Red teaming in 2026 looks noticeably different from even a few years ago. EDR products have gotten sharper at fingerprinting the old favorites, cloud and hybrid Active Directory environments dominate real engagements, and AI-driven systems have become attack surfaces in their own right. The tools that actually earn a spot in a serious red team’s toolkit have adapted accordingly.
Why Tool Selection Matters in Red Teaming
Unlike a broad penetration test, red teaming lives and dies on stealth. A tool that’s technically capable but instantly flagged by every EDR product on the market undermines the entire purpose of the engagement — you’re supposed to be testing whether the organization notices a patient, realistic adversary, not whether their antivirus signature database is current. That’s why modern red team toolkits increasingly favor customizable, low-signature frameworks over older, heavily-fingerprinted tools, and why picking the right tool for the right phase of the engagement matters as much as technical skill.
Reconnaissance and OSINT Tools
1. theHarvester
Gathers emails, subdomains, employee names, and open ports from public sources, forming the initial OSINT picture of a target organization before any active engagement begins.
2. Recon-ng
A modular, Python-based web reconnaissance framework that automates OSINT collection through a structured workflow of modules, letting operators chain data sources together efficiently.
3. SpiderFoot
An automated OSINT tool that correlates data across dozens of sources simultaneously — domains, IPs, breach databases, social media — producing a consolidated view of an organization’s external footprint.
4. Amass
Focused specifically on attack surface mapping and subdomain enumeration, Amass combines passive data sources with active DNS resolution to build a thorough picture of an organization’s external assets.
Command and Control (C2) Frameworks
5. Cobalt Strike
Still the most widely recognized commercial C2 platform in red teaming, known for its Malleable C2 profiles that disguise beacon traffic as legitimate application traffic, and its Aggressor scripting for custom operator automation. Its popularity is also its weakness — heavily fingerprinted by most EDR vendors, so mature teams often heavily customize its indicators before use.
6. Sliver
An open-source, cross-platform C2 framework written in Go, valued for its active development community and flexibility in building custom implants across Windows, macOS, and Linux targets without licensing costs.
7. Mythic
A modular, containerized C2 framework where each capability runs as its own microservice, allowing operators to build and swap custom “agents” for different operating systems. It has a steeper learning curve than turnkey commercial options but offers exceptional customization for research-focused teams.
8. Havoc
A modern, actively maintained open-source C2 framework built with a focus on evasion and modularity, increasingly favored by teams wanting an alternative to the more heavily signatured Cobalt Strike.
9. Brute Ratel C4
Built specifically around evading modern EDR detection, Brute Ratel has become a favorite among red teams needing an alternative when Cobalt Strike’s signatures are too well known to the defending organization’s tooling.
10. Covenant
A .NET Core-based, collaborative C2 framework offering both a web dashboard and a command-line “Elite” interface, with a large built-in task library covering credential dumping and lateral movement out of the box.
Active Directory and Network Attack Tooling
11. BloodHound
Maps Active Directory relationships — group memberships, ACLs, sessions, trust relationships — into a graph database, visually revealing attack paths toward Domain Admin that would be nearly impossible to spot manually across a large enterprise domain.
12. Impacket
A collection of Python classes and scripts for working with network protocols, widely used for Kerberoasting, remote command execution (psexec.py, wmiexec.py), and ticket manipulation in Active Directory environments.
13. CrackMapExec / NetExec
A post-exploitation and lateral movement tool built around SMB, WinRM, MSSQL, and LDAP, used to validate credentials across many hosts simultaneously, enumerate shares, and execute commands at scale. This <a href=”https://awjunaid.com/kali-linux/crackmapexec-post-exploitation-and-penetration-testing-tool/”>guide to CrackMapExec’s core functionality</a> walks through its most common use cases in detail.
14. Responder
Listens for LLMNR/NBT-NS broadcast name resolution requests and responds on the attacker’s behalf, capturing NTLM hashes from misconfigured Windows networks — still one of the fastest ways to gain an initial internal foothold.
15. Mimikatz
The long-standing standard for extracting plaintext credentials, hashes, PIN codes, and Kerberos tickets from Windows memory, frequently used post-exploitation to escalate privileges and move laterally.
16. PowerView / PowerSploit
A PowerShell-based toolkit for Active Directory enumeration and situational awareness, often used alongside BloodHound to manually verify and further explore discovered attack paths.
