Red Team Mind Map

Reconnaissance

• Find Sub-Domains
• Find External Services
• Find Cloud & GitHub
• Find Email Addresses

Initial Access

• External Password Spraying
• Spear Phishing Emails
• MITM Attack
• Malicious File
• Exploit External Services

Find Credentials

• LLMNR & NBT-NS Poisoning
• Hashes (Relay & Cracking)
• Internal Password Spraying
• Clear-text Traffic Sniffing

Exploit RCE

• BlueKeep
• MS17-010
• MS08-067
• SMB Vuln

Host Enumeration

• Reconnaissance
• Privilege Escalation
• Host Persistence
• Credentials Dumping

Domain Reconnaissance

• PowerView
• BloodHound
• CrackMapExec

Lateral Movement

• Kerberos Abuse
• Group Policy
• Find Credentials
• Exploit RCE

Defense Evasion

• PowerShell Obfuscation
• Process Injection
• Custom Payloads