domains / families / security / executing-red-team-exercise

executing-red-team-exercise

separate

'Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization''s

When to use

• Assessing an organization's ability to detect, respond to, and contain a realistic adversary operation
• Testing the effectiveness of the security operations center (SOC), incident response team, and threat hunting capabilities
• Validating security investments by simulating attacks that chain multiple vulnerabilities and techniques
• Evaluating the organization's security posture against specific threat actors (nation-state, ransomware groups, insider threats)
• Meeting regulatory requirements for adversary simulation (TIBER-EU, CBEST, AASE, iCAST)

When not to use

• Use without executive-level authorization and a detailed Rules of Engagement document
• Use against systems where disruption could affect safety or critical operations
• Use as a replacement for basic vulnerability management

Skill page

Source