Plan. Execute. Vanish.

We have talked about the idea of "plan, execute and vanish" many times in the blog, we've explained its meaning on everyday red teaming. There are many phases to an assessment, or red teaming op, however it comes down to:

Plan: Get your facts right, analyze the potential problems and make a plan. Or as discussed on On Planning: know the project or end goal, analyze the problems, find a solution to those problems, perform a dry run and make a plan. Remember to red team the plan.

Execute: Once you have a plan ready, go for it. Stop occasionally to see if you missed anything on the initial assessment, but just execute. Remember ACTE: assess the situation; create a simple plan; take action and evaluate your progress. Always stop to see what's the reality on the ground and adapt the plan accordingly. The real world is a special case. This is the live run.

Vanish: Complete your execution and when you are done, move on. Focus on the next thing. Always clean up after you. Don't leave anything behind: user accounts, breached perimeters and cameras, etc. Leave the place as you found it. Vanish.

Three steps that can be adapted to any situation: digital, physical, personal, you name it.

The Superior Red Teamer’s Learning Checklist | Red Team Journal

Red Teaming and the Adversarial Mindset: Have a Plan, Backup Plan and Escape Plan | ITS Tactical