Red team tradecraft primitives. See red-team-operations for path ordering.

Opsec / infra

• opsec-fundamentals · c2-protocol-design
• infrastructure-design · payload-staging
• c2-frameworks · metasploit-fundamentals

C2 framework deep dives

• sliver-c2-deep
• sliver-extension-development
• havoc-c2-deep
• mythic-framework-deep

Initial access (client-side)

• client-side-attacks-primer
• office-vba-macros-initial-access
• jscript-hta-wsh-initial-access
• phishing-infrastructure-design
• pretext-design-for-engagements
• hardware-implants-and-badusb

Post-macro phishing formats

• modern-phishing-payload-formats-post-vba
• msix-and-appx-as-malware-delivery
• onenote-and-modern-document-formats-payload-delivery

Modern AitM / MFA-bypass phishing

• aitm-evilginx-modern-phishing
• oauth-device-code-phishing-m365
• mfa-fatigue-tradecraft
• tycoon2fa-and-modern-phish-kits
• conditional-access-bypass-modern

Physical and SE

• physical-pentest-tradecraft

Network filter bypass

• dns-c2-and-icmp-c2
• dns-tunneling-deep-with-modern-tools
• domain-fronting-and-cdn-abuse
• modern-tunnelling-chains-chisel-ligolo-gost
• wsl-and-wsl2-as-attack-vector

Allowlisting bypass

• applocker-bypass-techniques

Post-exploitation (Linux)

• linux-post-exploitation-tradecraft

Edge-case scenarios

• kiosk-breakout-techniques

Reporting

• report-writing-for-pentesters

Engagement lifecycle

• pentest-proposal-and-scoping
• pentest-engagement-execution
• pentest-report-writing-deep
• pentest-debrief-and-followup
• red-team-vs-pentest-engagement-shape

Evasion

• amsi-bypass · amsi-providers-tampering
• etw-bypass · wldp-bypass
• edr-hooks-and-unhooking
• anti-debugging-windows
• syscall-direct-and-indirect
• living-off-the-land
• living-off-the-land-binaries-lolbas

Evasion — deep dives

• amsi-memory-patching-deep
• etw-tampering-deep
• hells-halos-tartarus-gates-comparison
• syswhispers-freshycalls-comparison
• bof-cobalt-strike-development

OSEP / PEN-300 cluster

• osep-exam-strategy-and-pacing
• osep-payload-development-toolkit
• osep-network-filter-bypass-techniques
• osep-ad-attack-chain-walkthrough

Execution & loaders

• dll-side-loading · com-hijacking
• parent-pid-spoofing
• process-injection-techniques
• file-transfer-techniques · shell-upgrade-techniques

Credential access

• password-cracking-toolkit

Pivoting

• pivoting-and-tunneling

Persistence

• persistence-techniques-windows
• ad-persistence
• registry-run-keys-persistence
• wmi-event-subscription-persistence
• ifeo-debugger-persistence
• appinit-dlls-persistence
• netsh-helper-dll-persistence
• screensaver-persistence
• accessibility-stickykeys-persistence

Enterprise infrastructure tradecraft

• sccm-misconfiguration-manager

Adversary feedback

• purple-team-feedback-loop
• ad-recon-low-noise
• edr-rules-as-code-from-attack-patterns

Linux runtime tradecraft

• ebpf-offensive-and-defensive