# US 10,812,516 B2 · Cyber security posture validation platform > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,812,516 B2 - Document ID: US10812516B2 - Status: Granted - Kind: B2 - Application number: 14/818,975 - Filed: 2015-08-05 - Published: 2016-02-11 - Granted: 2020-10-20 - Earliest claimed: 2014-08-05 - Assignees: AttackIQ, Inc. - Applicants: AttackIQ, Inc. - Inventors: Stephan Chenette; Rajesh Kumar Sharma - Web page: https://patentgrep.com/patent/US10812516B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A cyber security assessment platform is provided. The platform can assess the security posture of a network by deploying one or more scenarios to be executed on one or more assets on the network and analyzing the outcomes of the scenarios. A scenario can be configured to validate a device or network status, and/or mimic an unauthorized cyber-attack. Each scenario can include one or more phases defining an execution path. Related method, apparatus, systems, techniques and articles are also described. ## Claims ### Claim 1 A computer-implemented method for implementation by a data processor and a selected asset of a network forming part of a computing system, the method comprising: receiving, by the data processor, data specifying a scenario, the data specifying the scenario including instructions and code generated to mimic an attack of the network by a third party via the selected asset or to validate a device or a network status in compliance with one or more predefined network integrity standards, the scenario comprising a plurality of phases defining an execution path and the selected asset of the network on which to execute the plurality of phases wherein the plurality of phases and the execution path mimic a plurality of steps of an attack cycle of the attack wherein one of the plurality of phases corresponds to a point of entry phase and wherein at least another of the plurality of phases occurs after the point of entry phase; initiating deployment, by the data processor, of the scenario to an agent deployed at the selected asset to run the scenario on the selected asset; executing, by the selected asset of the network, the plurality of phases of the scenario wherein at least a portion of the execution path is a logical execution path and wherein execution of the scenario includes conditionally executing ones of the plurality of phases; receiving, from the agent, outcome data characterizing an outcome for each of the plurality of phases; and providing, by the data processor, the outcome data. ### Claim 2 (depends on 1) The computer-implemented method according to claim 1, wherein the providing comprises at least one of: storing the outcome data, loading the outcome data into memory, transmitting the outcome data to a remote computing system, or displaying the outcome data in a graphical user interface. ### Claim 3 (depends on 1) The computer-implemented method according to claim 1, further comprising: collecting, by at least one data processor, attack intelligence data representing the attack, wherein the attack intelligence data comprises one or more indicators of attack of the attack; generating, by at least one data processor, an attack intelligence element based on one or more elements collected from the attack intelligence data; wherein the execution path of the phases are generated based on the attack intelligence element. ### Claim 4 (depends on 1) The computer-implemented method according to claim 1, further comprising: collecting, by at least one data processor, attack intelligence data representing the attack; analyzing, by at least one data processor, the attack intelligence data to determine whether the attack is destructive. ### Claim 5 (depends on 1) The computer-implemented method according to claim 1, further comprising: deploying, by at least one data processor, a second scenario to a further asset of the network, wherein the execution path of the phases includes a coordination of the asset and the further asset. ### Claim 6 (depends on 1) The computer-implemented method according to claim 1, wherein the scenario is stored in a local cache of the selected asset, wherein the execution of the scenario by the selected asset is executed from the local cache. ### Claim 7 (depends on 1) The computer-implemented method according to claim 1, wherein the agent runs on the selected asset. ### Claim 8 (depends on 1) The method according to claim 1, wherein the scenario further comprises: at least one parameter controlling the execution of at least one of the plurality of phases. ### Claim 9 (depends on 1) The method according to claim 1, wherein the agent runs on a computing device attached to the selected asset. ### Claim 10 (depends on 1) The computer-implemented method according to claim 1, wherein the scenario is a first scenario, and the method further comprises: automatically generating a second scenario from the outcome data. ### Claim 11 (depends on 10) The computer-implemented method according to claim 10, wherein the second scenario comprises one or more phases of an attack in a particular execution path. ### Claim 12 (depends on 1) The computer-implemented method according to claim 1, wherein the one or more phases are executed sequentially. ### Claim 13 (depends on 1) The computer-implemented method according to claim 1, wherein the one or more phases are executed conditionally. ### Claim 14 (depends on 1) The computer-implemented method according to claim 1, wherein the outcome for each of the plurality of phases is a pass or a fail. ### Claim 15 (depends on 1) The computer-implemented method according to claim 1, wherein the scenario is a first scenario, and the method further comprises: searching, based upon the outcome data, for a second scenario related to the first