Huntress Acquires Inside Agent: A New Era for Identity ProtectionFree Trial
Menu
InvestorsCareersBlogAboutAcademySupportContact
LoginSign up
ADVERSARY SIMULATION · RED TEAM · PURPLE TEAM · APT EMULATION

Know Your Enemy.Before They KnowYour Weaknesses.

Intelligence-led adversary simulation that replicates the exact tactics, techniques, and procedures of threat actors targeting your sector — measuring your true detection and response capability under sustained, realistic attack conditions.

Adversary Simulation

Operate exactly
like the adversary.

We deploy operators who think, plan, and execute exactly like the threat actors targeting your organisation — testing not just your tools, but your people, processes, and detection capability under authentic adversarial conditions.

OPERATOR-0x1A · TARGET: REDACTED · SESSION: 04d 22h 17mLIVE
[09:09:03]C2 BEACON: HTTPS malleable — cdn-microsoft-update[.]com
[02:31:44]LSASS DUMP: 3 domain admin NTLM hashes extracted [EDR-ALT-0214]
[03:18:22]PASS-THE-HASH: EXCH01 mailbox access confirmed
[00:44:19]KERBEROASTING: 7 SPNs targeted — 2 passwords cracked offline
[07:12:08]ADCS ESC1 ABUSE: domain admin via cert — CA template exploited
[22:00:11]EXFILTRATION: 18.4 GB via DNS tunnel — undetected over 6h
[08:14:22]OSINT COLLECTION: 847 assets catalogued
MITRE ATT&CK v14 · 9 TECHNIQUES EXECUTED2 ALERTS TRIGGERED · 7 EVADED
THREAT SCOPE — ACTIVE
0min
Avg MTTD
Mean time to detect operator activity
0%
Detection Rate
Techniques that triggered any alert
0
TTPs / Engagement
Techniques per full red team operation
0days
Avg Dwell Time
Undetected access before SOC awareness

Intelligence-Led Planning

Every simulation begins with adversary profiling — identifying the specific threat groups targeting your sector, their documented TTPs, and your highest-value assets from the attacker's perspective.

Full Kill Chain Execution

Operators execute the complete adversary lifecycle — from initial reconnaissance through persistence, lateral movement, and mission execution — with no artificial scope restrictions.

ATT&CK Coverage Analysis

Every technique exercised is mapped against MITRE ATT&CK in real-time, producing a precise technique-level coverage heatmap showing exactly where your detection capability fails.

Continuous Programme Model

Adversary simulation as an ongoing capability — not a point-in-time assessment. Quarterly operations track your evolving environment and measure detection maturity improvement over time.

Threat Actor Coverage

Six adversary archetypes.
Each simulated with precision.

We maintain current intelligence on the full spectrum of adversary categories — from nation-state APTs to ransomware affiliates. Every simulation is calibrated to the actor group most relevant to your threat environment.

Active Threat

APT28

Fancy Bear / STRONTIUM

OriginRussia — GRU Unit 26165
MotivationStrategic Espionage · Influence Operations
Target Sectors
GovernmentDefenceAerospaceMediaPolitical
Primary MITRE TTPs
T1566.001
T1203
T1098
T1059.001
T1048
Observed Toolset
1
X-Agent
2
Sofacy
3
CHOPSTICK
4
GAMEFISH
TTP Simulation Coverage94%

94% of this group's documented MITRE ATT&CK techniques are exercisable within our simulation framework against your live environment.

Four-Phase Methodology

Intelligence-to-hardening —
a closed-loop engine.

Each phase produces structured outputs that feed directly into the next. The result is not a list of vulnerabilities — it is a precise intelligence picture of your defensive posture against real adversaries.

PH-01

Threat Intelligence Scoping

Targeted adversary profiling for your organisation — mapping specific threat groups active in your sector, their current TTP sets from MITRE ATT&CK, and your highest-value assets from the attacker's perspective. Dark web credential monitoring and supply chain exposure assessment are conducted before day one.

Operation Fidelity25%
Phase Metrics
Threat Actors Profiled6–12 per engagement
TTP Coverage200+ techniques mapped
Intelligence SourcesOSINT · Dark Web · ISACs
Scope DocumentDelivered pre-engagement

Each phase output is documented, timestamped, and passed to the next phase as structured intelligence — maintaining full operational continuity.

Adversary Kill Chain

Seven phases.
One unbroken operation.

Operators move between phases adaptively, responding to your defensive actions in real-time exactly as an actual adversary would. No phase is skipped; no technique is scripted.

Phase 01Target Intel

OSINT collection, infrastructure enumeration, credential exposure analysis, LinkedIn employee profiling, and dark web monitoring. Full attack surface constructed before first contact is made.

