Lore a Red Team Emulation Tool

Abstract

This article presents the red team emulation tool Lore, which uses boolean logic and trained models to automatically select and execute red team actions. Lore improves the current state of red team automation, and is the first such tool shown to provide a more fun and educational experience than a manual red team during a cyber defence exercise. In addition to the cyber defence exercise, empirical tests are performed to examine the accuracy of Lore's trained models. The results show that application of these models lead to two times more compromised machines than when applying expert-defined models, and five times more compromised machines than when randomly selecting actions.