ATK — Attacker mission
Run an automated kill chain: script the intrusion, stand up resilient C2, tunnel out, and adapt faster than the defender can write a rule.
Red & Blue Automation Cyber Range Training
At scale, the fight is won by whoever automates faster — the attacker chaining tooling, or the defender shipping detections as code.
DEF — Defender mission
Turn the attack into detections-as-code, automate triage and containment with SOAR, and close the loop so the next run of the same technique is caught instantly.
AI — What the Coach reviews
Coverage of your detections against the techniques the red side actually ran, your mean-time-to-detect, and where automation closed — or widened — the gap.
MITRE ATT&CK techniques covered
- T1059 Command and Scripting Interpreter
- T1071.001 Application Layer Protocol: Web Protocols (C2)
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1027.002 Obfuscated Files: Software Packing
Technique IDs are indicative of the kill chains modelled in this domain; each match draws a unique path through them.
Why this matters
- Breach-and-attack-simulation and purple-team programmes (e.g. Atomic Red Team, Caldera) as standard practice.
- Detection-as-code with Sigma and CI pipelines turning incidents into permanent coverage.
- Commodity C2 frameworks lowering the bar for automated, adaptive intrusions.
Attack. Defend. Repeat.