MITRE TTPs
T1592T1589T1591
Tools / Methods
Shodancrt.shSpiderFootHaveIBeenPwned
Avg Detection Rate
12%
of organisations detect activity at this phase
Target IntelACTIVE
Initial Access
Establish Hold
Escalate
Lateral Move
Mission Execute
Debrief
MITRE ATT&CK Coverage

Tactic-by-tactic
detection mapping.

Every technique exercised during the operation is logged against MITRE ATT&CK in real-time. This matrix shows representative findings from a recent engagement — red cells are your blindspots.

Detected
Missed
Untested
TA0043
Recon
T1592Host Info Gathering
T1589Identity Data Harvest
T1596Open Tech DB Search
TA0001
Initial Access
T1566.001Spearphishing
T1190Exploit Public SVC
T1195Supply Chain
TA0002
Execution
T1059.003Windows Cmd Shell
T1059.001PowerShell
T1218.005mshta.exe LOLBAS
TA0003
Persistence
T1053.005Scheduled Task
T1547.001Registry Run Keys
T1505.003Web Shell
TA0005
Defense Evasion
T1036Masquerading
T1070Indicator Removal
T1027Obfuscated Files
TA0006
Credential Access
T1003.001LSASS Memory
T1558.003Kerberoasting
T1649ADCS Cert Abuse
TA0008
Lateral Movement
T1021.001RDP
T1021.002SMB Admin Shares
T1550.002Pass-the-Hash
TA0011
Command & Control
T1071.001HTTPS Protocol
T1071.004DNS C2 Channel
T1572Protocol Tunnelling
TA0010
Exfiltration
T1048.003Exfil over DNS
T1041Exfil over C2
T1537Transfer to Cloud
Techniques Simulated27 / 27
Detected by SOC8 (30%)
Missed by SOC16 (59%)
Untested (out-of-scope)3 (11%)
Representative findings — actual coverage map is delivered per-engagement.
C2 Infrastructure

Custom-built per operation.
Nation-state tradecraft.

We never use commodity C2 frameworks. Every engagement gets a purpose-built, purpose-discarded command and control stack — designed from the ground up to replicate your specific threat actor's tradecraft.

OPS
Layer

Operator Workstation

Air-gapped operator workstation running a custom hardened Linux distribution. All traffic leaves through a VPN + Tor chain before hitting redirectors. Operator IP addresses never contact target infrastructure directly at any stage. Full packet capture logs maintained for post-operation forensics.

Air-gapped custom Linux OS
VPN + Tor exit chain
Full PCAP maintained
Complete attribution sanitisation
Stack layer
1 / 6

All C2 infrastructure is destroyed within 48h of operation conclusion. Full technical disclosure of every component — IP ranges, domain names, TLS fingerprints, and implant configuration — is provided in the post-engagement report.

Engagement Reconstruction

Real operation.
Every step documented.

This is a representative reconstruction of an actual full-spectrum engagement. 10 events, 4 days, 2 detections. Domain admin achieved at 72h. 18.4 GB exfiltrated undetected.

10
Events Executed
2
Detected
8
Undetected
20%
Detection Rate
Time
Phase
TTP
Event
Status / Alert
Day 0 · 08:14
Recon
T1589
LinkedIn enumeration + crt.sh subdomain mapping — 847 assets catalogued
UNDETECTED
Day 0 · 11:43
Recon
T1589.001
HIBP breach analysis — 4 valid employee accounts found in credential dump data
UNDETECTED
Day 0 · 14:22
Access
T1566.001
Spearphish to CFO assistant — macro Excel with spoofed DocuSign request header
UNDETECTED
Day 1 · 09:07
Execution
T1218.005
Stage-0 dropper fires via mshta.exe LOLBAS chain on victim workstation
DETECTEDSIEM-RUL-0091: mshta.exe spawns child process
Day 1 · 09:09
C2
T1071.001
Stage-2 implant beacons via HTTPS malleable (cdn-microsoft-update[.]com)
UNDETECTED
Day 2 · 02:31
Cred Access
T1003.001
LSASS dump via comsvcs.dll MiniDump — 3 domain admin NTLM hashes extracted
DETECTEDEDR-ALT-0214: Suspicious LSASS memory read
Day 2 · 03:18
Lateral
T1550.002
Pass-the-Hash to EXCH01 (Exchange) via SMB admin share — mailbox access confirmed
UNDETECTED
Day 3 · 00:44
Escalation
T1558.003
Kerberoasting — 7 SPNs targeted, 2 weak service passwords cracked offline
UNDETECTED
Day 3 · 07:12
Escalation
T1649
Domain admin via ADCS ESC1 cert abuse — misconfigured CA template exploited
UNDETECTED
Day 4 · 22:00
Exfil
T1048.003
18.4 GB exfiltrated via DNS tunnelling (iodine over UDP/53) — undetected over 6h
UNDETECTED

Timeline represents composite findings from a real financial-sector full red team engagement. Organisation names and specific identifiers sanitised per engagement agreement. Average enterprise engagement produces similar or worse detection rates.

