# Red Team Leaders

## Red Team Leaders

- [Welcome](https://docs.redteamleaders.com/readme.md)
- [Adversary Emulation Guide](https://docs.redteamleaders.com/documentation/adversary-emulation-guide.md)
- [Red Team Operations Framework](https://docs.redteamleaders.com/documentation/red-team-operations-framework.md)
- [Purple Team Operations](https://docs.redteamleaders.com/documentation/purple-team-operations.md)
- [The first 90 days of a new Red Team](https://docs.redteamleaders.com/documentation/the-first-90-days-of-a-new-red-team.md): This article explores key strategies, governance practices, process design, team structure, and operational focus areas that will guide a Red Team lead through this initial phase.
- [Command and Control](https://docs.redteamleaders.com/red-team-infrastructure/command-and-control.md)
- [C2 Redirectors Part.1](https://docs.redteamleaders.com/red-team-infrastructure/command-and-control/c2-redirectors-part.1.md)
- [Defense Evasion](https://docs.redteamleaders.com/offensive-security/defense-evasion.md)
- [Simple Shellcode Runner in Rust](https://docs.redteamleaders.com/offensive-security/defense-evasion/simple-shellcode-runner-in-rust.md)
- [Pass the Hash Attack with Mimikatz and PsExec](https://docs.redteamleaders.com/offensive-security/defense-evasion/pass-the-hash-attack-with-mimikatz-and-psexec.md)
- [Direct Syscall Execution in Windows](https://docs.redteamleaders.com/offensive-security/defense-evasion/direct-syscall-execution-in-windows.md)
- [Hookchain Technique Introduction by Helvio Júnior (M4v3r1ck)](https://docs.redteamleaders.com/offensive-security/defense-evasion/hookchain-technique-introduction-by-helvio-junior-m4v3r1ck.md)
- [Probabilistic Call Stack: A Deep Dive into Non-Deterministic Execution Paths](https://docs.redteamleaders.com/offensive-security/defense-evasion/probabilistic-call-stack-a-deep-dive-into-non-deterministic-execution-paths.md)
- [AMSI Bypass - Neutralizing the Microsoft Antimalware Scan Interface](https://docs.redteamleaders.com/offensive-security/defense-evasion/amsi-bypass-neutralizing-the-microsoft-antimalware-scan-interface.md)
- [ETW Bypass - Blinding Windows Telemetry](https://docs.redteamleaders.com/offensive-security/defense-evasion/etw-bypass-blinding-windows-telemetry.md)
- [Indirect Syscalls — Preserving a Legitimate Stack Trace](https://docs.redteamleaders.com/offensive-security/defense-evasion/indirect-syscalls-preserving-a-legitimate-stack-trace.md)
- [API Unhooking — Restoring ntdll to a Clean State](https://docs.redteamleaders.com/offensive-security/defense-evasion/api-unhooking-restoring-ntdll-to-a-clean-state.md)
- [Process Hollowing — Gutting Legitimate Processes](https://docs.redteamleaders.com/offensive-security/defense-evasion/process-hollowing-gutting-legitimate-processes.md)
- [Reflective DLL Injection — DLLs That Load Themselves](https://docs.redteamleaders.com/offensive-security/defense-evasion/reflective-dll-injection-dlls-that-load-themselves.md)
- [PPID Spoofing — Forging the Process Tree](https://docs.redteamleaders.com/offensive-security/defense-evasion/ppid-spoofing-forging-the-process-tree.md)
- [Token Impersonation — Identity Theft on Windows](https://docs.redteamleaders.com/offensive-security/defense-evasion/token-impersonation-identity-theft-on-windows.md)
- [Shellcode Obfuscation — Hiding Payloads from Static Detection](https://docs.redteamleaders.com/offensive-security/defense-evasion/shellcode-obfuscation-hiding-payloads-from-static-detection.md)
- [APC Injection — Execution via Asynchronous Procedure Call Queues](https://docs.redteamleaders.com/offensive-security/defense-evasion/apc-injection-execution-via-asynchronous-procedure-call-queues.md)
- [Heaven's Gate — Calling 64-bit Code from a 32-bit Process](https://docs.redteamleaders.com/offensive-security/defense-evasion/heavens-gate-calling-64-bit-code-from-a-32-bit-process.md)
- [Sleep Obfuscation — Encrypting Beacons During Rest](https://docs.redteamleaders.com/offensive-security/defense-evasion/sleep-obfuscation-encrypting-beacons-during-rest.md)
- [Credential Access](https://docs.redteamleaders.com/offensive-security/credential-access.md)
- [Dumping LSASS with Direct Syscalls](https://docs.redteamleaders.com/offensive-security/credential-access/dumping-lsass-with-direct-syscalls.md)
- [Windows Internals and API](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api.md)
- [Building Backdoors with Alternative Socket with lib-nosa (No Socket API)](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api/building-backdoors-with-alternative-socket-with-lib-nosa-no-socket-api.md): Alternative implementation of winsock2 using AFD.sys for socket realization. Still improving!
- [Windows API Hashing to Malware](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api/windows-api-hashing-to-malware.md)
- [Detection of Hooked Syscalls in ntdll.dll](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api/detection-of-hooked-syscalls-in-ntdll.dll.md)
- [Credential Exposure in Memory](https://docs.redteamleaders.com/offensive-security/windows-internals-and-api/credential-exposure-in-memory.md): A Deep Dive into SecureString, PowerShell, and Windows Process Internals
- [Privilege Escalation](https://docs.redteamleaders.com/offensive-security/privilege-escalation.md)
- [Windows UAC Bypass Techniques](https://docs.redteamleaders.com/offensive-security/privilege-escalation/windows-uac-bypass-techniques.md)
- [Obtaining SYSTEM privilege via a vulnerable driver using a Userland program](https://docs.redteamleaders.com/offensive-security/privilege-escalation/obtaining-system-privilege-via-a-vulnerable-driver-using-a-userland-program.md)
- [Malware Development](https://docs.redteamleaders.com/offensive-security/malware-development.md)
- [Chrome Password Dumper: Guide to Browser Password Recovery](https://docs.redteamleaders.com/offensive-security/malware-development/chrome-password-dumper-guide-to-browser-password-recovery.md)
- [Initial Access](https://docs.redteamleaders.com/offensive-security/initial-access.md)
- [Weaponized LNK Files for Initial Access and Delivery](https://docs.redteamleaders.com/offensive-security/initial-access/weaponized-lnk-files-for-initial-access-and-delivery.md)
- [Persistence](https://docs.redteamleaders.com/offensive-security/persistence.md)
- [Advanced Windows Persistence: Unveiling TypeLib Hijacking with Lesser-Known CLSIDs](https://docs.redteamleaders.com/offensive-security/persistence/advanced-windows-persistence-unveiling-typelib-hijacking-with-lesser-known-clsids.md)
- [Offensive Artificial Intelligence](https://docs.redteamleaders.com/offensive-artificial-intelligence.md)
- [Prompt Injection 101](https://docs.redteamleaders.com/offensive-artificial-intelligence/prompt-injection-101.md)