External red team methodology

The Strobes red team uses MITRE ATT&CK-aligned TTPs to:

• Validate detection and response capabilities
• Identify vulnerabilities in exposed assets (web apps, cloud, APIs)
• Provide actionable insights to harden defenses

Objectives vary with the purpose of the exercise and the environment. They typically target enterprise environments such as Active Directory, federation services, and cloud platforms like Azure or AWS, and are customized further to the customer's environment. They are not limited to the following:

• Cloud admin credential cracking
• AD domain admin credential cracking
• Credentials of admins to applications
• Unauthenticated access or password resets
• User account hijacking and compromise
• Shell upload and reverse shell access
• Access to a CXO mailbox and email exfiltration
• Password list: 300+ non-admin user IDs and passwords
• Customer PII data (GBs of data or 100+ records)
• Confidential IT system information (GBs of data or 50+ records)
• Confidential business information, non-customer (GBs of data)
• Weaponize and install recon software on 10+ systems
• Cloud services exploitation
• Lateral movement on cloud systems
• Successful C2 (command and control) establishment
• Access to payroll data (100+ records)
• Phishing to gain access to high-profile users
• Emulate a user's privileges to identify over-privileged accounts
• Webpage defacement by uploading a predefined error page
• Bypass host-based controls to execute specific payload types
• Execute sample ransomware payloads to assess detection and response

The Strobes red team emulates the TTPs used by threat actors across the following phases, depending on the goals set by the customer.

Passive, OSINT-driven mapping of the external attack surface before any active testing.

• Conduct passive reconnaissance using OSINT tools (e.g., Shodan, Censys) to gather critical data about the target
• Map external assets, subdomains, and IP ranges, and identify exposed credentials from past breaches
• Analyze sensitive configurations and public code repositories, and detect misconfigured cloud services
• Gather leaked credentials and employee data from breach repositories

Identify and prioritize high-impact weaknesses across internet-facing services and applications.

• Use tools such as Nmap, Burp Suite, Nuclei, and Nikto to detect open ports, outdated software, and unpatched or misconfigured services
• Correlate findings with CVE databases, MITRE ATT&CK, and exploit frameworks to prioritize high-impact vulnerabilities
• Uncover weak configurations on internet-facing services (e.g., default credentials, overly permissive access, SCM leaks)
• Perform dynamic analysis on web, mobile, and API endpoints to detect injection flaws (SQLi, XSS), authentication bypasses, and broken access controls

Convert exposure into a foothold through applications, misconfigured cloud assets, and people.

• Exploit vulnerable applications, exposed services, and misconfigured cloud assets for initial access
  • Examples: SSRF in AWS EC2, SQLi in Azure-hosted apps, exposed S3 buckets, or default admin credentials in Apache Tomcat
• Conduct phishing campaigns using custom payloads or malicious URLs to harvest credentials or deploy malware
• Exploit Active Directory (e.g., weak ACLs, trust misconfigurations) to compromise domain resources

Maintain access across reboots, credential rotations, and cloud identity changes.

• Deploy backdoors or web shells to establish persistence within the environment
• Abuse MFA bypass techniques or create C2 servers that interact with accounts, systems, and servers in the infrastructure
• Register rogue applications in Azure AD or OAuth apps to maintain long-term access via valid tokens
• Deploy malicious Lambda or Azure Functions with elevated permissions to act as cloud backdoors
• Modify or create custom IAM policies in AWS or role assignments in Azure to maintain hidden administrative access
• Use Golden Ticket attacks in AD to generate ticket-granting tickets (TGTs) for long-term domain persistence
• Exploit Azure service principals by stealing or persisting client secrets to keep access to critical resources
• Insert malicious scripts in GPOs or scheduled tasks in AD to execute code repeatedly and maintain persistence

Move between trust boundaries across on-premises, hybrid, and cloud environments.

• Exploit trusted relationships between AD forests, domains, or Azure AD tenants to reach resources in connected environments
• Use token theft (e.g., Azure AD refresh tokens, AWS STS tokens) to impersonate users or services in cloud environments
• Exploit shared credentials stored in Azure Key Vault, AWS Secrets Manager, or other secret management tools to reach additional cloud resources
• Abuse Active Directory replication protocols like DCSync to extract credentials in on-premises or hybrid AD
• Use Kerberos ticket attacks (e.g., Silver Ticket or Pass-the-Ticket) to reach resources within an AD domain
• Exploit Azure AD conditional access policy misconfigurations to bypass restrictions and reach restricted resources
• Pivot through compromised jump boxes, misconfigured bastion hosts, or VPN gateways to reach isolated networks

Escalate from a foothold to privileged control across identity and cloud.

• Exploit over-permissioned IAM roles or service accounts (e.g., AdministratorAccess in AWS or Owner in Azure)
• Abuse Azure AD Privileged Identity Management (PIM) misconfigurations to activate elevated roles without proper approvals or MFA
• Use trust relationships in hybrid environments to move from on-premises AD to cloud via synchronized accounts or compromised federation services (e.g., ADFS)
• Exploit password synchronization flaws between AD and cloud to reuse compromised on-premises credentials for cloud escalation
• Enumerate and abuse managed identities or access tokens (e.g., Azure Managed Identities or AWS STS tokens) to gain elevated access
• Use Azure Resource Manager (ARM) template manipulation to elevate permissions by deploying privileged resources
• Exploit Group Policy Objects (GPOs) in AD to push scripts or modify user rights to escalate privileges
• Abuse Kerberos delegation (e.g., unconstrained or resource-based constrained delegation) to impersonate privileged users
• Exploit misconfigured service principal credentials or exposed secrets (e.g., Azure app registrations or AWS Lambda environment variables)
• Use Golden SAML attacks in federated environments to forge authentication tokens and escalate to privileged cloud roles

Move target data out under realistic evasion conditions to test DLP and EDR.

• Simulate exfiltration over encrypted channels such as HTTPS, SFTP, or TLS to avoid detection by DLP systems and EDRs
• Use cloud storage (e.g., AWS S3, Azure Blob, Google Drive) or SaaS platforms (e.g., Dropbox, OneDrive) that are often trusted and excluded from monitoring
• Use DNS tunneling, ICMP traffic, or covert HTTP headers to move data through unconventional paths
• Split large files into smaller chunks or encode them (e.g., Base64, gzip) to avoid size-based DLP rules and signature-based EDR detection
• Use time-based techniques such as slow-drip transfer or off-hours exfiltration to bypass behavioral DLP and EDR

Demonstrate business impact safely, within customer-defined boundaries.

• Simulate data destruction or file-wiping scenarios to test the ability to detect and respond to critical data loss
• Use frameworks such as CALDERA or Atomic Red Team to emulate sophisticated attack chains and validate detection against real-world scenarios
• Customize attack payloads for specific organizational assets to test targeted incident response, including APT-style chains, with attention to evading EDR and SIEM while staying within customer-defined boundaries

This methodology sets out how the Strobes red team assesses and simulates real-world cyber threats, covering reconnaissance, exploitation, persistence, lateral movement, privilege escalation, data exfiltration, and impact simulation. By using advanced attack techniques and evasion strategies, organizations can measure their security posture against sophisticated adversaries. The insights help strengthen detection, response, and mitigation, and regular assessments drive continuous improvement, reducing the risk of breaches and operational disruption.