The Attacker's Objective

When developing a red team versus blue team exercise it is important to specify the red team’s objective. The objective is the overall aim of the exercise and red teams may have more than one objective in an exercise. When organizations are starting out with red team/blue team exercises, they should limit objectives so that the exercise does not become overly complicated. Once the red team/blue team exercises become more established, the outcome of exercises with more complex and difficult objectives will become clearer. If both the red team and blue team are inexperienced and the red team is pursuing a set of complex objectives, it will be difficult to conclude whether the organizational infrastructure is indeed secure, or if the red team wasn’t organized or capable enough to be able to exploit vulnerabilities.

Attackers, and red teams, can have more than one objective in an exercise. When engaging red teams as penetration testers from outside the organization ensure that the objectives are clearly stated before the exercise begins. A red team/blue team exercise is different from a security audit, where an external group of penetration testers examines an organization’s configuration and generates a report detailing vulnerabilities and problems.

There are a set of common objectives that attackers pursue:

• Persist presence
• Steal data
• Hackstortion
• Ransomware
• Coin miners
• Destroy systems

We will define these common objectives below.