Engagement Outcomes

Operation outcomes.
Numbers that prove it.

Every engagement produces a precise, measurable intelligence picture. These are representative metrics from a full-spectrum red team operation against a 4,000-person organisation.

78%
Evasion Rate
Techniques undetected across full 4-day op
91%
ATT&CK Coverage
MITRE ATT&CK v14 techniques exercised
21days
Mean Dwell Time
Undetected persistence before SOC awareness
47+
Detection Rules
Validated SIEM/EDR rules delivered post-op
Technique Coverage Matrix · MITRE ATT&CK v14
DetectedMissed
Phase
TTP·01
TTP·02
TTP·03
TTP·04
TTP·05
TTP·06
RECON
1/6 det.
17%
T1595EVADE
T1592EVADE
T1589EVADE
T1591DETECT
T1597EVADE
T1596EVADE
INIT ACC
1/6 det.
17%
T1566DETECT
T1190EVADE
T1078EVADE
T1133EVADE
T1195EVADE
T1199EVADE
PERSIST
2/6 det.
33%
T1218DETECT
T1547EVADE
T1053EVADE
T1543EVADE
T1505DETECT
T1574EVADE
ESCALATE
3/6 det.
50%
T1558EVADE
T1134DETECT
T1068EVADE
T1055DETECT
T1484DETECT
T1078EVADE
LATERAL
1/6 det.
17%
T1550EVADE
T1021DETECT
T1563EVADE
T1210EVADE
T1080EVADE
T1534EVADE
C2
0/6 det.
0%
T1071EVADE
T1095EVADE
T1132EVADE
T1573EVADE
T1008EVADE
T1090EVADE
EXFIL
1/6 det.
17%
T1048EVADE
T1041EVADE
T1567EVADE
T1030EVADE
T1020EVADE
T1029DETECT
42 total executions · 9 detected · 33 evaded · 7 kill-chain phases78.6% EVASION RATE
Detection by Kill Chain Phase
Reconnaissance
12%/ 88%
88% evaded
Initial Access
34%/ 66%
34%
66% evaded
Establish Hold
28%/ 72%
28%
72% evaded
Escalate Privs
45%/ 55%
45%
55% evaded
Lateral Movement
22%/ 78%
22%
78% evaded
C2 Channels
8%/ 92%
92% evaded
Exfiltration
15%/ 85%
85% evaded
21%
Avg Detection
across all phases
79%
Avg Evasion
techniques undetected
Detection Rules Delivered
SIEM + EDR · validated against live TTPs
47+
Tradecraft Standards

Built to the highest
operator standards.

Our operators are drawn from nation-state intelligence agencies, elite military cyber units, and advanced persistent threat research teams. Every engagement is conducted under formal certification frameworks.

OPSECCustom ToolingHuman-Only OpsATT&CK CoverageDetection Eng.Threat Intel
CBEST
Bank of England
Registered Provider
TIBER-EU
ECB Framework
Certified
PTES
Pentest Exec. Std.
Compliant
OSSTMM
ISECOM v3.0
Aligned
NIST 800-115
Technical Guide
Aligned
MITRE ATT&CK
v14 · 193 Tech.
Full Coverage
Operator Profiles
Nation-State APT Replication
Former intelligence agency operators
Ransomware Operator Tradecraft
eCrime group TTP replication specialists
Social Engineering & Initial Access
HUMINT-trained vishing & phishing specialists
Operation Models

Choose your engagement model.
We execute with precision.

Each model is engineered for a specific programme maturity and security objective.

Maximum Realism
8–12 weeks

Full-Spectrum Red Team

End-to-end adversary simulation with no scope restrictions. Tests your entire security programme — people, process, and technology — under sustained adversarial pressure. SOC operates blind with zero advance notice.

ScopeFull estate — no restrictions
SOC AwarenessNone — blind engagement
Kill ChainReconnaissance through exfil
C2 InfraCustom-built per operation
OutputATT&CK heatmap + roadmap
Best Suited For
Mature security programmes
Pre-M&A validation
Critical infrastructure
Board assurance

Frequently Asked Questions

Frequently asked
questions.

Still have questions?
Our security engineers answer within one business day.
Ask a question