Building a Red-Team Field Manual From ATT&CK, Atomic Red Team and LOLBAS

A layered script pipeline that generates an Obsidian knowledge graph of tradecraft, rebuilt from scratch after an OS migration to prove it's reproducible.

2026-09-12#RTFM

work: May–Sep 2026 · Built, gaps listed · RTFM, Offensive Security, ATT&CK, Automation, Obsidian

Why build it

In BAS and pentest work I kept jumping between the ATT&CK site, Atomic Red Team, LOLBAS, GTFOBins, WADComs, Sigma, Nuclei and random blogs. I wanted one place where a technique links to how it's done, how it's detected, what telemetry it leaves, and where I've practiced it, and I wanted it generated so it stays current.

Shape of the vault

Start Here · Cyber Kill Chain · MITRE ATT&CK Enterprise · Labs and Ranges
Commands and Syntax · Attack Paths and Chains · Knowledge Domains
Mindmaps and Indexes · Scripts and Automation · Templates · References

Each technique is a hub: Procedures → Commands → Detections → Logs/Telemetry → Tools → Payloads/Artifacts → Labs → References. For example, T1047 Overview → Atomic - T1047 → Atomic - T1047 - Windows Management Instrumentation. It's navigated with local graphs and tactic MOCs (Execution, Persistence, Credential Access, Discovery, Lateral Movement); the global graph is too noisy.

The pipeline

Built in layers, with an audit between each:

Layer	Script(s)	Output
1	`create-rtfm-vault.sh`, `generate-attack-enterprise.py`, `enrich-attack-procedures.py`, `generate-attack-indexes.py`	technique/sub-technique notes, relationships, tactic indexes
2	`import-atomic-red-team.py`	Atomic tests as procedure notes
3	`import-tool-source-map.py`, `parse-lolbas-gtfobins-wadcoms.py`, `parse-nuclei-sigma.py`	binary-abuse, detection and check notes mapped to TTPs
fix-up	`backfill-procedure-notes.py`, `repair-per-technique-tools-notes.py`, `audit-rtfm-components.py`	consistency, backfill, component audit

index generation script output — The index-generation pass: 15 tactic indexes, a master index, and per-object indexes for groups, software and campaigns.

Numbers

Layer 3 checkpoint: 371 structured notes, 257 LOLBAS, 104 WADComs, 73 TTP mappings
Backfill: 755 procedure files
Sep 2026 rebuild on the new Fedora workstation: 254 technique folders, 618 sub-technique notes, 761 TTP notes enriched, 1,052 ATT&CK object notes, 15 tactic indexes, then Atomic Red Team re-imported

The rebuild test

When I moved my workstation to Fedora, I didn't copy the vault. I re-ran the pipeline from an empty directory. If a knowledge base can't be rebuilt from scripts, it's a pile of notes, not a system. It came back.

The first build also choked my ThinkPad. Obsidian indexing thousands of freshly generated notes is heavy, so builds now run on the workstation.

Gotcha — GTFOBins' `api.json` isn't JSON

The parser got almost no GTFOBins entries (4). The api.json in the repo is a Jekyll/Liquid template that renders into JSON when the site builds. In the raw repo it's template code. The right source is the _gtfobins/ directory of per-binary files. The parser is being rewritten to read those.

Open items

GTFOBins parser fix (above)
update-rtfm-sources.sh is unfinished
TA0005 naming: the same tactic shows up as both "Stealth" and "Defense Evasion" across sources, so vault paths need normalizing to one name
Git remote: self-hosted (Gitea/Forgejo) rather than GitHub, for a private vault

Sources: Red Team Knowledgebase Guide (26 May 2026), ThinkPad Obsidian Performance (6 Jun 2026), Find RTFM build file (26 Aug 2026), Resurrect RTFM Vault (12 Sep 2026), Tech Portfolio master dump