Hello Reader,
A while back, I shared a post on LinkedIn about building test environments for simulating attacks and creating better training datasets. This is something I’ve done extensively for both my coworkers and my SANS students. With the discontinuation of Detection Lab several years ago, I started exploring alternatives. After reviewing the issues section of Detection Lab and consulting ChatGPT O1, I’ve identified two promising replacements that are currently being maintained:
1. Project ADAZ
Four years ago, Christophe Tafani-Dereeper joined us on the Forensic Lunch to discuss his Azure-supported project for spinning up instrumented networks for testing. According to his GitHub page, it’s still being actively updated. I’ll be revisiting Project ADAZ in my upcoming blog posts to see how it performs today and whether it still meets my needs as it did back then.
Key Features:
- ELK Backend: Provides a robust and widely-used stack for log aggregation, analysis, and visualization.
- Azure Integration: Leverages Azure to create and manage the test environment, making it ideal for organizations already invested in Microsoft’s ecosystem.
- Open Source: Free to use, with full access to the source code for customization.
Limitations:
- Azure Costs: While the software is free, the resources used on Azure (e.g., VMs, storage, bandwidth) can add up quickly.
- Azure Dependency: It’s tightly coupled with Azure, which may not be ideal for those working with other cloud providers or looking for multi-cloud solutions.
- Complexity: Initial setup and configuration may require familiarity with Azure, ELK, and Terraform.It is well documented though and I felt it easy to setup.
2. Splunk Attack Range
The Splunk Threat Research Team has developed an instrumented network-building script, specifically designed for collecting and analyzing logs with Splunk. It’s another compelling option for creating test environments.
Key Features:
- Broad Platform Support: Works with VirtualBox, Azure, and AWS, offering flexibility across various deployment scenarios.
- Splunk-Centric: Designed to send logs directly to Splunk, enabling quick analysis and visualization.
- Actively Maintained: Updates and support from the Splunk Threat Research Team ensure compatibility with current Splunk releases and threat models.
- Attack Simulations: Pre-configured to simulate adversary techniques using open-source tools like Atomic Red Team, enabling realistic threat scenarios.
Limitations:
- Splunk Dependency: Works best with Splunk as the log receiver, making it less attractive for organizations using alternative log aggregation solutions like ELK.
- Resource Requirements: Environments built with Splunk Attack Range can be resource-intensive, requiring significant compute and storage, especially for larger simulations.
- Learning Curve: Requires familiarity with Splunk configurations and potential tuning for specific use cases.
What’s Next?
I’ll be deploying both of these solutions in my test environments to compare their performance, usability, and suitability for various scenarios. Additionally, I’m on the lookout for robust Terraform scripts to build similar environments with cloud-based identity providers (e.g., Azure AD or Google Cloud Identity) instead of traditional local Active Directory.
If you know of any such scripts or have experience with either of these projects, please share your thoughts in the comments below—I’d love to hear your insights!
