Anthropic-Cybersecurity-Skills/skills/conducting-full-scope-red-team-engagement/assets/template.md

# Red Team Engagement Report Template

## Document Control

| Field | Value |
|---|---|
| Engagement ID | RT-2025-XXX |
| Client Name | [Organization Name] |
| Report Date | YYYY-MM-DD |
| Classification | CONFIDENTIAL |
| Report Version | 1.0 |
| Lead Operator | [Name] |
| Reviewed By | [Name] |

---

## 1. Executive Summary

### 1.1 Engagement Overview

[Organization Name] engaged [Red Team Company] to conduct a full-scope red team assessment from [start date] to [end date]. The engagement simulated the tactics, techniques, and procedures (TTPs) of [Threat Actor], targeting [objectives].

### 1.2 Key Findings Summary

| # | Finding | Severity | Detected |
|---|---|---|---|
| 1 | [Finding Title] | Critical | No |
| 2 | [Finding Title] | High | Yes |
| 3 | [Finding Title] | High | No |
| 4 | [Finding Title] | Medium | Yes |

### 1.3 Overall Risk Rating

**[CRITICAL / HIGH / MEDIUM / LOW]**

The red team achieved [X of Y] defined objectives, with [Z]% of activities detected by the security operations center. Critical gaps were identified in [area 1], [area 2], and [area 3].

### 1.4 Metrics at a Glance

| Metric | Value |
|---|---|
| Total TTPs Executed | XX |
| Detection Rate | XX% |
| Mean Time to Detect | XX hours |
| Objectives Achieved | X/Y |
| Dwell Time (Undetected) | XX days |
| Unique Hosts Compromised | XX |
| Credentials Harvested | XX |

---

## 2. Scope and Rules of Engagement

### 2.1 Engagement Scope

**In-Scope:**
- Network ranges: [CIDR ranges]
- Domains: [domains]
- Physical locations: [if applicable]
- Personnel: [if social engineering in scope]

**Out-of-Scope:**
- [Systems/networks excluded]
- [Actions prohibited]

### 2.2 Rules of Engagement

- Authorization document reference: [RoE document ID]
- Approved hours of operation: [hours]
- Emergency contact: [name, phone]
- Deconfliction process: [description]

### 2.3 Threat Profile

**Emulated Adversary:** [Threat Actor Name]
- MITRE ATT&CK Group: [Group ID]
- Known Targets: [industries/regions]
- Typical TTPs: [summary of techniques]

---

## 3. Attack Narrative

### 3.1 Engagement Timeline

```
Day 1-5:   Reconnaissance and OSINT
Day 6-8:   Infrastructure setup and payload development
Day 9-12:  Initial access attempts
Day 13-20: Post-exploitation, lateral movement, persistence
Day 21-25: Objective pursuit and data exfiltration
Day 26-28: Cleanup and evidence collection
```

### 3.2 Phase 1: Reconnaissance

**Objective:** Identify attack surface and high-value targets

| Action | Technique | Result |
|---|---|---|
| Subdomain enumeration | T1593 | Found XX subdomains |
| Employee enumeration | T1589.002 | Identified XX employees |
| Credential search | T1589.001 | Found XX breached credentials |

**Key Discoveries:**
- [Discovery 1 with evidence]
- [Discovery 2 with evidence]

### 3.3 Phase 2: Initial Access

**Objective:** Establish initial foothold on target network

**Vector Used:** [T1566.001 Spearphishing / T1190 Exploit / etc.]

**Detailed Walkthrough:**
1. [Step 1 with screenshot reference]
2. [Step 2 with screenshot reference]
3. [Step 3 with screenshot reference]

**Detection Status:** [Detected/Undetected] by [source] at [time]

### 3.4 Phase 3: Post-Exploitation

**Objective:** Escalate privileges and establish persistence

| Action | Technique | Host | Result | Detected |
|---|---|---|---|---|
| Credential dump | T1003.001 | WS-XXX | Obtained X creds | Yes/No |
| Kerberoasting | T1558.003 | DC01 | Cracked X SPNs | Yes/No |
| Scheduled task | T1053.005 | WS-XXX | Persistence set | Yes/No |

