What is the best way to simulate a Ransomware attack during a Red Team engagement?

All answers to this question.

To simulate ransomware safely, you should follow the MITRE ATT&CK framework for the "Impact" stage without actually destroying data. Use the Atomic Red Team scripts by Red Canary; they have specific tests for shadow copy deletion and mock encryption behaviors that trigger EDR alerts without damaging the filesystem. For lateral movement, demonstrate how an attacker can use BloodHound to find paths from a standard user to a Domain Admin. In a 2024 simulation, we used "Canary Tokens" placed in sensitive directories. When our "malware" touched those files, it sent an alert to the SOC. This proved the path was vulnerable while keeping all corporate data perfectly intact and accessible.

   Answered 2025-04-15 by Susan Martinez

Do you recommend running these simulations on production machines, or is it better to isolate a "Gold Image" in a sandbox environment for the demo?

   Answered 2025-04-28 by Robert Wilson

• Robert, for a Red Team exercise, you want to test the actual production defenses—the EDR, the SOC response time, and the internal segmentation. However, you must have a "Kill Switch" in your scripts. Never use actual encryption logic. Instead, create dummy files and move them to a hidden folder. This shows the movement and the "theft" without the risk of an unrecoverable system crash or actual data loss for the business.

     Commented 2025-05-05 by James Anderson

We used Caldera by MITRE for our last simulation. It automates the adversary emulation and gives a very professional report that is easy for the board to understand.

   Answered 2025-05-12 by Jennifer Clark

• Caldera is fantastic for that "professional" feel. The visual graphs of how the "attacker" moved through the network are worth a thousand words during the post-mortem meeting.

     Commented 2025-05-20 by Christopher Evans