Credential Access and Password Attacks
17. Hashcat
The standard GPU-accelerated password cracking tool, used to recover plaintext passwords from captured hashes (NTLM, Kerberos tickets, WPA handshakes) far faster than CPU-based cracking alone.
18. Hydra
An online password-guessing tool supporting a wide range of protocols (SSH, RDP, FTP, HTTP forms), useful for testing credential strength against live services where offline hash cracking isn’t applicable.
Cloud and Emerging AI-Focused Red Teaming Tools
19. GraphRunner / MAAD Attack Framework
A newer category of tooling focused specifically on Microsoft 365 and Azure AD/Entra ID post-exploitation, interacting directly with the Microsoft Graph API to enumerate and abuse cloud identity permissions — reflecting how much real-world red teaming has shifted toward hybrid cloud environments.
20. DeepTeam and AI Red Teaming Frameworks
As organizations deploy LLM-powered applications and agents, a new category of red teaming tooling has emerged specifically for testing prompt injection, jailbreaks, and insecure output handling against AI systems, aligned with frameworks like the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework. This reflects a genuinely new attack surface that traditional network and AD-focused red team tools were never designed to address.
How to Choose the Right Tool for the Engagement
Step 1: Match the Tool to the Engagement Phase
Reconnaissance tools (theHarvester, Amass) belong at the start. C2 frameworks come into play once initial access is achieved. Active Directory tooling (BloodHound, Impacket) is for the internal, lateral-movement phase. Don’t reach for Mimikatz before you’ve even established a foothold — sequence matters.
Step 2: Weigh Detection Risk Against Capability
Cobalt Strike is powerful, but its signatures are extremely well known to defenders and EDR vendors. If stealth is the primary goal of the engagement (as it should be in genuine red teaming), a less common framework like Sliver, Havoc, or Brute Ratel may better serve the objective — even if it means a steeper learning curve or less polish.
Step 3: Consider Open-Source vs Commercial Trade-offs
Open-source tools (Sliver, Mythic, Impacket, BloodHound) cost nothing and offer full customization, but require more operator expertise and self-managed infrastructure. Commercial tools (Cobalt Strike, Core Impact) offer curated support and a maintained exploit/feature library, at higher cost and often higher detection risk due to widespread familiarity among defenders.
Step 4: Build Toward the Objective, Not the Tool List
The best red teamers pick tools based on the specific engagement objective and the target environment’s technology stack — a purely on-prem Active Directory environment calls for a very different toolkit than a cloud-native, Microsoft 365-heavy organization.
Physical and Social Engineering Tooling
Red teaming often extends beyond purely technical systems, and a well-rounded toolkit accounts for this.
Physical Security Testing Aids
Lock-picking sets, RFID cloning devices, and badge cloning tools remain relevant for engagements that include a physical intrusion component, testing whether an organization’s physical access controls hold up alongside its digital ones.
Social Engineering and Phishing Infrastructure
Frameworks like Gophish and Evilginx are commonly used to build realistic phishing campaigns and, in Evilginx’s case, to proxy legitimate login pages in a way that can capture session tokens even from accounts protected by multi-factor authentication — reflecting how real phishing campaigns have evolved past simple credential harvesting toward session hijacking.
Building a Tiered Toolkit Based on Engagement Maturity
Rather than trying to master all 20 tools simultaneously, it helps to think about toolkit development in tiers matched to your growing experience level.
Tier 1: Foundational Tools
Start with Impacket, BloodHound, and a single lightweight open-source C2 framework like Sliver. These three alone cover the majority of what a beginner-to-intermediate internal engagement or CTF-style lab exercise will require.
Tier 2: Intermediate Expansion
Add Responder and Hashcat for credential capture and offline cracking, along with CrackMapExec/NetExec for scaling lateral movement testing across larger environments.
Tier 3: Advanced and Specialized Tooling
Layer in commercial or more sophisticated C2 frameworks (Cobalt Strike, Brute Ratel), cloud-specific tooling (GraphRunner, MAAD Attack Framework), and eventually AI red teaming frameworks as your engagements begin to involve more complex hybrid and cloud-native environments.
This tiered approach avoids the common beginner mistake of trying to learn every tool in this list at once, which usually results in shallow familiarity with everything and genuine proficiency with nothing.
