Full-Scope Red Team Engagement
Plan and run an ATT&CK-mapped red team exercise testing an organization's detection and response
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
This skill teaches an AI agent how to plan and document a full red team exercise, where a authorized team simulates a realistic attacker moving from reconnaissance through initial access, privilege escalation, lateral movement, and data theft to test whether an organization's defenders notice and respond. The agent gets a structured six-phase workflow mapped to the MITRE ATT&CK framework, example tool commands, a reporting template, and Python helpers that track actions, detection gaps and metrics. It is aimed at security professionals and is explicitly a planning and reporting aid, not a tool that attacks anything by itself.
Great for
- Security teams scoping an authorized, objective-based red team or purple team exercise
- Consultants who need a structured ATT&CK-mapped engagement plan and final report
- Teams wanting to emulate a specific threat actor's techniques against their own defenses
Skip it if
- Anyone without written authorization: the commands describe real intrusion techniques (credential dumping, DCSync, phishing payloads) and running them against systems you do not own or have permission to test can be illegal under laws such as the CFAA
- Beginners hoping to learn hacking from scratch: the skill assumes professional context and gives commands without much teaching
- Production environments without a rules-of-engagement document and emergency stop plan, since the exercise could cause outages or data exposure
Try asking
- “Help me draft a red team engagement plan emulating APT29 against our corporate network, with ATT&CK mapping per phase”
- “Build a reporting template with detection gap analysis for our completed red team exercise”
- “Create a tracker for logging red team actions, timestamps and whether our SOC detected each one”
- “List ATT&CK techniques for the Credential Access and Lateral Movement tactics to scope our purple team test”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
conducting-full-scope-red-team-engagement.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip conducting-full-scope-red-team-engagement.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip conducting-full-scope-red-team-engagement.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Have the agent produce the Rules of Engagement and scope document first and confirm authorization before any technical step
- Ask for planning, mapping and reporting outputs rather than live attack commands, and review every command before running it
- Review scripts/agent.py and scripts/process.py yourself before execution, since the agent will run them and agent.py queries the live MITRE ATT&CK data source over the internet
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.