[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C5RGV15XMJDQV59B6Q2WM":3,"skill-same:01M71C5RGV15XMJDQV59B6Q2WM":58},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":37,"commitSha":38,"skillDirectory":39,"forksCount":14,"repositoryHtmlUrl":40,"repositoryHomepageUrl":6,"ownerHtmlUrl":41,"ownerBlogUrl":6,"ownerDescription":42,"updatedAt":43,"install":44,"resources":57},"01M71C5RGV15XMJDQV59B6Q2WM","red-team-tactics",null,"Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.","yqecea\u002Fgem-swarm","yqecea","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F196189405?v=4","01M71C12KWH5QPTE12J69335KF","Yusuf","01M71C12MFS3BRGNE5SSHB4DY9",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyqecea\u002Fgem-swarm\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fdomain\u002Fred-team-tactics\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30],"red team","team","red team tactics","red","ATT&CK","principles","read","reporting","ck","grep","detection","evasion","2026-11-10 10:12:30",false,"---\nname: red-team-tactics\ndescription: Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.\nallowed-tools: Read, Glob, Grep\n---\n\n# Red Team Tactics\n\n> Adversary simulation principles based on MITRE ATT&CK framework.\n\n---\n\n## 1. MITRE ATT&CK Phases\n\n### Attack Lifecycle\n\n```\nRECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE\n       ↓              ↓              ↓            ↓\n   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY\n       ↓              ↓              ↓            ↓\nLATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT\n```\n\n### Phase Objectives\n\n| Phase | Objective |\n|-------|-----------|\n| **Recon** | Map attack surface |\n| **Initial Access** | Get first foothold |\n| **Execution** | Run code on target |\n| **Persistence** | Survive reboots |\n| **Privilege Escalation** | Get admin\u002Froot |\n| **Defense Evasion** | Avoid detection |\n| **Credential Access** | Harvest credentials |\n| **Discovery** | Map internal network |\n| **Lateral Movement** | Spread to other systems |\n| **Collection** | Gather target data |\n| **C2** | Maintain command channel |\n| **Exfiltration** | Extract data |\n\n---\n\n## 2. Reconnaissance Principles\n\n### Passive vs Active\n\n| Type | Trade-off |\n|------|-----------|\n| **Passive** | No target contact, limited info |\n| **Active** | Direct contact, more detection risk |\n\n### Information Targets\n\n| Category | Value |\n|----------|-------|\n| Technology stack | Attack vector selection |\n| Employee info | Social engineering |\n| Network ranges | Scanning scope |\n| Third parties | Supply chain attack |\n\n---\n\n## 3. Initial Access Vectors\n\n### Selection Criteria\n\n| Vector | When to Use |\n|--------|-------------|\n| **Phishing** | Human target, email access |\n| **Public exploits** | Vulnerable services exposed |\n| **Valid credentials** | Leaked or cracked |\n| **Supply chain** | Third-party access |\n\n---\n\n## 4. Privilege Escalation Principles\n\n### Windows Targets\n\n| Check | Opportunity |\n|-------|-------------|\n| Unquoted service paths | Write to path |\n| Weak service permissions | Modify service |\n| Token privileges | Abuse SeDebug, etc. |\n| Stored credentials | Harvest |\n\n### Linux Targets\n\n| Check | Opportunity |\n|-------|-------------|\n| SUID binaries | Execute as owner |\n| Sudo misconfiguration | Command execution |\n| Kernel vulnerabilities | Kernel exploits |\n| Cron jobs | Writable scripts |\n\n---\n\n## 5. Defense Evasion Principles\n\n### Key Techniques\n\n| Technique | Purpose |\n|-----------|---------|\n| LOLBins | Use legitimate tools |\n| Obfuscation | Hide malicious code |\n| Timestomping | Hide file modifications |\n| Log clearing | Remove evidence |\n\n### Operational Security\n\n- Work during business hours\n- Mimic legitimate traffic patterns\n- Use encrypted channels\n- Blend with normal behavior\n\n---\n\n## 6. Lateral Movement Principles\n\n### Credential Types\n\n| Type | Use |\n|------|-----|\n| Password | Standard auth |\n| Hash | Pass-the-hash |\n| Ticket | Pass-the-ticket |\n| Certificate | Certificate auth |\n\n### Movement Paths\n\n- Admin shares\n- Remote services (RDP, SSH, WinRM)\n- Exploitation of internal services\n\n---\n\n## 7. Active Directory Attacks\n\n### Attack Categories\n\n| Attack | Target |\n|--------|--------|\n| Kerberoasting | Service account passwords |\n| AS-REP Roasting | Accounts without pre-auth |\n| DCSync | Domain credentials |\n| Golden Ticket | Persistent domain access |\n\n---\n\n## 8. Reporting Principles\n\n### Attack Narrative\n\nDocument the full attack chain:\n1. How initial access was gained\n2. What techniques were used\n3. What objectives were achieved\n4. Where detection failed\n\n### Detection Gaps\n\nFor each successful technique:\n- What should have detected it?