### 3.5 Phase 4: Lateral Movement

**Objective:** Move toward crown jewel systems

**Attack Path:**
```
Initial Foothold (WS-042)
    └── Credential Reuse (T1078)
        └── File Server (FS01) via PsExec (T1021.002)
            └── Database Server (DB01) via RDP (T1021.001)
                └── Domain Controller (DC01) via DCSync (T1003.006)
```

### 3.6 Phase 5: Objective Achievement

| Objective | Status | Evidence |
|---|---|---|
| Domain Admin Access | Achieved | DCSync of krbtgt hash |
| PII Data Exfiltration | Achieved | 50MB exfiled over C2 |
| SCADA Network Access | Not Achieved | Network segmentation prevented access |

---

## 4. MITRE ATT&CK Mapping

### 4.1 Technique Heat Map

[Insert ATT&CK Navigator layer screenshot]

Navigator JSON file: `engagement_navigator.json`

### 4.2 Techniques Used

| Technique ID | Technique Name | Tactic | Used | Detected |
|---|---|---|---|---|
| T1566.001 | Spearphishing Attachment | Initial Access | Yes | Yes |
| T1059.001 | PowerShell | Execution | Yes | No |
| T1003.001 | LSASS Memory | Credential Access | Yes | Yes |
| T1558.003 | Kerberoasting | Credential Access | Yes | No |
| T1021.002 | SMB Admin Shares | Lateral Movement | Yes | No |
| T1003.006 | DCSync | Credential Access | Yes | Yes |
| T1041 | Exfil Over C2 Channel | Exfiltration | Yes | No |

---

## 5. Findings

### Finding 1: [Title]

| Field | Value |
|---|---|
| Severity | Critical |
| CVSS Score | 9.8 |
| Affected Systems | [list] |
| MITRE ATT&CK | [technique ID] |

**Description:** [Detailed description of the vulnerability or gap]

**Evidence:** [Screenshots, logs, proof of exploitation]

**Impact:** [Business impact assessment]

**Recommendation:** [Specific remediation steps]

---

## 6. Detection Gap Analysis

### 6.1 Summary

| Category | Count | Percentage |
|---|---|---|
| Actions Detected | X | XX% |
| Actions Undetected | X | XX% |
| Techniques with Zero Coverage | X | - |

### 6.2 Gaps by Tactic

| Tactic | Actions | Detected | Gap |
|---|---|---|---|
| Initial Access | X | X | XX% |
| Execution | X | X | XX% |
| Persistence | X | X | XX% |
| Credential Access | X | X | XX% |
| Lateral Movement | X | X | XX% |
| Exfiltration | X | X | XX% |

### 6.3 Priority Detection Rules Needed

1. **[Detection Rule Name]** - Detect [technique] via [data source]
2. **[Detection Rule Name]** - Detect [technique] via [data source]
3. **[Detection Rule Name]** - Detect [technique] via [data source]

---

## 7. Recommendations

### 7.1 Immediate (0-30 days)
1. [Critical remediation action]
2. [Critical remediation action]

### 7.2 Short-Term (30-90 days)
1. [High-priority improvement]
2. [High-priority improvement]

### 7.3 Long-Term (90-180 days)
1. [Strategic improvement]
2. [Strategic improvement]

---

## 8. Appendices

### Appendix A: Tools Used
| Tool | Purpose | Version |
|---|---|---|
| Havoc | C2 Framework | 0.7 |
| Impacket | AD Attacks | 0.11.0 |
| Rubeus | Kerberos Attacks | 2.3.0 |
| BloodHound | AD Reconnaissance | 4.3 |

### Appendix B: IOCs for Deconfliction
| Type | Value | Context |
|---|---|---|
| IP | X.X.X.X | C2 Server |
| Domain | c2.example.com | C2 Domain |
| Hash | [SHA256] | Payload |
| User-Agent | [string] | C2 Callback |

### Appendix C: Cleanup Confirmation
- [ ] All implants removed
- [ ] All persistence mechanisms removed
- [ ] All created accounts deleted
- [ ] All modified configurations restored
- [ ] Infrastructure decommissioned