Alex

Red team and offensive security tradecraft is scattered across maybe a few hundred operator blogs. Some are active. Some are stale. It’s kind of hit or miss but definitely a PITA to keep track of them all tbh. Over the past few months, I’ve been working on identifying, cataloging, and indexing as many of them as possible in a centralized location, now housed here: redteam.community/tradecraft. By the numbers, there is currently 6,500+ unique tradecraft-specific blog posts by ~190 unique individuals (many of them operators, researchers, or practitioners) and growing daily. You might notice that the search box has gotten a facelift and upgrade compared to other pages on the site. It’s a RAG pipeline that you can ask questions using natural language, and the retrieval is pretty cool too. I feel like a lot of “chat with the docs” tools embed everything into vectors and just call it a day. That ends up handling fuzzy questions moderately well but isn’t practical for what operators would actually search for. Retrieval runs two ways at once. First, the question is rewritten into a keyword rich query. Then a dense retriever (vector embeddings) finds posts by meaning while a sparse retriever (postgres full text) matches exact terms literally, in parallel. The two rankings are then fused with RRF (reciprocal rank fusion), and an LLM reranks the survivors against the original question. The top posts go to the model, which answers strictly from them, with citations. If the corpus doesn’t cover it, it says so instead of inventing some made up hallucinated bs. Basically, you can ask the way you think: “how do operators bypass AMSI to run .NET tooling in memory?” That should return specific writeups from multiple authors with each technique credited to the operator who published it. Or maybe you might ask, “what does modern phishing tradecraft look like in 2026?” That should surface evilginx style MFA bypass, Cloudflare Turnstile evasion, and primary refresh token phishing, with links to the sources. No hallucinated slop since it’s a RAG. One design decision I care a lot about that I want to call out is attribution. So, even when the tradecraft originates from a company blog, the post is still credited to the individual who wrote it (not the company’s social account). This was intentional and a little extra work, but well worth it IMO. It’s not to take anything away from the teams at companies like SpecterOps or TrustedSec who put out amazing content on their company blogs. I love you guys! I really just wanted to try to focus on showcasing tradecraft authors and their personal contributions across the field. Lastly, there is an entire discovery pipeline that will attempt to find new sources (new tradecraft authors) on a daily basis. The RAG also checks the sources for new posts on a daily basis too. That said, discovery isn’t perfect. So, if you know of a tradecraft blog that is missing, please consider adding it using the +add button on the site.