# red-team-tactics

This skill organizes adversary simulation around MITRE ATT&CK and helps document findings. Use it to plan attack phases and examine gaps in detection.

- skill · `type=skill` · Claude Code · 177 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/red-team-tactics
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/red-team-tactics

## What it does

The skill maps a simulated attack from reconnaissance and initial access through lateral movement, collection, and impact. Its guidance covers access options, privilege escalation, and defense evasion on Windows and Linux, along with Active Directory attack categories.

It also outlines how to report a test: record the attack chain, techniques used, objectives reached, and points where detection failed. The available file tools are `Read`, `Glob`, and `Grep`. Keep the exercise within its agreed scope; the skill says to minimize impact and not go beyond proof of concept.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/red-team-tactics
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill red-team-tactics -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/red-team-tactics/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/red-team-tactics/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/red-team-tactics/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/red-team-tactics/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates red-team-tactics
```

2. **Manually: put the files in place**
- File: `.github/skills/red-team-tactics/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/red-team-tactics
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/red-team-tactics/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/red-team-tactics

## When to use it
- structure a test plan around MITRE ATT&CK phases
- compare initial access options against an exercise scenario
- review privilege escalation checks for Windows and Linux
- record detection gaps in a red-team report

## Example prompts
- Plan a scoped adversary simulation using MITRE ATT&CK phases.
- Review privilege escalation checks for a Windows and Linux assessment.
- Help me document the attack chain and detection gaps in this report.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md