AttackMate: Realistic Emulation and Automation of Cyber Attack Scenarios Across the Kill Chain
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866918296957222912 |
|---|---|
| author | Landauer, Max Hotwagner, Wolfgang Boenke, Thorina Skopik, Florian Wurzenberger, Markus |
| author_facet | Landauer, Max Hotwagner, Wolfgang Boenke, Thorina Skopik, Florian Wurzenberger, Markus |
| contents | Adversary emulation tools facilitate scripting and automated execution of cyber attack chains, thereby reducing costs and manual expert effort required for security testing, cyber exercises, and intrusion detection research. However, due to the fact that existing tools typically rely on agents installed on target systems, they leave suspicious traces that make it easy to distinguish their activities from those of real human attackers. Moreover, these tools often lack relevant capabilities, such as handling of interactive prompts, and are unsuitable for emulating specific stages of the kill chain, such as initial access. This paper thus introduces AttackMate, an open-source attack scripting language and execution engine designed to mimic behavior patterns of actual attackers. We validate the tool in a case study covering common attack steps including privilege escalation, information gathering, and lateral movement. Our results indicate that log artifacts resulting from AttackMate's activities resemble those produced by human attackers more closely than those generated by standard adversary emulation tools. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2601_14108 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | AttackMate: Realistic Emulation and Automation of Cyber Attack Scenarios Across the Kill Chain Landauer, Max Hotwagner, Wolfgang Boenke, Thorina Skopik, Florian Wurzenberger, Markus Cryptography and Security Adversary emulation tools facilitate scripting and automated execution of cyber attack chains, thereby reducing costs and manual expert effort required for security testing, cyber exercises, and intrusion detection research. However, due to the fact that existing tools typically rely on agents installed on target systems, they leave suspicious traces that make it easy to distinguish their activities from those of real human attackers. Moreover, these tools often lack relevant capabilities, such as handling of interactive prompts, and are unsuitable for emulating specific stages of the kill chain, such as initial access. This paper thus introduces AttackMate, an open-source attack scripting language and execution engine designed to mimic behavior patterns of actual attackers. We validate the tool in a case study covering common attack steps including privilege escalation, information gathering, and lateral movement. Our results indicate that log artifacts resulting from AttackMate's activities resemble those produced by human attackers more closely than those generated by standard adversary emulation tools. |
| title | AttackMate: Realistic Emulation and Automation of Cyber Attack Scenarios Across the Kill Chain |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2601.14108 |