The Hacker Playbook 3: Red Team Edition

Executive Summary: Adversary Emulation & Red Team Campaigns

Standard penetration testing often focuses on finding as many isolated security vulnerabilities as possible within a fixed time window. Red Teaming takes an entirely different approach: it simulates real-world Advanced Persistent Threat (APT) campaigns to evaluate an enterprise's overall detection, response, and containment capabilities (the Blue Team and Security Operations Center / SOC).

The Hacker Playbook 3 (Red Team Edition) focuses on the operational mechanics of adversary emulation. Spanning 350 technical pages, this manual equips security operators with the tools and mindsets required to set up stealthy Command & Control (C2) infrastructure, gain initial entry through weaponized payloads, navigate complex Active Directory domains using BloodHound, bypass modern EDR sensors via Direct Syscalls, and execute domain takeover scenarios.

Deep Dive: Core Red Team Campaign Phases

The handbook provides operational playbooks across five core campaign stages:

1. Initial Access & Weaponized Delivery

Gaining an initial foothold in a modern enterprise requires bypassing perimeter email filters and endpoint security controls. The book covers advanced delivery techniques:

• HTML Smuggling: Utilizing HTML5 Blob objects and JavaScript to construct payload binaries directly within the victim browser, bypassing perimeter network inspection.
• LNK / ISO Container Delivery: Wrapping payload executables inside disk image files (`.iso`, `.img`) to bypass Mark-of-the-Web (MOTW) security warnings.

2. Command & Control (C2) Infrastructure Engineering

A resilient C2 infrastructure ensures operational persistence even if an individual beacon IP is detected. The handbook details multi-tier C2 setup:

• Domain Fronting & CDN Proxying: Masking C2 HTTPS beacon traffic behind reputable Cloudflare, Amazon CloudFront, or Fastly CDN endpoints.
• Malleable C2 Traffic Profiles: Customizing HTTP request headers, URI paths, and payload encodings to mimic standard web traffic (e.g. Google Analytics or Amazon API calls).

3. Active Directory Enterprise Exploitation

Active Directory is the crown jewel of enterprise IT. The book provides step-by-step AD attack paths:

• Kerberoasting & AS-REP Roasting: Requesting TGS service tickets for service accounts with SPNs and cracking password hashes offline using hashcat.
• DCSync & Golden Tickets: Abusing `DS-Replication-Get-Changes` permissions to dump the Kerberos krbtgt hash and generate forged Golden Tickets for permanent domain admin access.

Field Engineering: Red Team PowerShell & C# Snippets

Chapter 6 of the handbook provides practical automation scripts for AD Kerberoasting and EDR Syscall injection:

# Request Kerberos SPN Tickets for Offline Password Hash Cracking
Rubeus.exe kerberoast /outfile:hashes.txt /format:hashcat /simple

# Hashcat Offline Password Cracking Command (Mode 13100)
hashcat -m 13100 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule

using System;
using System.Runtime.InteropServices;

public class DirectSyscallInjector {
    // Direct Assembly Syscall stub to bypass ntdll.dll API Hooks
    static byte[] bNtAllocateVirtualMemory = new byte[] {
        0x4C, 0x8B, 0xD1,               // mov r10, rcx
        0xB8, 0x18, 0x00, 0x00, 0x00,   // mov eax, 0x18 (NtAllocateVirtualMemory Syscall ID)
        0x0F, 0x05,                     // syscall
        0xC3                            // ret
    };

    public static void Main() {
        Console.WriteLine("[*] Executing Shellcode via Direct Native Syscalls (Bypassing EDR Hooks)...");
        // Allocate executable memory block and execute beacon payload
    }
}

Complete Table of Contents & Module Syllabus

• Module 01 Red Team Campaign Planning & Adversary Emulation

  Pages 1–40
  Planning red team engagements, MITRE ATT&CK mapping, threat actor profiling, rules of engagement (RoE), and deconfliction playbooks.
• Module 02 External Reconnaissance, OSINT & Surface Mapping

  Pages 41–80
  Passive OSINT techniques, domain enumeration, employee email scraping, cloud infrastructure discovery, and credential leak monitoring.
• Module 03 Initial Access: Spear-Phishing, HTML Smuggling & LNK Payloads

  Pages 81–125
  HTML Smuggling mechanics, LNK shortcut creation, weaponized ISO/IMG disk images, VBA macro obfuscation, and bypassing email gateways.
• Module 04 Command & Control (C2) Infrastructure & Redirector Setup

  Pages 126–175
  Setting up Cobalt Strike, Mythic, and Covenant C2 frameworks, CDN domain fronting, malleable C2 profile tuning, and beacon jitter configuration.
• Module 05 Active Directory Reconnaissance: BloodHound & PowerView

  Pages 176–220
  BloodHound graph database analysis, executing LDAP queries with PowerView, mapping domain trust relationships, and identifying privilege escalation paths.
• Module 06 Active Directory Exploitation: Kerberoasting & DCSync

  Pages 221–265
  Kerberoasting, AS-REP Roasting, ACL modification attack paths, abusing GPO objects, DCSync credential dumping, and Golden/Silver Ticket generation.
• Module 07 EDR Evasion, AMSI Bypass & Direct Syscalls Engineering

  Pages 266–310
  Bypassing Windows AMSI, unhooking `ntdll.dll` API hooks in memory, Process Hollowing, Direct Syscalls (SysWhispers), and obfuscating C# binaries.
• Module 08 Lateral Movement, Persistence & Covert Exfiltration

  Pages 311–350
  Pass-the-Hash (PtH), Overpass-the-Hash, WMI/WinRM execution, WMI event subscription persistence, DNS/HTTPS exfiltration channels, and final reporting.

Who Should Read This Handbook?

This handbook is designed for advanced offensive and defensive security professionals:

Verified Red Team Operator Reviews

Frequently Asked Questions