Common Mistakes and Troubleshooting Tips
- Using default C2 profiles out of the box. Cobalt Strike and similar tools ship with default Malleable C2 profiles that are instantly recognizable to modern EDR products — always customize traffic profiles before an engagement.
- Ignoring cloud identity attack paths. Many red teams still focus heavily on on-prem Active Directory while modern organizations run hybrid or fully cloud-based identity — bring cloud-specific tooling into scope where relevant.
- Overusing Mimikatz without OPSEC awareness. Mimikatz is heavily signatured by nearly every AV/EDR product; running it without in-memory evasion techniques will likely trigger an alert immediately.
- Treating tool lists as a substitute for methodology. Having the right tools doesn’t replace disciplined planning, patient pacing, and a clear engagement objective — tools are the “how,” not the “why.”
- Forgetting to update tooling regularly. Frameworks like Sliver, Havoc, and BloodHound are actively developed, with detection evasion techniques and features changing frequently — running an outdated version can mean missing both new capabilities and new defensive countermeasures baked into recent releases.
Security Risks and Defensive Recommendations
For defenders reading this from the blue team side, these tools represent exactly what your detection stack should be tuned against:
- Monitor for LLMNR/NBT-NS traffic patterns consistent with Responder-style attacks, and disable these legacy protocols via Group Policy where possible
- Deploy behavioral EDR detection rather than relying solely on signature-based detection, since modern C2 frameworks are specifically built to evade static signatures
- Monitor for anomalous Kerberos ticket requests (a common Kerberoasting indicator) and enforce strong, managed service account passwords
- Audit Azure AD/Entra ID and Microsoft Graph API permissions regularly, since cloud identity abuse is an increasingly common red team (and real attacker) objective
- Establish baseline behavioral monitoring for privileged account usage patterns to catch lateral movement regardless of which specific tool is used
Frequently Asked Questions
1. Is Cobalt Strike still worth using in 2026 given how well-known it is? It’s still capable, but its widespread detection footprint means mature teams typically invest heavily in custom Malleable C2 profiles and additional evasion layers, or choose a less commonly fingerprinted alternative depending on the engagement’s stealth requirements.
2. What’s the best free alternative to Cobalt Strike? Sliver and Mythic are both strong open-source alternatives, each offering solid cross-platform support and active development communities, without licensing costs.
3. Do I need to learn all 20 of these tools to be an effective red teamer? No — focus on mastering the categories relevant to your target environments first (typically Active Directory tooling and at least one C2 framework), then expand into cloud and AI-specific tooling as needed.
4. Why is BloodHound considered so essential in Active Directory red teaming? Because manually mapping attack paths across a domain with thousands of objects, groups, and permissions is practically impossible by hand — BloodHound automates that analysis into a visual, actionable graph.
5. Are AI red teaming tools relevant if my organization doesn’t use LLMs yet? Not immediately, but given how quickly organizations are adopting AI-powered applications and agents, it’s worth understanding this category even if it’s not yet part of your current engagement scope.
6. How do I practice with these tools without breaking any laws? Build an isolated home lab with your own Active Directory environment and vulnerable machines, and practice exclusively there before ever touching a real, authorized engagement.
7. Which tool should a beginner start with? Start with Impacket and BloodHound for Active Directory fundamentals, alongside a lightweight open-source C2 framework like Sliver, before moving into more advanced or commercial tooling.
Conclusion
The red team toolkit of 2026 reflects where real attacks are actually happening — hybrid Active Directory and cloud identity environments, EDR-aware C2 infrastructure, and now, emerging AI-powered application attack surfaces. Tool familiarity matters, but the tools listed here are only as effective as the methodology and discipline behind them: proper reconnaissance, careful OPSEC, patient pacing, and always, always, explicit written authorization before a single command runs against a real target. Build your skills in an isolated lab first, understand what each tool is actually doing and why, and let the engagement’s objective — not tool popularity — guide what you reach for.
For a deeper reference on general offensive security commands and techniques that complement this toolkit, see this <a href=”https://awjunaid.com/ethical-hacking/extended-penetration-testing-cheatsheet/”>extended penetration testing cheatsheet</a>, and for a broader roadmap into the field, this guide on <a href=”https://awjunaid.com/cyber-security/stop-being-a-script-kiddie-master-ethical-hacking-in-2025/”>moving from beginner to skilled ethical hacker</a> is a solid next read.