Red Team Engagement and Attack Path Planning
Build scoped red team plans with attack paths, ATT&CK mappings, technique scores, safety gates, and detection tests.
Before & after
Same prompt, same agent — the only difference is the skill.
Red team engagements simulate real-world attacks to test defenses. Here's a general structure: 1. **Scoping** — define rules of engagement, targets, and boundaries 2. **Reconnaissance** — gather information about the target 3. **Initial access** — find a way in (phishing, exposed services) 4. **Privilege escalation** — gain higher access 5. **Lateral movement** — move through the network 6. **Objective** — reach the defined goal (data, systems) 7. **Reporting** — document findings and recommendations Make sure you have written authorization before beginning any engagement, and clearly defined rules of engagement to stay within legal and ethical bounds. What's the scope of your engagement?
Authorized engagement — assuming signed ROE and scope on file. First
question back: what's the crown jewel? An engagement without a defined
objective wanders. Everything below assumes "customer PII in prod DB."
CROWN JEWEL → WORK BACKWARD
Target: prod customer DB. Map the attack paths that reach it, then pick
the one with the lowest OPSEC risk, not the flashiest.
ATT&CK KILL-CHAIN PLAN
Initial Access T1566 phishing (likely) vs T1190 exposed service
Score by detection risk: phishing trips the SOC less
than scanning your perimeter does.
Execution T1059 — living-off-the-land, not custom malware
Persistence T1053 scheduled task — minimal, objective-scoped
PrivEsc T1068 / T1078 — valid accounts beat exploits on OPSEC
Lateral Movement T1021 — the choke point analysis below
Collection DB access → objective
CHOKE POINTS — where the whole path funnels
The path to prod almost certainly routes through:
• a jump host / bastion, and
• a service account with DB creds
Both are single points the defense can watch. If you can't get through
the bastion undetected, the rest of the plan doesn't matter — pressure-
test that first, before burning a phish.
OPSEC RISK RANKING
HIGH network scanning, credential brute force, new binaries on disk
LOW valid-account reuse, LOLBins, DB access during business hours
Prefer low. The goal is to test detection, and getting caught on recon
tests nothing.
CROWN-JEWEL TARGETING
Don't touch the DB until you have a clean, repeatable path. The
objective is demonstrating the path exists, not exfiltrating the most
rows.
REPORTING FRAME
Every finding maps to an ATT&CK technique + the specific detection that
should have fired and didn't. That's what makes the report actionable
for the blue team rather than a war story.
Confirm the crown jewel and I'll score the two initial-access options in
detail.About this skill
Your red team plan lists techniques, but does the path actually reach the target? This skill turns an authorized objective into a defensible engagement plan, exposing missing privileges, unsupported transitions, operational risks, and the evidence needed to prove success.
What it does
- Defines crown-jewel objectives with observable success conditions and safe proof methods.
- Builds attack paths around identity, access, network reachability, and trust boundaries.
- Scores candidate techniques for environment fit, detection likelihood, operational risk, and evidence confidence.
- Maps planned behaviors to MITRE ATT&CK without treating its tactics as a mandatory sequence.
- Identifies choke points and attaches prerequisites, telemetry expectations, and stop conditions to each transition.
- Separates attempted actions, demonstrated access, observed detection, and completed response in the final findings.
What you get
A scoped engagement plan or focused path review, sized to your request. Full plans include rules-of-engagement gaps, a primary path, bounded alternatives, a detection validation matrix, and cleanup requirements.
Best for
Internal red teams, purple teams, security consultants, and security leads planning authorized adversary simulations or reviewing whether an attack path is feasible and worth testing.
SKILL.md preview
---
name: red-team-engagement-and-attack-path-planning
description: Designs authorized red team engagements by translating crown-jewel objectives into prerequisite-checked attack paths, MITRE ATT&CK mappings, technique scores, and measurable detection tests. Use when the user says "plan a red team engagement", "map an attack path to our crown jewels", "review our rules of engagement", "score these ATT&CK techniques", "where are the choke points", "our attack chain keeps breaking at lateral movement", or "turn this into a purple team exercise".
---
# Red Team Engagement and Attack Path Planning
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.