\n- Why didn't detection work?\n- How to improve detection\n\n---\n\n## 9. Ethical Boundaries\n\n### Always\n\n- Stay within scope\n- Minimize impact\n- Report immediately if real threat found\n- Document all actions\n\n### Never\n\n- Destroy production data\n- Cause denial of service (unless scoped)\n- Access beyond proof of concept\n- Retain sensitive data\n\n---\n\n## 10. Anti-Patterns\n\n| ❌ Don't | ✅ Do |\n|----------|-------|\n| Rush to exploitation | Follow methodology |\n| Cause damage | Minimize impact |\n| Skip reporting | Document everything |\n| Ignore scope | Stay within boundaries |\n\n---\n\n> **Remember:** Red team simulates attackers to improve defenses, not to cause harm.\n","# Red Team Tactics\n\n> Adversary simulation principles based on MITRE ATT&CK framework.\n\n---\n\n## 1. MITRE ATT&CK Phases\n\n### Attack Lifecycle\n\n```\nRECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE\n       ↓              ↓              ↓            ↓\n   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY\n       ↓              ↓              ↓            ↓\nLATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT\n```\n\n### Phase Objectives\n\n| Phase | Objective |\n|-------|-----------|\n| **Recon** | Map attack surface |\n| **Initial Access** | Get first foothold |\n| **Execution** | Run code on target |\n| **Persistence** | Survive reboots |\n| **Privilege Escalation** | Get admin\u002Froot |\n| **Defense Evasion** | Avoid detection |\n| **Credential Access** | Harvest credentials |\n| **Discovery** | Map internal network |\n| **Lateral Movement** | Spread to other systems |\n| **Collection** | Gather target data |\n| **C2** | Maintain command channel |\n| **Exfiltration** | Extract data |\n\n---\n\n## 2. Reconnaissance Principles\n\n### Passive vs Active\n\n| Type | Trade-off |\n|------|-----------|\n| **Passive** | No target contact, limited info |\n| **Active** | Direct contact, more detection risk |\n\n### Information Targets\n\n| Category | Value |\n|----------|-------|\n| Technology stack | Attack vector selection |\n| Employee info | Social engineering |\n| Network ranges | Scanning scope |\n| Third parties | Supply chain attack |\n\n---\n\n## 3. Initial Access Vectors\n\n### Selection Criteria\n\n| Vector | When to Use |\n|--------|-------------|\n| **Phishing** | Human target, email access |\n| **Public exploits** | Vulnerable services exposed |\n| **Valid credentials** | Leaked or cracked |\n| **Supply chain** | Third-party access |\n\n---\n\n## 4. Privilege Escalation Principles\n\n### Windows Targets\n\n| Check | Opportunity |\n|-------|-------------|\n| Unquoted service paths | Write to path |\n| Weak service permissions | Modify service |\n| Token privileges | Abuse SeDebug, etc. |\n| Stored credentials | Harvest |\n\n### Linux Targets\n\n| Check | Opportunity |\n|-------|-------------|\n| SUID binaries | Execute as owner |\n| Sudo misconfiguration | Command execution |\n| Kernel vulnerabilities | Kernel exploits |\n| Cron jobs | Writable scripts |\n\n---\n\n## 5. Defense Evasion Principles\n\n### Key Techniques\n\n| Technique | Purpose |\n|-----------|---------|\n| LOLBins | Use legitimate tools |\n| Obfuscation | Hide malicious code |\n| Timestomping | Hide file modifications |\n| Log clearing | Remove evidence |\n\n### Operational Security\n\n- Work during business hours\n- Mimic legitimate traffic patterns\n- Use encrypted channels\n- Blend with normal behavior\n\n---\n\n## 6. Lateral Movement Principles\n\n### Credential Types\n\n| Type | Use |\n|------|-----|\n| Password | Standard auth |\n| Hash | Pass-the-hash |\n| Ticket | Pass-the-ticket |\n| Certificate | Certificate auth |\n\n### Movement Paths\n\n- Admin shares\n- Remote services (RDP, SSH, WinRM)\n- Exploitation of internal services\n\n---\n\n## 7. Active Directory Attacks\n\n### Attack Categories\n\n| Attack | Target |\n|--------|--------|\n| Kerberoasting | Service account passwords |\n| AS-REP Roasting | Accounts without pre-auth |\n| DCSync | Domain credentials |\n| Golden Ticket | Persistent domain access |\n\n---\n\n## 8. Reporting Principles\n\n### Attack Narrative\n\nDocument the full attack chain:\n1. How initial access was gained\n2. What techniques were used\n3. What objectives were achieved\n4. Where detection failed\n\n### Detection Gaps\n\nFor each successful technique:\n- What should have detected it?\n- Why didn't detection work?