🌶 REDTEAM-COMMS

Fast, clear communication templates for an engagement - kickoff, status,
and especially when something goes wrong: incident/mistake, out-of-scope,
deconfliction. Pair with the Red-Team Comms Builder tool.

  1. Stop the activity that caused it.
  2. Notify your client point of contact IMMEDIATELY - do not wait to
     "understand it fully" first. Speed limits damage and protects trust.
  3. Be honest and specific: what you did, when, what you saw.
  4. Do not blame, minimise, or speculate about their systems.
  5. Preserve evidence and a timeline; follow up in writing.
  6. Ask before you "fix" their system - you may make it worse or destroy
     evidence.
  Honesty + speed beats a tidy story delivered late.

  Client primary POC:   <name>  <phone>  <email>
  Client escalation:    <name>  <phone>  <email>
  Your team lead:       <name>  <phone>  <email>
  Out-of-hours path:    <how to reach someone 24/7>
  Deconfliction phrase: <agreed word/format proving activity is yours>
  Source IPs in use:    <list, so blue team can attribute quickly>

  Subject: Kickoff - <engagement> testing begins
  Hi <POC>,
  Confirming testing for <engagement> starts now (<datetime>).
  - Scope/RoE as signed.
  - Window: <start>-<end>.
  - Our source IPs: <ips>.
  - Contact: <you>, <email>, <phone>.
  Tell us of any freezes or sensitive systems to avoid.
  Regards, <you>

  Subject: <engagement> - daily status (<date>)
  Hi <POC>,
  - Done today: <...>
  - Next: <...>
  - Findings of note: <summary / none yet>
  - Blockers/access needed: <...>
  No unexpected impact to report.
  Regards, <you>

  Subject: ACTION NEEDED - <engagement> unexpected impact during testing
  Hi <POC>,
  Reporting an unexpected issue during authorized testing, immediately.

  WHAT HAPPENED
  - Time (approx): <datetime>
  - Affected system(s): <host/URL/service>
  - What we did: <exact action>
  - Observed impact: <e.g. service unresponsive>

  CURRENT STATUS
  - We STOPPED activity against the affected system.
  - <remediation performed, or "no data was modified">.

  WHAT WE NEED
  - Can you confirm the impact on your side?
  - Do you want the wider engagement paused during review?

  I'm available now at <email>/<phone>. Written timeline to follow.
  Apologies for the disruption - this is our top priority.
  <you>

  Subject: <engagement> - out-of-scope asset encountered
  Hi <POC>,
  We reached an asset that appears OUTSIDE agreed scope:
  - Asset: <host/IP/URL>
  - How we reached it: <linked from in-scope host / shared range>
  - Action: we STOPPED and did not test it further.
  Please confirm: (1) is it yours? (2) add to scope with written
  authorization, or exclude? We will hold until you confirm.
  Regards, <you>

  Subject: Deconfliction request - <engagement>
  Hi <POC>,
  Please confirm whether this was expected on your side:
  - Time: <datetime>   Source IP(s): <ip>
  - Target/activity: <host, ports, actions>
  If NOT us or another authorized tester, treat as potentially malicious
  and investigate.
  Regards, <you>

  Subject: RE: Deconfliction - <engagement>
  Hi <POC>,
  Activity in question:
  - Time: <datetime>  Source IP(s): <ip>  Target: <...>
  CONFIRMATION: this WAS / WAS NOT part of our authorized testing.
  - If yes: <what we were doing>.
  - If no: recommend you investigate as potentially malicious.
  Happy to call.
  Regards, <you>

  Subject: <severity> finding - <engagement> (immediate notice)
  Hi <POC>,
  Flagging a <severity> finding immediately per our agreement:
  - Finding: <title>   Affected: <host/URL>
  - Impact: <what an attacker could do>
  - Evidence: <safe, minimal proof>
  RECOMMENDED IMMEDIATE ACTION: <containment step>
  No destructive action taken; further exploitation paused pending your
  response. Full write-up in the report. Reachable now at <email>.
  <you>

  Subject: <engagement> - testing paused
  Hi <POC>,
  We have PAUSED all testing as of <datetime>.
  - Reason: <client request / incident review / freeze>.
  - No activity resumes without explicit written go-ahead.
  Regards, <you>

  Subject: <engagement> - testing complete
  Hi <POC>,
  Active testing complete as of <datetime>.
  - Test artifacts/accounts/files removed (list attached if any).
  - No further activity from us against scope.
  - Draft report by <date> via <secure channel>.
  Thanks for your support.
  Regards, <you>

  See also: PENTEST-REPORTING, SOCIAL-ENGINEERING, MITRE-REDTEAM, PHYSICAL-PENTEST.
  Interactive tool: /tools/redteam-comms-builder