THREAT OPS › Threat News › Automating GOAD and Live Malware Labs
Automating GOAD and Live Malware Labs
<h2 id="introductiontheneedforascalableautomatedsimulationrange"><strong>Introduction: The Need for a Scalable, Automated Simulation Range</strong></h2> <p>In modern security operations, detection engineering is no longer a “set it and forget it” discipline. The central challenge for any security team – and the question that underpins the entire purple-team approach is simple: <em>how do you know
MITRE ATT&CK techniques
- Scheduled TaskT1053.005
- ServerlessT1583.007
- OS Credential DumpingT1003
- Security Account ManagerT1003.002
- VulnerabilitiesT1588.006
- Supply Chain CompromiseT1195
- MasqueradingT1036
- LSASS MemoryT1003.001
- PowerShellT1059.001
- Exploitation of Remote ServicesT1210
- Brute ForceT1110
- Exploitation for Privilege EscalationT1068
- Credential StuffingT1110.004
- CredentialsT1589.001
- Windows Command ShellT1059.003
- ServerlessT1584.007
- KerberoastingT1558.003
- DCSyncT1003.006
- SQL Stored ProceduresT1505.001
- CompressionT1027.015
- ServerlessAML.T0008.004
- Generative AIAML.T0016.002
- MasqueradingAML.T0074
- OS Credential DumpingAML.T0090
Indicators of compromise
- CVE-2024-3094cve
- CVE-2021-34527cve
- https://ludus.cloud/url
- https://docs.ludus.cloud/docs/quick-start/install-ludusurl
- https://www.orangecyberdefense.com/url
- https://docs.ludus.cloud/docs/environment-guides/malware-laburl
- https://cloud.elastic.co/registrationurl
- https://registry.terraform.io/providers/elastic/ec/latest/docsurl
- https://registry.terraform.io/providers/elastic/elasticstack/latest/docsurl
- https://docs.ludus.cloud/docs/environment-guides/goadurl
- https://docs.ludus.cloud/docs/environment-guides/goad#2-on-the-ludus-host-clone-and-setup-the-goad-projecturl
- https://docs.ludus.cloud/docs/networking#testing-modeurl
- https://docs.ludus.cloud/docs/quick-start/using-cli-locally#wireguardurl
- https://<fleet_domain>:<fleet_port>url
- 1.1.1.1ipv4
- 8.8.8.8ipv4
- 198.51.100.1ipv4
- 198.51.100.2ipv4
- 198.51.100.0ipv4
- 198.51.100.0/24cidr
- static-www.elastic.codomain
- fleet.us-central1.gcp.cloud.es.iodomain
- es.us-central1.gcp.cloud.es.iodomain
- process.iodomain