Elastic Security Labs published a comprehensive guide on automating GOAD and live malware labs by combining Ludus infrastructure automation with Elastic’s SIEM/XDR platform.
The setup merges Game of Active Directory labs for identity-based attacks like Kerberoasting with live malware simulation using XZbot (CVE-2024-3094), all safely isolated through pinhole egress controls.
The malware half builds on Ludus’s own xz backdoor lab, which puts a Debian 12 VM with the patched liblzma next to REMnux and FLARE VM workstations and cuts off the internet with ludus testing start.
The trigger comes from Anthony Weems’ xzbot, which swaps the backdoor’s hardcoded ED448 key for one he holds and notes that successful exploitation leaves no INFO or higher log entries.
An earlier post collects the analyses of the backdoor itself.
With 1,500+ prebuilt detection rules and AI-powered attack correlation, this turns manual purple team lab validation into a repeatable, continuous detection-engineering pipeline: cyber range as code, if you will.