scenario; and automatically launching the second scenario. ### Claim 16 (depends on 1) The computer-implemented method according to claim 1, wherein execution of the scenario includes sequentially executing other ones of the plurality of phases. ### Claim 17 (depends on 1) The computer-implemented method according to claim 1, wherein the other of the plurality of phases includes at least two of: Injection, Escalation, Hiding, Gaining Persistence, Lateral Movement, Command and Control, Exfiltration, and Cleanup. ### Claim 18 (depends on 1) The computer-implemented method according to claim 1, wherein the other of the plurality of phases includes at least Escalation, Hiding and Command and Control. ### Claim 19 A system comprising: a selected asset of a network; data processor; and memory storing instructions which, when executed by the data processor, implement a method comprising: receiving data specifying a scenario, the data specifying the scenario including scenario instructions and code generated to mimic an attack of a network by a third party via the selected asset or to validate a device or a network status in compliance with one or more predefined network integrity standards, the scenario comprising a plurality of phases defining an execution path and the selected asset of the network on which to execute the plurality of phases wherein the plurality of phases and the execution path mimic a plurality of steps of an attack cycle of the attack wherein one of the plurality of phases corresponds to a point of entry phase and wherein at least another of the plurality of phases occurs after the point of entry phase; initiating deployment of the scenario to an agent deployed at the selected asset to run the scenario on the selected asset, wherein at least a portion of the execution path is a logical execution path and wherein execution of the scenario includes conditionally executing ones of the plurality of phases; receiving, from the selected asset, outcome data characterizing an outcome for each of the phases; and providing the outcome data. ### Claim 20 (depends on 19) The system according to claim 19, wherein the providing comprises at least one of: storing the outcome data, loading the outcome data into memory, transmitting the outcome data to a remote computing system, or displaying the outcome data in a graphical user interface. ### Claim 21 (depends on 19) The system according to claim 19, further comprising: collecting attack intelligence data representing the attack, wherein the attack intelligence data comprises one or more indicators of attack of the attack; generating an attack intelligence element based on one or more elements collected from the attack intelligence data; wherein the execution path of the phases are generated based on the attack intelligence element. ### Claim 22 A computer-implemented method for implementation by a data processor and a selected asset of a network forming part of a computing system, the method comprising: receiving, by the data processor, data specifying a scenario, the data specifying the scenario including instructions and code generated to validate a device or a network status in compliance with one or more predefined network integrity standards, the scenario comprising a plurality of phases defining an execution path and the selected asset of the network on which to execute the plurality of phases wherein the plurality of phases and the execution path mimic a plurality of steps of an attack cycle of an attack wherein one of the plurality of phases corresponds to a point of entry phase and wherein at least another of the plurality of phases occurs after the point of entry phase; initiating deployment, by the data processor, of the scenario to an agent deployed at the selected asset to run the scenario on the selected asset; executing, by the selected asset of the network, the plurality of phases of the scenario; receiving, from the agent, outcome data characterizing an outcome for each of the plurality of phases; and providing, by the data processor, the outcome data. ### Claim 23 (depends on 22) The computer-implemented method according to claim 22, wherein the agent runs on the selected asset. ### Claim 24 A computer-implemented method for implementation by a data processor and a selected asset of a network forming part of a computing system, the method comprising: receiving, by the data processor, data specifying a first scenario, the data specifying the first scenario including instructions and code generated to mimic an attack of the network by a third party via the selected asset or to validate a device or a network status in compliance with one or more predefined network integrity standards, the first scenario comprising a plurality of phases defining an execution path and the selected asset of the network on which to execute the plurality of phases wherein the plurality of phases and the execution path mimic a plurality of steps of an attack cycle of the attack wherein one of the plurality of phases corresponds to a point of entry phase and wherein at least another of the plurality of phases occurs after the point of entry phase; initiating deployment, by the data processor, of the first scenario to an agent deployed at the selected asset to run the scenario on the selected asset; executing, by the selected asset of the network, the plurality of phases of the first scenario; receiving, from the agent, outcome data characterizing an outcome of the first scenario; providing, by the data processor, the outcome; searching, based upon the outcome, for a second scenario related to the first scenario; and automatically launching the second scenario. ### Claim 25 (depends on 24) The computer-implemented method according to claim 24, wherein the agent runs on the selected asset.