> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/getting-started/intro-to-red-teaming.md). # Intro to Red Teaming 'Red Teaming' is a type of security exercise designed to access how well an organization can detect and respond to cyber attack. A good dictionary definiation was provided by Joe Vest and James Tubberville in their book, Red Team Development Aand Operations. > Red Teaming is the process of using Tactics, Techniques and Prodedures (TTPs) to emulate a real-world threat, with the goal of measuring the effectiveness of the people, processes and technologies used to defend and environment. > > — Joe Vest and James Tubberville Red teams attempt to breach systems in the same way a real-life attacker would. * This could be through social engineering such as phishing or Physically breaking into a premises. #### Tactics, Techniques and Procedures **Tactics** - describe the why ? **Techniques** - describe the how ? **Procedures** - describe the specific steps an adversary will take to achieve their objective. *** **Tactics:** * A tactic is the overall tactical goal - the reason fr performing an action. \ Ex: Chaining multiple tactics together such as **privilege escalation**, **credential access**, and **lateral movement**. **Techniques:** * A techniques describes how an adversary will achieve a tactic. \ Ex: Access to credentials could be achieved by extracting them from LSASS memory or by reading them from unsecured locations on disk such as the **Registry**. **Procedures:** * A procedure describes the exact step-by-step process of how a technique is performed.\ Ex: Credentials could be read from LSASS using **Mimikatz** or the **Task Manager** #### Another way to visualise how TTPs relate to one-another is with a mind map:
#### Blue teams The role of a blue team is to defend an organization from attack. Some organizations have dedicated team such as a Security Operations Centre (SOC); others are made up of personnel from their IT teams; and others may outsource to a Managed Service Provider (MSP). * During a red team assessment, a blue team must detect and respond to the red team incursion via their incident management processes. * At the end of the assessment period, any gaps in detection and response capabilities are reviewed and (hopefully) improvements can be implemented. * Blue teams rely heavily on log telemetry from assets as workstations, servers and firewalls. * They must do their best to differentiate malicious and non-malicious activity accordingly. At the discretion of the client, a blue team may or may not be notified that a red team assessment is scheduled or is underway.