Red Team Operations

When to Activate

• Simulating advanced persistent threat (APT) operations
• Testing detection and response capabilities
• Establishing persistent access and C2
• Evading EDR/AV/SIEM detection
• Privilege escalation on compromised hosts
• Data exfiltration planning

Initial Access

Phishing Payloads

# Office macro (VBA)
# - AutoOpen/Document_Open trigger
# - Download cradle: PowerShell IEX or certutil
# - Sandbox evasion: check domain join, user interaction delay