Steal Like a Red Teamer: 7 Offensive Techniques Your Defenders Need to Know Cold
Photo: The White House, Public domain, via Wikimedia Commons
The best blue teamers I've ever worked with all had the same quality: they thought like attackers. Not in a vague, abstract "think adversarially" way — but in a specific, technical, "I know exactly what this tool does and where it leaves traces" way.
Adversarial emulation — the practice of simulating real-world threat actor behavior against your own environment — is one of the most valuable exercises in the security playbook. But most organizations treat it as a periodic event: bring in a red team once a year, get a report, patch the critical findings, repeat. The continuous learning loop that should come out of those engagements often doesn't happen.
This piece is about closing that gap. Here are seven techniques that red teams deploy regularly in adversarial simulations, along with what they look like from the inside, real-world examples of their use, and concrete detection and mitigation strategies your defensive team can implement right now.
1. Living Off the Land (LOLBins)
The Attacker's Play: Rather than dropping custom malware that might trigger AV/EDR detection, sophisticated attackers use tools already present on the target system — PowerShell, WMI, certutil, mshta, regsvr32. These are legitimate Windows binaries that IT teams need and can't simply block. The technique is called "Living Off the Land" (LOLBins), and it's a staple of APT tradecraft.
In the Wild: The FIN7 group has used this extensively, abusing WMI for persistence and PowerShell for payload delivery. During the SolarWinds intrusion, SUNBURST used native Windows processes for command-and-control communication to blend into normal traffic.
Steal This for Defense:
- Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging. This captures the decoded content of PowerShell commands, not just the invocation.
- Use Windows Defender Application Control (WDAC) or AppLocker to restrict which users and processes can invoke high-risk binaries like certutil, mshta, and regsvr32.
- Build detection rules around unusual parent-child process relationships — a Word document spawning PowerShell, or certutil reaching out to an external IP, should generate immediate alerts.
- Baseline normal LOLBin usage in your environment so you can spot deviations.
2. Kerberoasting
The Attacker's Play: Any authenticated domain user can request a Kerberos service ticket for any service account registered with a Service Principal Name (SPN). Those tickets are encrypted with the service account's password hash. Offline, an attacker can crack that hash at their leisure using tools like Hashcat. If the service account has a weak password — which they often do, because they're often old and forgotten — it's game over.
In the Wild: Kerberoasting has appeared in breaches attributed to ransomware groups including BlackCat/ALPHV and in numerous APT intrusions documented by CISA. It's a low-noise technique that generates no failed login events.
Steal This for Defense:
- Audit all service accounts with SPNs. Prioritize the ones with elevated privileges.
- Enforce strong, randomly generated passwords (25+ characters) on all service accounts. Better yet, migrate to Group Managed Service Accounts (gMSAs), which rotate passwords automatically.
- Monitor for Event ID 4769 (Kerberos Service Ticket Request) with encryption type 0x17 (RC4) — this is the cipher most commonly used in Kerberoasting attacks.
- Alert on bulk ticket requests from a single account in a short timeframe.
3. DCSync
The Attacker's Play: DCSync is a post-exploitation technique that abuses Active Directory replication protocols. If an attacker has an account with replication permissions (or has compromised a domain controller), they can request password hashes for any account in the domain — including the krbtgt account, which enables Golden Ticket attacks — without ever touching a domain controller directly.
In the Wild: DCSync is implemented in Mimikatz and is a standard move in most red team engagements after privilege escalation. Nation-state actors have used it extensively to harvest credentials for persistence.
Steal This for Defense:
- Restrict replication permissions. Only domain controllers should have
DS-Replication-Get-Changes-All. Audit this regularly using AD ACL auditing tools. - Monitor for Event ID 4662 with property
{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}— this flags replication requests from non-DC accounts. - Deploy Microsoft Defender for Identity (formerly Azure ATP), which has built-in detection for DCSync activity.
4. LLMNR/NBT-NS Poisoning
The Attacker's Play: When a Windows machine can't resolve a hostname via DNS, it falls back to Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) — broadcast protocols that ask the entire local network segment "hey, does anyone know where this host is?" An attacker on the same segment can respond "yes, that's me" and capture the victim's NTLMv2 challenge-response hash. Tools like Responder automate this completely.
