About

Mon, 01 Jan 0001 00:00:00 +0000

Think Red is where I publish red team tradecraft: concepts, lab research, engagement craft, and the tools I build. Every offensive technique comes with the defender’s side, covering how to detect it and how to mitigate it.

Think like an adversary. Write like a defender.

Focus areas

Adversary emulation and threat-informed red teaming
Active Directory and identity attack paths
Red team infrastructure and OPSEC
AI and LLM red teaming
Detection engineering from the attacker’s point of view

How I work

All research is performed in environments I own or am explicitly authorized to test.
Nothing here comes from client engagements unless it has been generalized and approved.
Techniques are mapped to MITRE ATT&CK and paired with detection and mitigation guidance.

Disclosure

If you find a security issue with this site, or believe something I published needs correcting, see /.well-known/security.txt or email thinkred@jmsg.me.

Disclaimer

Mon, 01 Jan 0001 00:00:00 +0000

All content on this site is provided for educational purposes and for use in authorized security testing only.

Only test systems you own or have explicit, written permission to test. Unauthorized access to computer systems is illegal in most jurisdictions.
Techniques and tools are demonstrated in isolated lab environments. Use them at your own risk.
Content is provided “as is”, without warranty of any kind. I am not responsible for misuse or damage resulting from the use of this information.
Views expressed here are my own and do not represent any current or former employer or client.
Vulnerabilities are handled through coordinated disclosure. Nothing here discloses unpatched vulnerabilities in third-party products.

Questions or concerns: thinkred@jmsg.me