Microsoft Releases SimuLand, a Lab Environment To Simulate Attacker Tradecraft

Microsoft today open-sourced a tool that can be used to build lab environments where security teams can simulate attacks and verify the detection effectiveness of Microsoft security products. From a report: Named SimuLand, the tool was specifically built to help security/IT teams that use Microsoft products such as Microsoft 365 Defender, Azure Defender, and Azure Sentinel. Currently, SimuLand comes with only one lab environment, specialized in detecting Golden SAML attacks.

However, Microsoft said it's working on adding new ones. Community contributions are also welcomed, and the reason the project has been open-sourced on GitHub, with Microsoft hoping to get a helping hand from the tens of thousands of security teams that run its software. "If you would like to share a new end-to-end attacker path, let us know by opening an issue in our GitHub repository, and we would be happy to collaborate and provide some resources to make it happen," Microsoft said today in a blog post. But Microsoft doesn't want only lab environments specialized in executing well-known techniques or adversary tradecraft. The OS maker is also encouraging the community to contribute improved detection rules for the attacks they're sharing, so everyone can benefit from the shared knowledge.

Its a trap!

[Anonymous Coward]

Really Gates? Tricking the rubes into solving cyber attacks for you, for free?

Why bother?

[bobstreo]

When there are already thousands and thousands of sites on the internet that aren't even patched?

The only part of this you need is a nice secure hosted environment in someone elses name to attack from.

Re:

[chispito]

I don't understand your criticism. This is a lab framework so ops and security people can see how Microsoft's security products work with real world scenarios. It's probably also good for security researchers wanting to try out novel attack vectors.

Gamifying attacks.

[Ostracus]

So when will this be coming to the Xbox?

Isn't this like showing theives the door?

[wakeboarder]

Couldn't you just download this and keep running attacks until you find something that works and then deploy it in the real world?

Why simulate?

[RitchCraft]

There are many daily real world attacks going on thanks to Microsoft.

ad supported

[algaeman]

Does it come with Candy Crush installed, or does it download it from the internet as soon as it connects?

We already have this

[Errol backfiring]

We already have this. It's called a PC.