## Red Team Operations

Red Teaming is not just "Running Nmap". It is a full-scope simulation.

### 1. Reconnaissance (OSINT)
*   Scraping LinkedIn to find system admins.
*   Looking for leaked credentials on the Dark Web.
*   Mapping external IP ranges (Shodan).

### 2. Weaponization & Delivery
*   Creating custom malware (avoiding signature detection).
*   Buying a look-alike domain (`cornpany.com`).
*   Sending the Spearphishing email.

### 3. Exploitation & Install
*   User clicks link.
*   Browser exploit runs.
*   Beacon (C2) installed.

### 4. Privilege Escalation
*   Local Admin -> Domain Admin.
*   Techniques: Kerberoasting, PrintNightmare.

### 5. Lateral Movement
*   Moving from "Bob from Accounting" to the "Swift Payment Server".

### 6. Actions on Objectives
*   Stealing the money. Encrypting the drive.

### Rules of Engagement (ROE)
A legal contract defining what Red Team is allowed to do.
*   **Limits**: "Do not attack the Production Database." "Do not phish the CEO."
*   **Emergency Contact**: If Red Team accidentally crashes a server, who do they call at 3 AM?