Rhombus use-case briefingOffensive validation
Prove your detections fire against real adversary techniques
Rhombus runs adversary techniques against an isolated range on the kit. Defenders confirm each attack produces the telemetry and detection it should. It turns "we think we would see it" into a repeatable, evidence-backed answer.
Why it matters
- A detection you have never triggered is an assumption, not a control.
- Repeatable attack playbooks let you prove coverage and catch silent regressions.
- Every technique maps to MITRE ATT&CK, so gaps are named in a shared language.
How it works on Rhombus
- Deploy the range from the console as a mission package — an isolated Active Directory forest plus the attack tooling.
- Three attack engines drive the range — single-technique atomic tests, deterministic playbook simulations, and chained agent-based emulation.
- A full-featured penetration-testing workstation provides manual tradecraft through a browser-based desktop.
- The console can reset the range to its delivered baseline between cohorts; Kali content refreshes through signed bundles.
From deployment to results
- Deploy the offensive validation mission package from the console.
- Select the techniques or emulation plan to run against the range hosts.
- Run the techniques while endpoint and network sensors capture the telemetry.
- Confirm the paired detection fired, then reset the range to the known-good baseline.
Defense and government use cases
- Cyber protection teams validate detection coverage before an operation or inspection.
- Defensive cyber operations generate positive controls to prove sensors and rules work.
- Instructors detonate techniques live so trainees watch telemetry appear and hunt it.
Commercial use cases
- Banks and financial services can validate security operations detections against current attacker tradecraft.
- Enterprise incident response teams can rehearse the run, detect and validate loop in a safe range.
- Managed security service providers can demonstrate detection efficacy to their clients.
Outcomes
- Each technique is paired to the telemetry and detection it should produce.
- Runs are repeatable, so detection gaps and regressions surface consistently.
- Results map to MITRE ATT&CK for briefing coverage in a common framework.
Considerations
- The range is deliberately vulnerable and isolated; it is not a hardened production asset.
- Agent-based emulation runs fully offline once staged; some atomic content is staged to the offline mirror as a prerequisite.
- Sizing the range and its sensors is a prerequisite; scope every run to range assets only.
Integrated tools
- Kali Linux
- Atomic Red Team
- PurpleSharp
- MITRE Caldera
Commercial products are licensed as part of your configuration. Product names are trademarks of their respective owners, and their use does not imply endorsement.