Red-Teaming Exercises

Use Cases

The Adversary Exercises are delivered by our Red Team and offer a holistic approach for cultivating and enriching your organization's defensive team (known as your Blue Team) capabilities through three primary exercises, each of which can be used at different times during your organization's security maturity or at specific times during your security improvement cycle. While the penetration testing and vulnerability assessment services are designed for discovering and validating weaknesses that an adversary could exploit to gain access to systems or data, the Adversary Exercises services focus on the detection, prevention, and response capabilities of your Blue Team and your security controls as they directly relate to actions performed by a threat actor.

Regardless of your organization's current security maturity, we offer a wide variety of options within the Adversary Exercises services line-up that will help create a stronger defensive posture by discovering gaps in detection and alerting and simultaneously training defenders to spot malicious activity and respond on time to prevent further attacks and impede a threat actor's ability to reach their goals and objectives.

All services from the offensive part of our VOC pillar are available (and sized as Small, Medium, Large) as standalone engagements or through a prepaid retainer (10 to 50 service units).  

Service Features

Collaborative Exercise (purple team)

The Collaborative Adversary Exercise ("CAE") allows your defenders to experience live-fire information security exercises designed to mimic real-world threat scenarios. You defend and/or hunt in your own network, using your own tooling, against a live attack while maintaining a real-time, constant communication channel with the Secureworks Adversary Group ("Red Team").

The CAE is for organizations with established security monitoring—either in-house or third-party monitoring services—that want to test assumptions about current detection, prevention, and response capabilities against common tactics, techniques, and procedures ("TTPs") of modern threat actors. This exercise is an excellent starting point to identify the readiness of your detection, prevention, and response capabilities prior to executing more advanced exercises, such as the Adversary Simulation Exercise ("ASE") and Adversary Emulation Exercise ("AEE").

Each exercise is based on common scenarios that emulate real-world TTPs with a goal of providing actionable events for the defenders so they can identify visibility deficiencies within security controls, and work with our consultants to improve detection capabilities.

• Collaborative Exercise (S:8, Replay:4)

Adversary Emulation Exercise (red team, TI led)

The Adversary Emulation Exercise uses threat intelligence to challenge your organization's capabilities to detect, prevent, and respond to a defined threat actor that is known to target your organization's industry. Through emulating the tactics, techniques, and procedures ("TTPs") of the specific threat actor, the objectives of the exercise are as follows:

1) Identify deficiencies in security controls and alerting that could allow the defined threat actor to act on their goals and objectives unimpeded.

2) Train your defenders to become familiar with and spot indicators of compromise from known threats and common TTPs.

We offers two tiers for the Adversary Emulation Exercise which allow organizations to focus on either a full spectrum of emulated threats through each phase of a cyber-attack or purely on the internal network from a post-breach context.

• Adversary Exercise Lite (S:32, Extra Time: 8 per week
• Adversary Exercise Standard (M:64, Extra Time: 8 per week)

Adversary Simulation Exercise (red team, Full spectrum)

The Adversary Simulation Exercise challenges your organization's capabilities to detect, prevent, and respond to an unknown, sophisticated threat actor with specific goals and objectives that are tailored to your environment and a realistic threat model. The Red Team adopts customized tooling and techniques as needed to assume the role of a unique threat actor. Through simulating a realistic attack by a unique adversary with non-attributable tactics, techniques, and procedures, the objectives of the exercise are as follows:

1) Identify deficiencies in security controls and alerting that could allow a threat actor to act on their goals and objectives unimpeded.

2) Train your defenders to spot indicators of compromise from unknown threats.

3)Test assumptions about detection and prevention against tactics and techniques that require deeper drilling into attack primitives.

While the Adversary Simulation Exercise is largely geared towards organizations with a moderate amount of security maturity, we offers two tiers and customization options for the exercise to better help train defenders regardless of your current level of security maturity. This allows for scalable sophistication as well as an option to focus only on the internal network from a post-breach context for organizations who are more interested in examining detection, prevention, and response capabilities from this standpoint only.

• Adversary Exercise Lite (S:32, Extra Time:8 per week; Physical security attacks (1 location): 16; Wireless (1 location): 8)
• Adversary Exercise Standard (M:64, Extra Time:8 per week; Physical security attacks (1 location): 16; Wireless (1 location): 8)