Red Team Report Writing

A red team report communicates the business risk of identified vulnerabilities to leadership (executive summary), enables defenders to replicate findings and improve detection (technical detail), and provides an action plan for remediation (recommendations).

Standard red team report structure:

1. Cover page and scope definition
2. Executive Summary
3. Methodology overview
4. Attack narrative / kill chain
5. Findings list with severity ratings
6. Technical details per finding
7. Recommendations and roadmap
8. Appendices: evidence, IOCs, tool list

Write the executive summary last. It should state:

• Engagement objectives and scope
• Key findings in business terms ("we obtained domain admin access in 4 hours")
• Overall risk posture assessment
• Top 3 priorities for remediation

No jargon. Assume the reader is a non-technical executive.

The attack narrative tells the story of the engagement chronologically:

1. Initial access vector (how first foothold was achieved)
2. Persistence and discovery
3. Privilege escalation steps
4. Lateral movement path
5. Objectives achieved (data accessed, domain compromised)

Map each step to MITRE ATT&CK technique IDs.

Each finding should include:

• Title: clear, specific name
• Severity: Critical/High/Medium/Low/Info (with CVSS score if applicable)
• Description: what was found
• Impact: business risk if exploited
• Steps to reproduce: detailed technical proof
• Evidence: screenshots, logs
• Recommendation: specific fix

CVSS (Common Vulnerability Scoring System) provides a standardized severity score 0-10. Components: Attack Vector, Complexity, Privileges Required, User Interaction, Scope, Confidentiality/Integrity/Availability Impact. Use CVSS 3.1 for consistent, defensible severity ratings.

Map every technique used to ATT&CK to give defenders actionable intelligence:

• T1566.001 — Spearphishing Attachment (initial access)
• T1059.001 — PowerShell (execution)
• T1003.001 — LSASS Memory (credential access)

ATT&CK mapping helps blue teams write detection rules for observed TTPs.

Screenshots should include:

• Date/time visible in terminal
• Hostname of compromised system
• Command and full output
• No cropping that removes context

Annotate screenshots to highlight the critical element. Evidence authenticates findings.

Good recommendations are:

• Specific: "Enable PowerShell AMSI and constrained language mode" not "improve security"
• Prioritized: which to address first based on risk
• Actionable: the reader knows exactly what to do
• Realistic: account for operational constraints

A live debrief presentation supplements the written report. Walk the client through the attack narrative with live screenshots, demonstrate how they could have detected each step, and take questions. This is often more impactful than the written report for driving change.

Red team reports contain sensitive vulnerability information. Handle accordingly:

• Encrypt the report (PGP or password-protected PDF)
• Transmit via secure channel
• Limit distribution to those who need it
• Define report retention and destruction policy
• Never email unencrypted reports

Which section of a red team report provides MITRE ATT&CK-mapped steps showing exactly how the red team progressed from initial access to objectives?

Red team reports serve business (executive summary), technical (attack narrative + findings), and defensive (ATT&CK mapping) audiences. Each finding includes severity, impact, reproduction steps, evidence, and specific recommendations. MITRE ATT&CK mapping turns offensive findings into defensive detection opportunities. Encrypt and handle reports as sensitive documents.