Consulting · Red teaming
Red teaming: would your team spot a real attack?
We pursue an agreed goal the way real attackers do, through people, processes and technology. So you see whether detection and response hold up when it matters.
Red teaming by snapSEC GmbH is a realistic attack simulation with a goal defined in advance, such as access to a business application. We combine social engineering, phishing, lateral movement and Active Directory exploitation and keep adapting our tactics, as real attackers do. Companies in Austria, Germany and Switzerland learn whether their blue team or SOC detects the attack, with optional joint purple teaming.
Engagement brief · RT-03
ConfidentialGoal
Read access to the ERP system
- Client
- beispiel-gmbh.at
- In the know
- 2 people (white team)
Agreed
- Spear phishing
- Social engineering
- Lateral movement
- Active Directory
Excluded
- Disrupting operations
- Changing production data
Phase 3 of 5Lateral movement
- Reconnaissance
- Initial Access
- Lateral Movement
- Objective
- Debrief
Insights
What your blue team and SOC learn
Red teaming shows not only that an attack worked, but also where your detection and your processes need to improve.
- Which steps of the attack were detected and which were not
- Where alerts are missing, or fired but were not escalated
- How well escalation paths and responsibilities work in a real case
- Which detection rules and hardening measures have the greatest effect
At a glance
Red teaming- Goal
- Defined in advance, for example access to business applications
- Attack paths
- Social engineering, phishing, lateral movement and Active Directory exploitation
- Approach
- Tactics, techniques and procedures (TTPs) of real attackers, adapted as we go rather than following a checklist
- Option
- Purple teaming with your blue team or SOC to improve detection and response
- Result
- Documented attack path and concrete ways to improve your defence
- Provider
- snapSEC GmbH, Vorchdorf (Austria), for Austria, Germany and Switzerland
How it differs
Pentest or red teaming?
A pentest looks for as many vulnerabilities as possible in defined systems. A red team looks for a way to the goal and tests your defence on the way.
| Criterion | Penetration testsnapSEC Consulting | Red teamingsnapSEC Consulting · This page |
|---|---|---|
| Key question | Where are the vulnerabilities in these systems? | Can an attacker reach our goal, and would we notice? |
| Scope | Defined systems, as completely as possible | One goal, every realistic path to it |
| Attack paths | Technical testing of network, applications, AD and cloud | Technology, social engineering and phishing combined |
| Who knows? | The IT team is informed and supports the test | Only a small circle; everyone else responds as in a real incident |
| Result | Findings with risk ratings and recommendations | Attack path and concrete ways to improve detection and response |
Only want to test phishing?Go to social engineering
Process
An attack in five phases
This is how a red teaming engagement can unfold. Each phase adapts to what we find, just like a real attack.
beispiel-gmbh.at
Goal: Read access to the ERP system
Reconnaissance
Scouting the target
Gathering public information about the company, people and systems, the way an attacker would.
Red team Public sources on beispiel-gmbh.at analysed
Blue team / SOCNot visible
Initial Access
Getting a foothold
A foot in the door, for example via spear phishing or social engineering.
Red team Spear phishing to 12 selected recipients
Blue team / SOCNot detected
Lateral Movement
Moving through the network
Spreading through the network and exploiting Active Directory, quietly and step by step.
Red team Service account taken over, access to 3 servers
Blue team / SOCAlert, not escalated
Objective
Reaching the goal
The agreed goal is reached, or the attempt is documented, with every step of the attack path.
Red team Read access to the ERP system
Blue team / SOCNot detected
Debrief
Debrief and purple teaming
We show you the attack path. Optionally we walk through it with your blue team and SOC to improve detection.
Red team Attack path replayed together
Blue team / SOCDetection added
Before we start
We agree goal and rules together
Red teaming is realistic, but never uncontrolled. These points are settled before the first step is taken.
Rules of engagement
Approved before the startThe goal
What should an attacker achieve? For example access to a business application or to sensitive data.
Who is in the know
You decide who knows. Everyone else experiences the attack as they would a real incident.
The attack paths
Social engineering, phishing, lateral movement, Active Directory: we agree which of these are used.
Limits and stopping
Which systems are excluded and when the engagement is paused is settled in advance.
The time frame
The engagement window is agreed. Activities outside normal working hours by arrangement.
Named contacts
A named contact on each side, so questions can always be cleared up quickly.
Purple teaming
Improve detection together
In purple teaming, the red team and the defenders work together instead of against each other. We walk through the attack path with your blue team or SOC and improve detection rules and response on the spot.
You receive
- Documentation of the attack path, step by step
- Concrete ways to improve detection and response
- Optional purple teaming workshop with your blue team or SOC
Purple teaming is also available as an extension of ACDC – Active Cyber Defense Center, the managed SOC for 24/7 monitoring.
More about ACDCDebrief log
Finding 3 of 7Phase 4 · Access to the ERP system
Observed
Read access to the ERP system by a taken-over service account, no alert.
Adjusted
Detection rule for unusual access by service accounts added together with the SOC.
Repeated
Step executed again, alert fired and escalated.
FAQ
Frequently asked questions about red teaming
What is the difference between a pentest and red teaming?
A penetration test checks defined systems as completely as possible for vulnerabilities, and the IT team is informed. Red teaming instead pursues an agreed goal, such as access to a business application, and combines technical and human attack paths like social engineering, phishing and lateral movement. Only a small circle knows. This shows whether your blue team or SOC detects a real attack and responds correctly.
Which companies is red teaming suitable for?
Red teaming suits companies that already run protective measures such as endpoint protection, a SIEM or a SOC and want to know whether they work together. It tests people, processes and technology at once. If basic vulnerabilities are still unknown, a penetration test is usually the better first step. In the first call we will tell you honestly where you should start.
Do you use phishing and social engineering?
Yes, phishing and social engineering can be part of the scenario, usually as the route to initial access. We agree in advance which methods are used. If you specifically want to measure how your staff respond to deception, a dedicated spear-phishing simulation or a media drop test with USB sticks or QR codes is the better fit. The two can also be combined.
What is purple teaming?
In purple teaming the red team and the defenders work together instead of against each other. We walk through the attack path with your blue team or SOC, check step by step what was detected and improve detection rules and response on the spot. At snapSEC purple teaming is available as an add-on to red teaming. Customers of ACDC – Active Cyber Defense Center can also add it as an optional extension of the managed SOC.
Who in our company knows about the test?
You decide. A small circle is usual, for example management and the people responsible for security, who approve the engagement and can step in if needed. Everyone else, including the blue team and SOC, experiences the attack as a real incident. Only then does it show whether detection and escalation really work. We record together who is in the know before we start.
What do we receive at the end of a red teaming engagement?
You receive documentation focused on the attack path: which steps we took, which vulnerabilities and gaps we exploited and what your detection saw. On top of that, you get specific recommendations to improve prevention, detection and response. Optionally we go through the results in a purple teaming session with your blue team or SOC and improve detection together.
How long does red teaming take and what does it cost?
Duration and cost depend on the goal, the agreed attack paths and the size of your environment, which is why there is no flat rate. In the first call and scoping we define the goal, rules of engagement and time frame, then you receive a quote. For projects our terms provide for a partial invoice of 35% when the order is placed and the rest after acceptance.
Read on
Related services
First conversation
Let's define your goal.
Tell us what an attacker must never achieve in your company. We will plan a scenario that shows whether your defence holds.
Destination: snapSEC, Vorchdorf
Asamerstraße 1b
4655 Vorchdorf, Austria 47°59′ N · 13°55′ E
Personal, without obligation and confidential.