20 Red-Team Questions, Answered from the XPN Archive

I turned Adam Chester's XPN infosec blog into a queryable knowledge graph — 1,196 nodes, 1,333 edges, 137 topic communities — and asked it what the archive knows. Every answer below is a one-paragraph synthesis of his public research, with the source post linked. Think of it as the cheat sheet to a decade of red-team tradecraft.

1. Can an LLM really take apart an EDR engine?

Yes — in Accelerating EDR Evasion with LLM-Driven Analysis GPT-5.5-Cyber carves through Cortex layer by layer, producing YARA rules, detection models and behavioural (CLP/CLIPS) logic, driven by an EMULATE-EDR.yaml subagent harness with GhostWorks scaffolding — the uncomfortable takeaway is that weeks of manual reversing compress into an evening, which both arms evasion and lays the defensive stack bare for anyone willing to look.

2. What is "disposable tooling"?

It is the idea from Disposable Tooling that LLM-generated Mythic agents — built from a mythic-implant-development skill through a QA sub-agent down to mythic-cli and the Mythicd server — should be treated as throwaway: generated from prompt to deployment in days, burned per engagement without regret, instead of maintained like precious software for years.

3. How do you know a prompt change actually helped a security agent?

With GEPA (Genetic-Pareto), the evolutionary prompt-optimization loop from Prompt Engineering for Security Agents: every tweak to the AGENTS.md baseline is scored against a Web CTF agent harness with day-shift routines, so prompt engineering becomes measurable hill-climbing instead of vibes and anecdote.

4. How does Cobalt Strike's ExternalC2 framework work?

As Exploring Cobalt Strike's ExternalC2 shows, it is file-based C2 at its simplest: third-party clients ferry Beacon frames over files and named pipes (Transfer C2 over file, connectBeaconPipe), so any language or runtime can speak to a Beacon through a plain read/write channel without touching the native protocol at all.

5. AWS Lambda redirector or Azure App Proxy for C2 — which wins?

Both borrow someone else's trusted infrastructure to hide the real server, which is exactly why the knowledge graph links AWS Lambda Redirector and Azure Application Proxy C2 as semantically similar: Lambda fronting is cheap and disposable, while the Azure path abuses Application Proxy connectors with a full client-certificate, CSR and Service Bus token flow that blends into legitimate enterprise traffic — same tradecraft, different landlord.

6. Can you really run C2 over a blockchain?

The BlockchainC2 research (ActiveBreach, Ethereum smart contracts holding tasking) proves it is possible and brutally takedown-resistant, since censoring the channel means fighting a decentralized ledger — but on-chain tasking is slow, costs gas and leaves a permanent public transcript, so it reads as a fascinating proof-of-concept rather than something operational.

7. What is the "accidental C2"?

The Accidental C2 found that VS Code Dev Tunnels — meant for sharing a dev session — hand out a reachable, Microsoft-fronted HTTPS endpoint that doubles as remote access with zero attacker infrastructure, which is convenient for red teams and a very good reason for defenders to start inventorying tunnel usage.

8. What is kerberoasting, in one paragraph?

Any authenticated user can request a service ticket (TGS) for any SPN and then crack it offline at leisure with no further domain interaction, as Kerberos Attacks Part 1 walks through — it works because the ticket is encrypted with the service account's password hash, so a weak service password plus one SPN equals domain leverage without ever touching LSASS.

9. What about AS-REP roasting?

Same idea one step earlier in the exchange, covered in Kerberos Attacks Part 2: accounts with Kerberos pre-authentication disabled will hand an AS-REP blob to literally anyone who asks, no credentials required, and that blob cracks offline — which is why finding one such account during recon can end the engagement early.

10. What is inter-realm key roasting?

Inter-Realm Key Roasting shows that cross-domain trust passwords (via TrustHelper.CreateTrustPassword and Forest.CreateTrustRelationship) are just key material, and key material can be roasted and forged into inter-realm tickets — trusts are invisible lateral-movement highways, and most defenders never audit who can mint traffic on them.

