Becoming a Red Team Operator

The talk opens by separating penetration testing, which tries to find as many weaknesses as possible with little concern for being noticed, from red teaming, which is organized around reaching a defined objective while staying hidden. The speaker argues that a red team must record who saw each action, from where, and when, and that a successful intrusion also exposes gaps in detection and response, not just technical flaws.

The middle of the talk covers the operator's working toolkit. Kill chain stages and MITRE ATT&CK help map activity, and the Pyramid of Pain shows how costly it is for defenders' detections to force changes in tooling. Infrastructure is the main focus: administration ports should stay closed to the internet, nginx redirectors can filter requests by path or user agent, and beacon sleep and jitter help traffic blend into normal baselines. A side-by-side capture contrasts a constant reverse shell with a Mythic agent that checks in on a schedule. Several common tools are flagged for quiet behaviour that can expose operators, including verification in TruffleHog and default checks in Pacu.

The closing section turns to reporting and collaboration. Phishing results are framed with the NIST Phish Scale, and engagement timelines and heat maps are kept in Vector so that blue teams can add their own findings. The speaker also addresses using insider knowledge fairly within a time box and treating SOC analysts as customers. The main takeaway is to keep records of failed attempts as well as successes, and to leave the defenders better prepared than before the engagement.