\n- How to improve detection\n\n---\n\n## 9. Ethical Boundaries\n\n### Always\n\n- Stay within scope\n- Minimize impact\n- Report immediately if real threat found\n- Document all actions\n\n### Never\n\n- Destroy production data\n- Cause denial of service (unless scoped)\n- Access beyond proof of concept\n- Retain sensitive data\n\n---\n\n## 10. Anti-Patterns\n\n| ❌ Don't | ✅ Do |\n|----------|-------|\n| Rush to exploitation | Follow methodology |\n| Cause damage | Minimize impact |\n| Skip reporting | Document everything |\n| Ignore scope | Stay within boundaries |\n\n---\n\n> **Remember:** Red team simulates attackers to improve defenses, not to cause harm.\n",{"name":5,"description":7,"allowed-tools":36},"Read, Glob, Grep","main","923c514d4d5e15bbfd65ec7eaf949a997679aa3e","src\u002Fskills\u002Fdomain\u002Fred-team-tactics","https:\u002F\u002Fgithub.com\u002Fyqecea\u002Fgem-swarm","https:\u002F\u002Fgithub.com\u002Fyqecea","15 y.o Data Science,Student","2026-04-26 20:00:27",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add yqecea\u002Fgem-swarm --skill red-team-tactics",{"tool":50,"command":51},"bunx","bunx skills add yqecea\u002Fgem-swarm --skill red-team-tactics",{"tool":53,"command":54},"pnpm","pnpm dlx skills add yqecea\u002Fgem-swarm --skill red-team-tactics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fyqecea\u002Fgem-swarm\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fdomain\u002Fred-team-tactics\u002FSKILL.md",true,[],[59,73,87,98,110,135],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":31},"01M71C74XVPP23ST10E8MYJZA0","validation","Cross-cutting validation methodology for verifying phase outputs and project integrity","https:\u002F\u002Fgithub.com\u002Fyqecea\u002Fgem-swarm\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fshared\u002Fvalidation\u002FSKILL.md",[],[61,66,67,68,69,70,71,72],"validation methodology","for","project","outputs","phase","methodology","integrity",{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":31},"01M71C72PTKRV481M975R3QDDE","session-management","Manages orchestration session state, tracking, and resumption","https:\u002F\u002Fgithub.com\u002Fyqecea\u002Fgem-swarm\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fshared\u002Fsession-management\u002FSKILL.md",[],[80,81,82,83,84,85,86],"session management","session","management","session state","orchestration","state","tracking",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":31},"01M71C6ZY1EGM4SGVYT4B2HHD7","implementation-planning","Generates detailed implementation plans from finalized designs","https:\u002F\u002Fgithub.com\u002Fyqecea\u002Fgem-swarm\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fshared\u002Fimplementation-planning\u002FSKILL.md",[],[94,95,96,97],"planning","implementation","implementation planning","plans",{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":31},"01M71C6XQVGMDFJ50BP5SBDS76","execution","Phase execution methodology for orchestration workflows with error handling and completion protocols","https:\u002F\u002Fgithub.com\u002Fyqecea\u002Fgem-swarm\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fshared\u002Fexecution\u002FSKILL.md",[],[100,67,71,105,106,84,70,107,108,109],"error","workflows","protocols","error handling","with",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":126,"publishedAt":31},"01M71C6VY8APWMNK1XEJ3WP7A2","design-dialogue","Guides structured design conversations for complex engineering tasks","https:\u002F\u002Fgithub.com\u002Fyqecea\u002Fgem-swarm\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fshared\u002Fdesign-dialogue\u002FSKILL.md",[116,121],{"categoryNo":117,"categoryName":118,"taxonomyType":119,"taxonomyTypeDesc":120},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":122,"categoryName":123,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[127,128,129,130,131,67,132,133,134],"dialogue","design","design dialogue","guides","conversations","tasks","engineering","structured",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":147,"publishedAt":31},"01M71C6R4RJWG3S2R26778TPD8","delegation","Agent delegation best practices for constructing effective subagent prompts with proper scoping","https:\u002F\u002Fgithub.com\u002Fyqecea\u002Fgem-swarm\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fshared\u002Fdelegation\u002FSKILL.md",[141,144],{"categoryNo":142,"categoryName":143,"taxonomyType":119,"taxonomyTypeDesc":120},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":145,"categoryName":146,"taxonomyType":119,"taxonomyTypeDesc":120},"01JBSEEDCAT000000000000023","Skill与智能体开发",[137,148,149,67,150,109,151],"subagent","scoping","best practices","prompts"]