Simulation of Pre-Ransomware Attacks on Active Directory

Active Directory is adopted by many organizations today. However, not many know how to securely implement it. This is concerning, particularly with the increasing prevalence of ransomware attacks. A ransomware attack inevitably affects organizations' business operations, data loss, and causes financial loss. Our approach aims to enable analysis of technical routes and behavioral aspects of attackers' “pre-ransomware” actions in an AD network while taking their capabilities and attack surfaces into account for realistic scenarios. By integrating simulations of vulnerable AD networks with an SIEM server, we demonstrate how AD attacks are carried out, to collect raw data on such attacks for future study for improvement of organizational detection capabilities.