Improving Red Team Maturity Through Red Team as Code

The speaker, a red teamer who has played in collegiate red-versus-blue competitions, describes how hand-built bash one-liners struggled to compromise a large environment in minutes. From those events he identifies four problems that also apply to real engagements: reliability at high callback volume, repeatability for training and detection testing, onboarding of new team members, and speed.

He proposes using infrastructure-as-code tooling as a command-and-control layer and reports three years of running Ansible this way. Its strengths were scale, rerunnable discrete tasks, readable YAML that documents itself, and version history that shows how techniques changed from year to year. The drawbacks were heavy logging artifacts, a need for remote management services and credentials that an attacker rarely holds, and weak support for in-memory execution. To address these, he presents Realm, a C2 framework whose Rust agent embeds a Python-like interpreter. Techniques are written as scripts that can be tested locally, uploaded through a GraphQL API, and tasked to beacons. Logging records who ran what and when, the server is stateless on a managed database, and finished scripts can be exported as standalone test cases for detection engineers.

The live demo built a script that enumerates user home directories and collects private SSH keys. The speaker notes that it would need hardening before production use. The takeaway for practitioners is that encoding techniques as versioned, reusable code can make red team operations more repeatable, easier to hand off, and easier to validate against detections. The project is open for anyone to find on GitHub.