<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-initial-access-simulation
description: >-
  Simulate initial access techniques to test perimeter defenses, email gateway
  controls, and endpoint protection against spearphishing, drive-by compromise,
  exploitation of public-facing applications, and valid account abuse.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - initial-access
  - spearphishing
  - drive-by-compromise
  - exploit-public-apps
  - valid-accounts
  - perimeter-testing
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001", "T1566.002", "T1189", "T1190", "T1078"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["python3", "gophish", "atomic-red-team"]
---

# Performing Initial Access Simulation

## Overview

Initial access simulation tests the first stage of an attack chain — how
adversaries establish a foothold in the target environment. This covers
spearphishing with attachments and links, drive-by compromise via watering
holes, exploitation of public-facing applications, and abuse of valid
credentials obtained through prior compromise or social engineering.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `GoPhish (for phishing)` | Security tooling |
| `web application scanners` | Security tooling |
| Authorized scope including email addresses and public services | Environment requirement |
| Email gateway and endpoint protection active and monitored | Environment requirement |
| Coordination with SOC for alert validation | Environment requirement |

## Workflow

### Step 1: Spearphishing Attachment Simulation (T1566.001)

```bash
# Generate safe test payload (benign macro document)
node scripts/agent.js generate-payload --type macro-doc --safe --output test_doc.docm

# Send via phishing platform
node scripts/agent.js send-phish --template "invoice" --attachment test_doc.docm --targets targets.csv

# Verify email gateway detection
node scripts/agent.js check-detection --technique T1566.001 --source email-gateway
```

### Step 2: Spearphishing Link Simulation (T1566.002)

```bash
# Deploy credential harvesting landing page (safe — logs only, no storage)
node scripts/agent.js deploy-landing --template "password-reset" --safe

# Send phishing emails with tracking links
node scripts/agent.js send-phish --template "password-reset" --link "https://safe.example.com/reset"

# Monitor click-through and detection rates
node scripts/agent.js check-detection --technique T1566.002 --source proxy
```

### Step 3: Exploitation of Public-Facing Applications (T1190)

```bash
# Scan authorized public services for known vulnerabilities
node scripts/agent.js scan-services --targets public_services.json --safe

# Simulate exploit delivery (safe payload only)
node scripts/agent.js simulate-exploit --target "https://app.example.com" --cve "CVE-2024-XXXX" --mode dry-run
```

### Step 4: Valid Account Testing (T1078)

```bash
# Test detection of credential stuffing patterns
node scripts/agent.js test-auth --technique T1078 --target "vpn.example.com" --mode simulate

# Check for brute force and anomalous login detection
node scripts/agent.js check-detection --technique T1078 --source siem

# Generate initial access simulation report
node scripts/agent.js report --execution-log initial_access.json
```

## Detection

```yaml
title: Initial Access Simulation Detection
id: 37f81fa1-9b76-4bbb-9d1e-2a8dfcdd043e
status: experimental
description: Detects suspicious activity related to performing initial access simulation techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*initial*"
  condition: selection
level: high
tags:
  - attack.t1566.001
  - attack.t1566.002
  - attack.t1189
  - attack.t1190
  - attack.t1078
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Initial Access Simulation Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1566.001, T1566.002, T1189, T1190, T1078 |

## Verification

- [ ] Spearphishing attachments blocked by email gateway
- [ ] Phishing links detected by proxy or URL filtering
- [ ] Endpoint protection blocks macro execution
- [ ] Exploitation attempts logged and alerted
- [ ] Anomalous authentication patterns detected by SIEM

## References

- [MITRE ATT&CK Initial Access](https://attack.mitre.org/tactics/TA0001/) — Technique catalog
- [Atomic Red Team Initial Access](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/Indexes/Indexes-Markdown/index.md) — Test library
