Microsoft releases SimuLand, a test lab for simulated cyberattacks

Microsoft has released SimuLand, an open-source lab environment to help test and improve Microsoft 365 Defender, Azure Defender, and Azure Sentinel defenses against real attack scenarios.

SimuLand test labs "provide use cases from a variety of data sources including telemetry from Microsoft 365 Defender security products, Azure Defender, and other integrated data sources through Azure Sentinel data connectors," MSTIC Threat Researcher Roberto Rodriguez said.

Lab environments deployed using SimuLab can help security experts "actively test and verify the effectiveness of related Microsoft 365 Defender, Azure Defender, and Azure Sentinel detections, and extend threat research using telemetry and forensic artifacts generated after each simulation exercise."

SimuLab test environments are designed to help security teams:

Understand the underlying behavior and functionality of adversary tradecraft. Identify mitigations and attacker paths by documenting preconditions for each attacker action. Expedite the design and deployment of threat research lab environments. Stay up to date with the latest techniques and tools used by real threat actors. Identify, document, and share relevant data sources to model and detect adversary actions. Validate and tune detection capabilities.

Currently, the only lab environment available for deployment allows researchers to test and improve their defenses against Golden SAML attacks that allow threat actors to forge authentication to cloud apps.

You can share your own end-to-end simulation scenarios by opening new issues on the SimuLand GitHub repository.

Besides working on adding more scenarios, Microsoft also wants to add automation of attack actions via Azure Functions in the cloud, telemetry export and share, Microsoft Defender evaluation labs integration, as well as infrastructure deployment and maintenance using CI/CD pipelines with Azure DevOps.

Lab environments contributed through this open-source Microsoft initiative require an Azure tenant and at least a Microsoft 365 E5 license (paid or trial).

— Microsoft Security (@msftsecurity) May 20, 2021

Last month, the Microsoft 365 Defender Research team also released an open-source cyberattack simulator dubbed CyberBattleSim.

This simulator allows creating simulated network environments that model how AI-controlled cyber agents (the threat actors) spread through a network after its initial compromise.

"The simulated attacker's goal is to take ownership of some portion of the network by exploiting these planted vulnerabilities," Microsoft explained.

"While the simulated attacker moves through the network, a defender agent watches the network activity to detect the presence of the attacker and contain the attack."