Interactive Attack Path Builder¶

Build realistic adversary attack chains by selecting from 30+ predefined attack steps mapped to MITRE ATT&CK techniques. The builder calculates cumulative risk scores, shows detection coverage from Nexus SecOps content, and exports a structured report for purple team exercises.

Companion Resources

Red Team Methodology — foundational red team planning and execution
Purple Team Operations — collaborative attack/defense exercises
ATT&CK Technique Reference — KQL/SPL detection queries for 60+ techniques
Purple Team Exercise Library — structured exercises aligned to ATT&CK

Load Example:

Attack Step Library

Attack Chain (0 steps)

Click steps from the library to build an attack chain

Risk Score

0

Detection Coverage

0%

Avg Stealth

-

Techniques

0

ATT&CK Mapping

#	Step	Tactic	Technique	Severity	Detection

How to Use¶

Browse the library on the left. Filter by ATT&CK tactic using the buttons.
Click a step to add it to your attack chain on the right.
Review the dashboard for cumulative risk score, detection coverage, and stealth rating.
Check the ATT&CK mapping table to see technique IDs and gap analysis.
Remove steps by hovering over a chain step and clicking the X button.
Load an example preset to study common kill chains.
Export a report to share with your purple team or document findings.

Educational Use Only

All attack paths, technique descriptions, and data in this tool are synthetic and intended for defensive security training. Never use this information for unauthorized access. See Red Team Methodology for rules of engagement guidance.

Pre-Built Attack Paths¶

Ransomware Kill Chain¶

Phishing Attachment Macro Execution PowerShell Scheduled Task LSASS Dump SMB Lateral Movement Service Stop Data Encrypted for Impact

Key insight: 7 of 8 steps have detection coverage in Nexus SecOps. The chain relies on speed — defenders must detect early-stage indicators before lateral movement begins.

APT Data Exfiltration¶

Exploit Public App Web Shell Process Injection UAC Bypass AD Discovery Kerberoasting SMB Lateral Data Staging Exfil Over C2

Key insight: The UAC Bypass step has detection coverage, but Process Injection and Data Staging are gaps. APT chains prioritize stealth over speed.

Insider Threat¶

Valid Accounts Account Discovery AD Discovery Email Collection Data Staging Exfil Over Web Service

Key insight: Insider threat paths have the highest average stealth rating. Only 2 of 6 steps are detected because legitimate credential use blends with normal activity. Focus on behavioral analytics and DLP.

Resource	Description
Red Team Methodology	Planning and executing red team engagements
Purple Team Operations	Collaborative attack/defense exercises
ATT&CK Technique Reference	KQL and SPL detection queries for 60+ techniques
Purple Team Exercise Library	Structured exercises mapped to ATT&CK
ATT&CK Gap Analysis	Coverage gaps and remediation priorities
Detection Query Library	Full catalog of detection rules