliases", style="yellow")
table.add_column("Target Sectors", style="cyan")
table.add_column("Techniques", style="green")
for actor, profile in THREAT_ACTOR_PROFILES.items():
total_techniques = sum(
len(techs) for techs in profile["techniques"].values()
)
table.add_row(
actor,
", ".join(profile["aliases"]),
", ".join(profile["targets"]),
str(total_techniques),
)
console.print(table)
def display_engagement_types():
"""Display available engagement types."""
table = Table(title="Available Engagement Types")
table.add_column("Type", style="red bold")
table.add_column("Name", style="yellow")
table.add_column("Description", style="cyan")
table.add_column("Phases", style="green")
for etype, details in ENGAGEMENT_TYPES.items():
table.add_row(
etype,
details["name"],
details["description"],
str(len(details["phases"])),
)
console.print(table)
def export_attack_navigator_layer(threat_actor: str, output_path: str):
"""Export MITRE ATT&CK Navigator layer JSON for visualization."""
if threat_actor not in THREAT_ACTOR_PROFILES:
console.print(f"[red][-] Unknown threat actor: {threat_actor}[/red]")
return
profile = THREAT_ACTOR_PROFILES[threat_actor]
techniques = []
for tactic, techs in profile["techniques"].items():
for tech in techs:
techniques.append(
{
"techniqueID": tech["id"],
"tactic": tactic.lower().replace(" ", "-"),
"color": "#ff6666",
"comment": f"Emulated by {threat_actor}",
"enabled": True,
"score": 1,
}
)
layer = {
"name": f"{threat_actor} Emulation Plan",
"versions": {"attack": "14", "navigator": "4.9.1", "layer": "4.5"},
"domain": "enterprise-attack",
"description": f"Red team emulation plan based on {threat_actor} ({', '.join(profile['aliases'])}) TTPs",
"techniques": techniques,
"gradient": {
"colors": ["#ffffff", "#ff6666"],
"minValue": 0,
"maxValue": 1,
},
"legendItems": [
{"label": "Planned Technique", "color": "#ff6666"},
],
}
layer_path = Path(output_path) / f"{threat_actor.lower()}_navigator_layer.json"
with open(layer_path, "w") as f:
json.dump(layer, f, indent=2)
console.print(f"[green][+] ATT&CK Navigator layer exported to: {layer_path}[/green]")
def main():
parser = argparse.ArgumentParser(
description="Red Team Engagement Planning Automation Tool"
)
parser.add_argument("--org", required=True, help="Target organization name")
parser.add_argument(
"--type",
choices=ENGAGEMENT_TYPES.keys(),
default="full-scope",
help="Engagement type",
)
parser.add_argument(
"--duration", type=int, default=20, help="Engagement duration in days"
)
parser.add_argument("--start-date", help="Start date (YYYY-MM-DD)")
parser.add_argument("--threat-actor", help="Threat actor to emulate")
parser.add_argument("--output", default="./engagement_plan", help="Output directory")
parser.add_argument(
"--generate-attack-plan", action="store_true", help="Generate attack plan"
)
parser.add_argument(
"--generate-roe", action="store_true", help="Generate ROE document"
)
parser.add_argument(
"--generate-all", action="store_true", help="Generate all documents"
)
parser.add_argument(
"--list-actors", action="store_true", help="List available threat actors"
)
parser.add_argument(
"--list-types", action="store_true", help="List engagement types"
)
parser.add_argument(
"--export-navigator",
action="store_true",
help="Export ATT&CK Navigator layer",
)
args = parser.parse_args()
if args.list_actors:
display_threat_actor_table()
return
if args.list_types:
display_engagement_types()
return
output_dir = Path(args.output)
output_dir.mkdir(parents=True, exist_ok=True)
console.print(
Panel(
f"[bold red]Red Team Engagement Planner[/bold red]\n"
f"Organization: {args.org}\n"
f"Type: {args.type}\n"
f"Duration: {args.duration} days\n"
f"Threat Actor: {args.threat_actor or 'Not specified'}",
title="Configuration",
)
)
if args.generate_roe or args.generate_all:
console.print("[yellow][*] Generating Rules of Engagement...[/yellow]")
roe = generate_roe_document(
args.org, args.type, args.duration, args.start_date, args.threat_actor
)
roe_path = output_dir / "rules_of_engagement.md"
with open(roe_path, "w") as f:
f.write(roe)
console.print(f"[green][+] ROE document saved to: {roe_path}[/green]")
if args.generate_attack_plan or args.generate_all:
if args.threat_actor:
console.print("[yellow][*] Generating Attack Plan...[/yellow]")
plan = generate_attack_plan(
args.threat_actor, args.type, args.duration
)
plan_path = output_dir / "attack_plan.md"
with open(plan_path, "w") as f:
f.write(plan)
console.print(f"[green][+] Attack plan saved to: {plan_path}[/green]")
else:
console.print(
"[red][-] --threat-actor required for attack plan generation[/red]"
)
if args.generate_all:
console.print("[yellow][*] Generating Deconfliction Matrix...[/yellow]")
matrix = generate_deconfliction_matrix(args.org, args.duration)
matrix_path = output_dir / "deconfliction_matrix.md"
with open(matrix_path, "w") as f:
f.write(matrix)
console.print(f"[green][+] Deconfliction matrix saved to: {matrix_path}[/green]")
console.print("[yellow][*] Generating Metrics Template...[/yellow]")
metrics = generate_metrics_template(args.type)
metrics_path = output_dir / "engagement_metrics.md"
with open(metrics_path, "w") as f:
f.write(metrics)
console.print(f"[green][+] Metrics template saved to: {metrics_path}[/green]")
if args.export_navigator and args.threat_actor:
export_attack_navigator_layer(args.threat_actor, str(output_dir))
console.print("\n[bold green][+] Engagement planning documents generated successfully![/bold green]")
if __name__ == "__main__":
main()