Method for emulating an attack on an asset within a target network

A non-transitory computer-readable medium storing an executable file comprising instructions that, when executed by a processor of a first internal asset within a target computer network, cause the processor to:

• access a set of data packets from the executable file, the set of set of data packets representing data transmitted between machines in communication with a reference computer network during a malicious attack on the reference computer network, each data packet in the set of data packets:
• associated with a behavior trigger, in a set of behavior triggers, based on a corresponding behavior during the malicious attack on the reference computer network;
• defining a recipient asset, in a set of assets, to receive the data packet;
• and
• defining the source asset, in the set of assets, to transmit the data packet to the recipient asset according to the behavior trigger;
• store the set of data packets in local memory of the first internal asset, the set of data packets comprising a first data packet to which the first internal asset and a second external asset, in the set of assets and external to the target computer network, are assigned;
• initiate transmission of the first data packet from the first internal asset to the second external asset according to a first behavior trigger in the set of behavior triggers;
• and
• generate a context file specifying a set of artifacts representing indicators of the malicious attack responsive to:
• reception of data packets in the set of data packets at the first internal asset;
• and
• transmission of data packets in the set of data packets from the first internal asset.

A method comprising:

• accessing a set of data packets representing data transmitted between machines in communication with a reference computer network during a malicious attack on the reference computer network during a first time period;
• selecting a set of assets as actors in an emulation of the malicious attack on a target computer network, the set of assets comprising:
• a first internal asset within the target computer network;
• and
• a second external asset external to the target computer network;
• for each data packet in the set of data packets:
• assigning a behavior trigger, in a set of behavior triggers, to the data packet based on a corresponding behavior during the malicious attack on the reference computer network;
• assigning a recipient asset, in the set of assets, to receive the data packet;
• and
• assigning a source asset, in the set of assets, to transmit the data packet to the recipient asset according to the behavior trigger;
• generating an executable file:
• comprising the set of data packets;
• defining the set of behavior triggers;
• and
• configured to trigger the first internal asset to generate a context file specifying a first set of artifacts according to a first format, the first set of artifacts representing indicators of the malicious attack responsive to:
• reception of data packets in the set of data packets at the first internal asset;
• transmission of data packets in the set of data packets from the first internal asset;
• and
• execution of behaviors corresponding to behavior triggers in the set of behavior triggers;
• during a second time period succeeding the first time period and in response to execution of the executable file at the first internal asset, initiating transmission of the set of data packets from source assets to recipient assets, in the set of assets, according to the set of behavior triggers to emulate the malicious attack on the target network;
• accessing the context file specifying the first set of artifacts and generated by the first internal asset in response to termination of the emulation of the malicious attack on the target computer network;
• transforming the first set of artifacts into a second set of artifacts according to a second format associated with a target security technology deployed on the target computer network;
• and
• serving the second set of artifacts to the target security technology.