Method for emulating a known attack on a target computer network

A method for emulating a known attack on a computer network comprising:

• accessing a packet capture file representing packet fragments transmitted between machines during a malicious network attack during a first time period;
• recombining packet fragments within the packet capture file based on packet fragment metadata to generate a set of data packets;
• designating a set of agents installed on assets, within and external to a target network, as actors in a simulation of the malicious attack on the target network;
• for each data packet in the set of data packets:
• defining a transmission trigger for the data packet based on timestamps of corresponding packet fragments in the packet capture file;
• designating a recipient agent, in the set of agents, to receive the data packet;
• designating a source agent, in the set of agents, to transmit the data packet to the recipient agent according to the transmission trigger;
• and
• uploading the data packet to the source agent for storage in local memory during a second time period succeeding the first time period;
• during a third time period succeeding the second time period, initiating transmission of the set of data packets from source agents to recipient agents, in the set of agents, according to the set of transmission triggers to simulate the malicious attack on the target network;
• scanning a log of a security technology, deployed on the target network, for a first security event related to a first data packet in the set of data packets and for a second security event related to a second data packet in the set of data packets;
• in response to presence of the first security event in the log, confirming configuration of the security technology to respond to a first stage of the malicious attack corresponding to the first data packet;
• and
• in response to absence of the second security event in the log, generating a prompt to reconfigure the security technology to respond to a second stage of the malicious attack corresponding to the second data packet.

A method for emulating a known attack on a computer network comprising:

• accessing a packet capture file representing packet fragments transmitted between machines during a malicious network attack during a first time period;
• recombining packet fragments within the packet capture file based on packet fragment metadata to generate a set of data packets;
• designating a set of agents installed on assets, within and external to a target network, as actors in a simulation of the malicious attack on the target network;
• for each data packet in the set of data packets:
• defining a transmission trigger, in a set of transmission triggers, for the data packet based on timestamps of corresponding packet fragments in the packet capture file;
• designating a recipient agent, in the set of agents, to receive the data packet;
• designating a source agent, in the set of agents, to transmit the data packet to the recipient agent according to the transmission trigger;
• and
• uploading the data packet to the source agent for storage in local memory during a second time period succeeding the first time period;
• during a third time period succeeding the second time period, initiating transmission of the set of data packets from source agents to recipient agents, in the set of agents, according to the set of transmission triggers to simulate the malicious attack on the target network;
• scanning a first log of a first security technology, deployed on the target network, for a first security event related to a first data packet in the set of data packets;
• in response to presence of the first security event in the first log, confirming configuration of the first security technology to respond to a first stage of the malicious attack corresponding to the first data packet;
• scanning a second log of a second security technology, deployed on the target network, for a second security event related to a second data packet in the set of data packets;
• and
• in response to absence of the second security event in the second log, generating a prompt to reconfigure the second security technology to respond to a second stage of the malicious attack corresponding to the second data packet.