Dijlah University
Cybersecurity Department
Awareness, training, and security
Report Topic:
Cyber simulation strategies: attack and defense analysis
in a realistic environment
Prepared by:
Yousef Waleed Abdul Latif
Akram Hassan Saad
Introduction:
With the evolution of cyberattacks , passive defense (reliance solely on
software) is no longer sufficient. This report aims to review the results
of a "live simulation" experiment in which an attacker (red team) was
directed to test the effectiveness of defenders (blue team) under the
supervision of a specialized trainer. The focus here is on identifying
vulnerabilities that are not detected by automated systems but only
become apparent through practical application.
2
Initial access breach simulation
1. Experiment Details:
The experiment was conducted using a "guided deception" approach.
The trainer instructed the attacker to exploit a vulnerability in "human
behavior" rather than a software vulnerability.
Phase 1 (Reconnaissance): The attacker collected open- source data
(OSINT) on an employee in the finance department.
Phase 2 (Execution): A phishing email containing a PDF file that
appeared to be a "work policy update" was sent, but it contained a
simple script that created a backdoor.
Phase 3 (Trainer's Role): The trainer observed both parties; instructing
the attacker to minimize "noise" so as not to trigger alarms, and
observing the defender to see if they would detect the unusual activity
originating from the employee's device.
2. Field result:
The experiment showed that the defender was monitoring the strong
“external” attacks, but overlooked the quiet “internal” movement made
by the hacker after taking control of the employee’s device.
3
Information collection :
"OSINT from LinkedIn for the
Finance Department"
Remote Control Box: (Sending a malicious file):
"Create a static connection Phishing email with the
channel to the server" subject line 'Policy Update'
Box (Device hacking):
"Execute the code after opening the
file."
(Spear Phishing Operation Flow)
4
The diagram above illustrates that the attack succeeded because it relied
on a layered attack, where:
In the "information gathering" step: The attacker did not breach any
system but exploited human weakness in the oversharing of professional
data on platforms like LinkedIn.
In the "sending" step: The malicious file was able to bypass the firewall
because it passed through as a seemingly legitimate email and was not
sandboxed.
In the "penetration" step: This occurred due to the employee's lack of
proper training in detecting spear phishing, not because of a vulnerability
in the operating system.
In the "control" step: The attacker successfully established a persistent
connection because they used a protocol (such as HTTPS) that appeared
to be legitimate traffic, causing the defender to overlook it.
5
Technical Anatomy of Defender Weaknesses
In this section, we will explain to the administrator why a
defender sometimes "fails" despite having expensive protection
systems:
Operational Blindness:
The defender often focuses on what is "outside" the network,
while experience has shown that the real threat originated
"inside" a trusted device.
Alert Fatigue:
A technical weakness: The security system sends hundreds of
routine alerts. The defender is human, and over time, they begin
to ignore moderately serious alerts, which is exactly what the
attacker in our experiment exploited to silently infiltrate.
The Detection vs. Response Gap:
The defender may detect unusual activity , but lacks the
"authority" to quickly disconnect the device from the
network for fear of disrupting operations , giving the
attacker enough time to encrypt or steal data.
6
Attacker Weaknesses and How to Exploit Them
Here, we shift the traditional view of the administrator; we show them
that the hacker is not an invincible ghost, but rather has weaknesses that
we can target:
Falling into the "Noise Trap":
No matter how careful the hacker is, they need to communicate with
their C2 server. This communication leaves a traffic pattern that can be
detected if the defender is closely monitoring the outgoing data traffic.
7
Relying on "Common Tools":
Hackers often use well-known software tools (such as Mimikatz or
Metasploit). If we constantly update our attack signatures, we deprive
them of their preferred weapons and force them to improvise, and
improvisation leads to mistakes.
The Time Factor and Resistance:
The hacker seeks quick profits with minimal effort. If we make the
defense "layered" (Layered Defense), the hacker will feel frustrated,
because the more time he spends inside the network without reaching
the target, the more likely he is to be exposed.
8
Strategic Recommendations and Proposed Solutions
Based on the results of the simulation exercise and the analysis of shared
vulnerabilities, we recommend adopting the following methodologies to
enhance the department's cybersecurity resilience:
1. Shift from "traditional awareness" to "active awareness":
Proposal: Instead of annual lectures, we propose conducting surprise
"periodic phishing tests" for employees.
Objective: To measure employee responses to suspicious links in a
secure environment and provide immediate training to those who fall
into the trap.
2. Address "alert fatigue" through intelligent automation:
Proposal: Update the SIEM monitoring systems to reduce false positives
by implementing rules that focus on "user behavior" rather than just pre-
programmed technical alerts.
Objective: To free up defenders to focus on real and serious threats.
3. Adopt a "Zero Trust Architecture":
Proposal: Restrict access privileges so that no employee (even in IT)
has more privileges than are necessary for their actual job.
Objective: To prevent an attacker from "moving laterally" within the
network if they succeed in the initial breach.
9
4. Tabletop Exercises:
Proposal: Holding a monthly meeting between the defense team and the
awareness team to discuss the latest attacker tactics (such as those
reviewed in this report).
Objective: To unify perspectives and bridge the gap between technical
and administrative personnel.
Conclusion:
Cybersecurity is not a product we buy; it's an organizational culture that
begins with the lowest-ranking employee and extends to the highest
management level. This experience has proven that we have the tools,
but we need to enhance "human vigilance" to always be one step ahead
of any intruder.
10
References
MITRE ATT&CK Global Matrix for Classifying Hacker Tactics and
Techniques (2024)."
NIST Cybersecurity Standards:
Writing style: "NIST Cybersecurity Framework (CSF 2.0)."
OWASP Social Engineering Project:
Writing style: "OWASP Annual Report on Human Behavior
Vulnerabilities and Spear Phishing Attacks."
Verizon DBIR Incident Analysis Reports:
Writing format: "Verizon Data Breach Investigation Report (DBIR) -
Cyber Attack Pattern Analysis for 2025/2026."
Training Methodology (SANS Institute):
Writing Style: "SANS Institute Methodology for Training Incident
Response Teams (Incident Response Strategy)."
"This report has been supported by the latest practices from the
MITRE ATT&CK framework for understanding intruder behavior,
and NIST standards to enhance our defensive team's capabilities."
11
12