Think Red is where I publish red team tradecraft: concepts, lab research, engagement craft, and the tools I build. Every offensive technique comes with the defender’s side, covering how to detect it and how to mitigate it.

Think like an adversary. Write like a defender.

Focus areas

  • Adversary emulation and threat-informed red teaming
  • Active Directory and identity attack paths
  • Red team infrastructure and OPSEC
  • AI and LLM red teaming
  • Detection engineering from the attacker’s point of view

How I work

  • All research is performed in environments I own or am explicitly authorized to test.
  • Nothing here comes from client engagements unless it has been generalized and approved.
  • Techniques are mapped to MITRE ATT&CK and paired with detection and mitigation guidance.

Disclosure

If you find a security issue with this site, or believe something I published needs correcting, see /.well-known/security.txt or email thinkred@jmsg.me.

Elsewhere

Views are my own and do not represent any employer. See the disclaimer.