Red Team Glossary — Acronyms and Terms Across the Track

A one-line definition for every acronym and term used across the curriculum, with the phase where it's covered in depth (Pnn). Use it as quick recall; follow the pointer for the from-zero treatment. Alphabetical. Everything here is for authorized engagements only.

A

  • AD — Active Directory: Microsoft's enterprise directory and authentication backbone; the identity perimeter of most enterprises. P05.
  • ADCS — Active Directory Certificate Services: the AD PKI; misconfigured templates (ESC1–ESC16) yield domain compromise. P05.
  • AMSI — Antimalware Scan Interface: a Windows API letting AV/EDR inspect de-obfuscated script/.NET content in memory at runtime. P06, P07.
  • AS-REP Roasting — extracting a crackable hash from accounts with Kerberos pre-auth disabled. P05.
  • ATT&CK — MITRE's tactic→technique matrix of observed adversary behavior; the lingua franca of emulation and reporting. P01.
  • Adversary emulation — reproducing a specific named actor's TTPs (from CTI) against a consenting client. The Mandiant model. P01.
  • Assumed breach — an engagement that starts from an existing foothold to test detection/response rather than perimeter. P00, P01.

B

  • Beacon — a C2 implant that periodically "calls home" for tasking; its rhythm (interval + jitter) is a key detection signal. P08.
  • BloodHound — graph tool that maps AD attack paths (who can reach Domain Admin and how). P05.
  • BOF — Beacon Object File: small compiled C run in-process by a C2 to reduce footprint vs. spawning a process. P06, P08.

C

  • C2 / C&C — Command and Control: the channel a compromised host uses for tasking and exfiltration. P08.
  • CKC — Cyber Kill Chain (Lockheed Martin): the linear campaign-phase lens. P01.
  • CLR — Common Language Runtime: the .NET virtual machine; in-process .NET execution is core Windows tradecraft. P06.
  • Cobalt Strike — a commercial C2 framework; the de-facto red team standard (and the most-emulated by real adversaries). P08.
  • CTI — Cyber Threat Intelligence: the actor knowledge that drives an emulation plan. P01.

D

  • DACL — Discretionary Access Control List: the per-object permission list on Windows; misconfigurations enable privesc and AD attacks. P04, P05.
  • Defense evasion — the ATT&CK tactic of avoiding detection; in this track always paired with the detection it should trigger. P07.
  • Deconfliction — the agreed process for the client SOC to confirm "is this activity the red team?" during an engagement. P00.
  • Diamond Model — the adversary/capability/infrastructure/victim lens; the basis of pivoting and attribution. P01.
  • DLL search-order / sideloading hijack — abusing how Windows resolves DLLs to load attacker code via a trusted process. P04, P06.
  • Domain fronting — hiding C2 destination behind a trusted CDN SNI (largely mitigated by providers). P08.

E

  • EDR — Endpoint Detection and Response: kernel + user-mode telemetry and response agent; the primary obstacle to modern tradecraft. P07.
  • ETW — Event Tracing for Windows: the high-volume telemetry bus; ETW-TI (Threat-Intelligence provider) feeds EDR. P06, P07.
  • Egress — outbound network traffic; egress filtering/allow-listing is a core C2 control. P03, P08.
  • Emulation plan — the document mapping a chosen actor's TTPs to procedures, success criteria, and stop conditions. P01.

H

  • Hooking (user-mode) — EDR patching ntdll/Win32 stubs to observe API calls; "unhooking" restores the original bytes. P07.

I

  • IAM — Identity and Access Management: the cloud identity layer; the cloud's real perimeter. P09.
  • IMDS — Instance Metadata Service: the cloud endpoint that hands credentials to a VM; SSRF→IMDS is a classic cloud foothold. P09.
  • Initial access — the ATT&CK tactic of getting the first foothold (phishing, exploit, valid accounts). P10.
  • IOC — Indicator of Compromise: a host/network artifact (hash, domain, pipe name) that signals an intrusion; the weak base of the Pyramid of Pain. P02, P12.
  • Injection (process) — running code in another process's address space (e.g., CreateRemoteThread, APC, mapping) to blend in. P06.

