Simulating adversary activity

For our detection lab, we may not have a red team readily available, but we still need to track how well our detections respond to realistic threat actor techniques. Fortunately, there are some free and publicly-available breach and attack simulation (BAS) resources we can use to emulate adversary behavior. We cover some noteworthy, freely available options in this section.

An important note on impairing security tools

Some validation tools and techniques can get blocked by different security controls, which is normally a good thing. However, this might prevent the validation exercise from being run as required. A preventative control on an endpoint can in some cases limit our ability to validate detective controls.

For example, consider the scenario where we need to validate detections for the creation of the log file associated with executing the mimikatz misc::memssp module. If we run mimikatz, but it immediately gets blocked and removed by...