Autoattack

What must an attacker never reach?

Name the goal you want the agent to pursue. AutoAttack chains real attacks and uses newly gained access to move toward it.

Choose an example

Name the target and the access you want the agent to gain. Leave empty to seek Domain Admin on every reachable domain. Review scope and permissions before deployment.

Free campaigns show the access gained with masked target names. See what a subscription includes.

Domain control

Test whether a foothold can become administrator access to your Active Directory domain.

Directory takeover guide

Example objective

Gain Domain Admin access on our full enterprise forest. Start out with this contractor account sanjay_temp:V!ct0riou5

Name the domain whose administrator access you want tested.

Customer data

Test whether an attacker can read the sensitive records in a named database or file share.

Data access guide

Example objective

Access customer data, start from the server at 10.10.20.4 and use the local account z.smith:SummerT!m3

Name your database or file share and the data to read.

CEO inbox

Test whether an attacker can read messages in the CEO's inbox.

Define the mailbox objective

Example objective

Read the CEO's inbox that's in our on-prem Exchange Server.

Name the CEO's mailbox in your objective.

Your starting position changes the test.

Run the campaign container on a dedicated Linux host with rootful Docker and access to the systems in scope. Start without credentials to test an initial foothold, or supply an authorized account to test how far its access extends.

Review deployment requirements
Help defining your objective Campaign controls and data handling Published assessment results
Autoattack