J

  • JA3 / JA4 — fingerprints of a TLS client hello; detect C2 by the shape of its handshake even when encrypted. P08.
  • Jitter — randomization of a beacon's call-home interval to defeat fixed-period detection. P08.

K

  • Kerberoasting — requesting service tickets (4769) for accounts with SPNs and cracking them offline. P05.
  • Kerberos — the AD authentication protocol (tickets, TGT/TGS); the language of identity attacks. P05.
  • Kill chain — see CKC; the campaign-phase lens. P01.

L

  • Lateral movement — moving from one host to another inside the perimeter (SMB/WMI/WinRM/RDP/PsExec). P03, P05.
  • LOLBin / LOLBAS — Living-Off-the-Land Binary: a trusted built-in (certutil, rundll32, wmic) abused to reduce footprint. P04, P06.
  • LSASS — Local Security Authority Subsystem: the Windows process holding credential material; dumping it is a top detection target. P05, P06.

M

  • Malleable C2 profile — a config that reshapes a beacon's traffic/indicators to emulate a chosen actor or blend with normal traffic. P08.
  • Mandiant Attack Lifecycle — Mandiant's campaign model (initial compromise → establish foothold → escalate → recon → move laterally → maintain → complete mission). P01.
  • Mimikatz — the canonical credential-extraction tool (lab-only); its techniques are heavily detected. P05.

N

  • NTLM — the legacy Windows challenge-response auth; relay and pass-the-hash attacks target it. P05.
  • Nim — a compiled, Python-like language used for compact cross-platform offensive tooling (named in the JD). P02.

O

  • OPSEC — Operational Security: minimizing the indicators your actions emit, and reasoning about what each sensor sees. P00, throughout.
  • OSINT — Open-Source Intelligence: public-data reconnaissance of people, infra, and exposure. P10.
  • OSCP / OSEP / OSED / OSCE / OSEE — Offensive Security certifications mapped to phases in the README §11.

P

  • Pass-the-Hash / Pass-the-Ticket — authenticating with a stolen NTLM hash / Kerberos ticket instead of a password. P05.
  • PE / COFF — Portable Executable: the Windows binary format; understanding it underlies loaders, injection, and RE. P02, P06, P11.
  • Pivoting — routing traffic through a compromised host to reach otherwise-unreachable networks. P03.
  • Purple team — red and blue working together to validate and build detections from emulated attacks. P12.
  • Pyramid of Pain — Bianco's model ranking IOCs by how much changing them costs the adversary (hashes easy → TTPs hard). P01, P12.

R

  • Redirector — infrastructure that proxies C2 traffic so the real team server is hidden and resilient. P08.
  • ROE — Rules of Engagement: the scope/method/time/stop-condition contract that authorizes the work. P00.
  • RBCD — Resource-Based Constrained Delegation: a Kerberos delegation primitive abused for privilege escalation. P05.

S

  • Sigma — a vendor-neutral detection-rule format; the way findings are handed to a SOC as durable detections. P07, P12.
  • sRDI / reflective loading — loading a DLL/PE from memory without touching disk; a classic evasion and detection target. P06.
  • SPN — Service Principal Name: the AD identifier that makes an account Kerberoastable. P05.
  • Sysmon — a free Windows telemetry sensor (process, network, image-load events) that underpins most home-grown detection. P06, P07.

T

  • TGT / TGS — Ticket-Granting Ticket / Service Ticket: the two Kerberos ticket types; golden/silver-ticket forgery targets them. P05.
  • TTP — Tactics, Techniques, and Procedures: the behavioral level of the Pyramid of Pain; what emulation reproduces. P01.

V

  • VECTR — a free purple-team tracking tool for emulation campaigns and detection coverage over time. P12.

W

  • WDAC / AppLocker — Windows application-control technologies that constrain what can execute. P06, P07.
  • WinRM / WMI / SMB — the common Windows remote-execution and lateral-movement transports. P03, P05.