System and method for emulating a known attack on a target computer network

A method for emulating a known attack on a computer network, the method comprising:

• accessing a set of data packets representing data transmitted between machines in communication with a second computer network during a malicious attack on the second computer network during a first time period;
• selecting a set of assets as actors in an emulation of the malicious attack on a target computer network, the set of assets comprising a first internal asset within the target computer network;
• for each data packet in the set of data packets:
• assigning a transmission trigger, in a set of transmission triggers, to the data packet based on transmission of corresponding data during the malicious attack on the second computer network;
• selecting a recipient asset, in the set of assets, to receive the data packet;
• and
• selecting a source asset, in the set of assets, to transmit the data packet to the recipient asset according to the transmission trigger;
• populating an executable file with the set of data packets and the set of transmission triggers;
• during a second time period succeeding the first time period and in response to execution of the executable file at the first internal asset, initiating transmission of the set of data packets from source assets to recipient assets, in the set of assets, according to the set of transmission triggers to emulate the malicious attack on the target network;
• accessing a set of network event records generated by a security technology, deployed on the target computer network, during the second time period;
• and
• in response to presence of a network event record, in the set of network event records, indicating the malicious attack:
• confirming configuration of the security technology to respond to computer network attacks analogous to the malicious attack at the target computer network.

A method comprising:

• accessing a packet capture file representing packet fragments transmitted between machines in communication with a second network during a malicious attack on the second network;
• recombining packet fragments within the packet capture file based on packet fragment metadata to generate a set of data packets;
• for each data packet in the set of data packets:
• assigning a transmission trigger, in a set of transmission triggers, to the data packet based on transmission of corresponding data during the malicious attack on the second computer network;
• selecting a recipient asset, in a set of assets assigned as actors in an emulation of the malicious attack on the target computer network, to receive the data packet;
• and
• selecting a source asset, in the set of assets, to transmit the data packet to the recipient asset according to the transmission trigger;
• for a first internal asset, in the set of assets and within the target computer network, generating an executable file:
• populated with the set of data packets and the set of transmission triggers;
• and
• configured to selectively initiate transmission of data packets, in the set of data packets, from the first internal asset to recipient assets, in the set of assets, according to transmission triggers, in the set of transmission triggers, responsive to execution of the executable file at the first internal asset;
• and
• storing the executable file for loading onto the first internal asset.