BRAWL – Automated Adversary Emulation Exercise

BRAWL – Automated Adversary Emulation Exercise. One of the challenging problems for cyber security researchers developing detection and response capabilities is finding a realistic environment in which to test their hypothesis and capabilities.

The cheapest method is to test capabilities on a small lab network. But this environment is lacking the scale of real enterprise network and the noise of real environments that makes detection much harder.

BRAWL - Automated Adversary Emulation Exercise
BRAWL – Automated Adversary Emulation Exercise

In many ways, the best environment would be testing on multiple enterprise scale networks with a controlled but realistic attacker and real noise from users, system administrators, and third party software/devices. The challenge with testing in this environment is that it is expensive and in some scenarios high risk.

BRAWL seeks to create a compromise by creating a system to automatically create an enterprise network inside a cloud environment. OpenStack is the only currently supported environment, but it is being designed in such a way as to easily support other cloud environments in the future. BRAWL also builds an analysis network containing a data ingest and processing pipeline using LogStash and Kafka.

As part of the analysis network, it creates an event storage and search system using Elasticsearch and Kibana. The framework spins up a enterprise network “Game Board” with Windows images. These images have Microsoft Sysmon and other sensors already installed and configured to forward logs into the data ingest framework.

The tool also has a concept of bots, which can be either Red, Blue, or Gray. Red bots are offensive, Blue bots are defensive, and Gray bots emulate legitimate user behavior in order to provide noise to make detection more difficult. When a user wants to test research hypotheses, they implement a BRAWL bot. The BRAWL bot registers itself with the BRAWL Controller, which then orchestrates games between BRAWL bots on the Game Board.

You can read more and download this tool over here:

Notify of
Inline Feedbacks
View all comments