11. How does Mimikatz pull plaintext passwords out of WDigest?

Through sekurlsa::wdigest reading the credentials WDigest cached inside LSASS (the gfParameterUseLogonCredential flag and the PTRNWIN6PasswdSet / LogSessHandlerPasswdSet signatures, reached via SpAcceptCredentials paths), all traced structure-by-structure across the two-part Exploring Mimikatz series — and Credential Guard exists for precisely one reason, which is to make this paragraph obsolete.

12. What is SSP persistence and why should defenders care?

Registering a malicious Security Support Provider DLL means LSASS voluntarily loads your code at boot and hands it credentials on every subsequent logon, as Exploring Mimikatz Part 2 demonstrates — it survives reboots, hides inside a legitimate extensibility point, and is exactly why LSA package loading and extension DLLs deserve auditing on every estate.

13. NTLM over QUIC — why does a new transport matter?

NTLMquic dusted off SMB-over-QUIC support (startQuicServer) and showed the relay geometry changes with it: QUIC's UDP/TLS transport slips past TCP-centric relay assumptions, paired with ntlmrelayx-style tooling — every new transport Microsoft ships is a new relay surface to test before attackers do.

14. How do AMSI bypasses actually work?

By making amsi.dll's scan fail open — the classic amsiInitFailed flag trick, in-memory patching, and silencing script-block logging alongside it — surveyed in Exploring PowerShell AMSI and Logging Evasion in the lineage of MDSec's logging-evasion work: AMSI is a tripwire, and every tripwire has a fail state worth knowing.

15. How do you hide .NET malware from ETW?

By blinding the telemetry at its source, per Hiding Your Dotnet ETW: unhooking or patching EtwEventWrite and tuning the COMPlus knobs so the CLR never emits the events sensors subscribe to — if the detector's data comes from your own runtime, you do not evade the detector, you starve it.

16. How do you patch .NET assemblies at build time?

With Mono.Cecil and Roslyn rewriting IL — module initialisers (.cctor) for early execution, resource-extracted payloads, layered obfuscation — all wired into an Azure DevOps pipeline in Building, Modifying, Packing, so every single build ships modified, packed and ready without a human touching a hex editor.

17. How do you inject into macOS processes via third-party apps?

macOS Injection via Third Party Frameworks piggybacks applications users already trust — Electron (ELECTRONRUNASNODE), Slack, Fiddler — through taskfor_pid and framework dylib loads, then contends with the Hardened Runtime and TCC consent gates; the Apfell implant demonstrates the full loop from injection to usable access.

18. What does it take to write a Mach-O in-memory loader?

Reimplementing dyld piece by piece, as Building a Mach-O Memory Loader does in macholoader.m: parsing machheader64, walking LCSEGMENT64, LCDYLIB/LCLOADDYLIB and LCSYMTAB, and resolving dyld chained fixups (LCDYLDCHAINEDFIXUPS, dyldchainedstartsin_segment), continued in the restoring-dyld series — because malware that never touches disk never trips a file scanner.

19. How does macOS antivirus protect itself — and where does that fail?

The macOS AV self-protection survey catalogues how endpoint agents defend their own processes, kexts and daemons on macOS, and precisely where those guards have historically fallen over — which is useful twice over, telling defenders what to verify and red teamers which fights are worth picking.

20. Why are identity providers the new domain controllers?

Because owning the SSO owns every downstream app, as the Identity Providers for Red Teamers and Okta for Red Teamers research argues through malIDP, Entra ID agent spoofing and SAML assertion forgery — the crown jewels moved to the cloud, and Kerberos-era assumptions about where authentication lives need updating.

---

*All twenty answers were synthesized from Adam Chester's public XPN research archive (blog.xpnsec.com), structured through a knowledge graph of 1,196 entities across 137 topic communities. Read the originals — each one earns its 17-minute read.*