# Cyber Attack and Defense Emulation Agents
## 4 Red Team Agent
### Generating and Performing Attack Scenarios
#### 4.5.1 Generating Attack Scenarios
In some cases, it is possible some scenarios go out of use, as mentioned in Section 4.3. The scenario performance process is shown in Figures 8-13. Each figure contains'scenario,' 'pre-state,' 'post-state' information. 'Scenario' is the sequence of the attack techniques derived by the scenario generator. 'Pre-state' and 'post-state' are the states of the red team agent before and after it uses the attack technique, respectively. 'Pre-condition validation' validates the pre-state of the red team agent satisfies the pre-condition of the attack technique to be used next. Unlike the scenario generation assumed the post-state, 'post-condition reflection' in the scenario performance updates the post-state with the actual state after the attack technique is operated. 'Goal verification' process is similar to it on the scenario generation process. It checks if the goal is achieved every time the post-state is reflected, and if the goal is achieved, the red team agent terminates with the successful attack. Figure 8: The example of the process of scenario performance: port scanning. Figure 10: The example of the process of scenario performance: system investigation. Figure 9: The example of the process of scenario performance: CVE-2016-3714 exploitation. Figure 8 shows the example of one scenario performance. The address and protocol information of the target system are stored in the pre-state, 192.168.10.1 and IPv4, respectively. The first attack technique of the scenario is Nmap scanning, and the red team agent manages the pre-condition validation on it. If the result shows the pre-conditions of Nmap scanning matches with the pre-state, the attack technique will be used for the attack. Executing the port scanning (Nmap scanning) could gather the following information of the target system; the operating system is Linux and the opened port is '(TCP, 1234)'. Then, the red team agent makes the pre-state be updated to get the post-state. Figure 9 describes the next step of Figure 8. The post-state of the previous step becomes the pre-state. The first attack in the remainder of the scenario is CVE-2016-3714 exploitation. The red team agent performs the pre-condition validation on the attack technique to exploit CVE-2016-3714. After the technique is executed, the agent operates the exploitation. If the result delivered is a success, the red team agent is able to gain a temporary shell and updates the pre-state to get the post-state. Figures 10-12 imply the similar processes are repeated. The result of the scenario is depicted in Figure 13, and it shows the goal of the scenario has been achieved. As follows, the red team agent stops the attack performance judging the scenario leads to the successful attack on the target system. The general case is to achieve the goal after using all attack techniques in the scenario. This is because attack scenarios are generated just as much as the adversary emulation needs. Figure 11: The example of the process of scenario performance: RAT download. Figure 12: The example of the process of scenario performance: RAT installation.