executing-red-team-engagement-planning

Red team engagement planning follows four phases: pre-engagement scoping with stakeholders, threat modeling using MITRE ATT&CK, operational planning for infrastructure and OPSEC, and documentation with legal review and executive approval.

Rules of engagement should include scope definitions, restricted systems, communication and escalation channels, emergency stop procedures, legal authorization letters, data handling rules, and timelines with blackout windows.

Use MITRE ATT&CK Navigator to map threat actors relevant to your sector, such as APT29 for government or FIN7 for finance. Then map their TTPs to your attack surface and define an emulation plan with specific technique IDs.

Full scope engagements simulate complete adversaries across physical, social, and cyber vectors against the entire organization. Assumed breach starts from an internal foothold and focuses on post-exploitation within the internal network.

Common planning tools include MITRE ATT&CK Navigator for TTP mapping, VECTR for engagement tracking, PlexTrac for reporting, and SCYTHE for adversary emulation plan creation. Cobalt Strike or Nighthawk support C2 infrastructure design.

Planning should never be skipped for any offensive testing. Without signed authorization, defined scope, and deconfliction procedures, testing risks legal liability, business disruption, and SOC teams treating red team activity as real incidents.