Red Team Assessment
Detects red team assessment reports and red team findings records revealing proven attack paths and security blind spots. A red-team / purple-team / adversary-simulation / threat-emulation title is discovery-only; enforcement requires attack-technique, ATT&CK technique ID, offensive-tool, or populated finding-record evidence, and high confidence requires a populated finding record (finding ID, severity, affected host) plus independent attack-path/TTP evidence.
- Type
- regex
- Confidence
- medium
- Confidence justification
- Medium confidence: title phrases are discovery-only; enforcement needs technique, ATT&CK ID, tool, or populated finding evidence, and 85 needs a populated finding record plus independent TTP evidence.
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS
- Data categories
- security
- Scope
- narrow
- Risk rating
- 8
Should match
Red team assessment— Low-tier probe - assessment title without technique or finding contentRed team assessment: attack path through initial access and lateral movement.— Discovery probe (65) - adversary technique wording without a finding record or ATT&CK IDRed team findings - Operation KESTREL (internal engagement RT-2026-03) Finding ID: RT-03-007 Severity: Critical Affected host: FIN-APP-02.corp.local Attack path: phishing payload (T1566.001) -> Kerberoasting of svc_backup (T1558.003) -> lateral movement over SMB (T1021.002) to FIN-APP-02 Detection: no EDR alert raised; SOC did not triage within the exercise window— High-tier probe - populated finding record (finding ID, severity, affected host) with ATT&CK attack path (rewritten from global-top500-253-red-team-findings)Purple team exercise debrief: Finding 4 (severity: high) - compromised account: jsmith-adm; persistence via scheduled task T1053.005 was not detected by the SIEM.— High-tier probe - inline finding record with severity, compromised account and ATT&CK persistence techniqueThreat emulation report for the payments platform: operators used Cobalt Strike beacons for command and control.— Discovery probe (65) - threat-emulation prose naming tooling and C2 technique but no populated finding record (merged title from global-top500-253-red-team-findings)
Should not match
Red team won the competition— Sports-team siblingTeam-building exercise— Workplace team exerciseThe public conference agenda lists a red team assessment session.— Public programme mentions only the assessment titleTemplate example: red team assessment with an attack path, lateral movement, findings summary, and risk summary.— Template contains otherwise high-tier evidenceRed team engagement policy: each engagement is approved by the CISO, and the report must record a finding ID, severity and affected host for every issue raised.— Policy prescribing finding fields without populated values or techniques stays discovery-onlyNews: the agency announced a red team exercise for its new digital licence app next quarter, run by an external provider.— News announcement of an exercise without findings stays discovery-onlyTraining example: red team findings - Finding ID: RT-03-007, Severity: Critical, Affected host: FIN-APP-02, lateral movement via T1021.002.— Training material with an otherwise high-tier finding record must not enforce
Known false positives
- Sports or team references. Mitigation: Require security-specific terms like adversary simulation, MITRE ATT&CK, or attack path.
- Security policies, engagement rules of engagement, vendor marketing, and conference agendas name red team exercises and list report fields (finding ID, severity, affected host) without containing findings. Mitigation: Title phrases stay discovery-only; finding fields count only when populated with a value, and template/training framing is excluded.