In the Wild: This is one of the first things most red teamers run on internal engagements. It's devastatingly effective in environments that haven't disabled these legacy protocols.
Steal This for Defense:
- Disable LLMNR via Group Policy: Computer Configuration > Administrative Templates > Network > DNS Client > Turn off multicast name resolution.
- Disable NBT-NS at the network adapter level or via DHCP options.
- Deploy honeypot credentials — fake accounts with attractive names that you monitor for authentication attempts. If someone's trying to log in as
svc-backup-admin, you have a Responder attack in progress. - Monitor network traffic for unusual LLMNR/NBT-NS response patterns.
5. Pass-the-Hash / Pass-the-Ticket
The Attacker's Play: In Windows environments, you often don't need a plaintext password to authenticate — you just need the hash. Pass-the-Hash (PtH) uses a captured NTLM hash to authenticate to other systems. Pass-the-Ticket (PtT) does the same with stolen Kerberos tickets. Both techniques allow lateral movement without ever cracking a credential.
In the Wild: These techniques have been documented in intrusions by nearly every major threat actor group. They're bread-and-butter lateral movement tactics.
Steal This for Defense:
- Enable Protected Users Security Group for privileged accounts. Members can't use NTLM authentication and their credentials aren't cached.
- Deploy Windows Credential Guard to protect LSASS from credential dumping.
- Implement tiered administration — admin accounts for tier 0 (domain controllers) should never touch tier 1 or tier 2 systems, preventing hash harvesting from less-controlled environments.
- Monitor for Event ID 4624 (Logon Type 3) from accounts that don't normally authenticate to specific systems.
6. BloodHound Attack Path Enumeration
The Attacker's Play: BloodHound is an open-source tool that maps Active Directory relationships and automatically identifies attack paths to high-value targets. A red teamer runs the SharpHound collector, feeds the data into BloodHound, and within minutes has a visual map of exactly how to get from a compromised helpdesk account to domain admin. It's one of the most powerful tools in the offensive toolkit.
In the Wild: BloodHound-style enumeration has been observed in nation-state intrusions and ransomware pre-positioning operations. The technique dramatically accelerates privilege escalation.
Steal This for Defense:
- Run BloodHound yourself, regularly, against your own environment. Find the attack paths before the adversary does. Purple team exercises using BloodHound data are incredibly valuable.
- Use BloodHound Enterprise or the open-source version with the "attack path management" workflow to prioritize and remediate the most dangerous paths.
- Monitor for SharpHound collection activity — look for LDAP queries with large result sets, particularly querying ACL and group membership data.
- Break attack paths by removing unnecessary group memberships, cleaning up ACL delegations, and enforcing tiered administration.
7. C2 over Legitimate Cloud Services
The Attacker's Play: Modern threat actors have largely moved away from dedicated command-and-control infrastructure that's easy to block. Instead, they tunnel C2 communications through legitimate cloud services — Microsoft OneDrive, Google Drive, Slack, Discord, Dropbox, even GitHub. Traffic to these services blends into normal business activity and rarely triggers firewall rules or proxy blocks.
In the Wild: APT41 has used Google Drive for C2. Lazarus Group has used GitHub. Multiple ransomware operators have used Slack webhooks for exfiltration. This technique appears in MITRE ATT&CK as T1102 (Web Service).
Steal This for Defense:
- TLS inspection on egress traffic is table stakes here — you need to see inside encrypted sessions to detect anomalous API calls to cloud platforms.
- Baseline normal cloud service usage per endpoint and user. An endpoint that never normally accesses OneDrive suddenly pushing 2GB of data to it is a signal.
- Look for unusual API call patterns — automated, regular, time-interval-based communications to cloud services from non-browser processes.
- Implement DLP controls on cloud service egress, and consider restricting access to consumer cloud storage from corporate endpoints where business justification is weak.
The Takeaway
None of these techniques are exotic. They're all well-documented, widely used, and available to anyone willing to spend a few hours on MITRE ATT&CK or the Hacker's Handbook. The adversaries using them against US organizations aren't relying on zero-days and movie magic — they're executing reliable, repeatable playbooks against environments that haven't built the detection logic to catch them.
Your red team is doing you a favor every time they run one of these. The question is whether you're learning from it or just filing the report.
Hack the planet. Defend the stack. And for the love of all things holy, disable LLMNR.
