Attack Validation
Validate Red Team attacks against Blue Team detection capabilities
Validation Success Rates
87
Total Validations
64
Validated (74%)
15
Failed (17%)
8
Pending (9%)
Validation Scenarios
Spearphishing Attachment
PowerShell Execution
Registry Run Keys
Bypass UAC
LSASS Memory Dump
Remote Desktop Protocol
Process Injection - DLL
Local Account Discovery
Validation Details
T1566.001 - Spearphishing Attachment
Initial Access
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.
Attack Steps (Red Team)
Detection Points (Blue Team)
Validation Results
EDR detected malicious macro execution and blocked payload download. Email gateway flagged as suspicious but allowed delivery.
- Email Gateway: Partial detection (flagged but allowed)
- Endpoint EDR: Detected and blocked macro execution
- PowerShell Logging: Captured malicious activity
- Network Monitoring: No alert (payload blocked before connection)
Notes & Comments
Email gateway needs tuning to block rather than just flag. Consider implementing stricter macro policies.
Agreed. Will update email security rules to quarantine Office files with macros from external senders.