Sherlocked Security – Emotet/Containment Campaign Simulation
Simulate a Real-World Emotet Campaign to Assess Your Organization’s Defenses Against Advanced Malware
1. Statement of Work (SOW)
Service Name: Emotet/Containment Campaign Simulation
Client Type: Enterprises, Financial Institutions, Government, Critical Infrastructure, MSSPs
Service Model: Simulated Malware Campaign with Advanced Containment Testing
Compliance Coverage: NIST 800-53, SOC 2, ISO 27001, CIS Controls, PCI-DSS
Simulation Types:
- Emotet Malware Simulation
- Phishing Campaign Emulation (Initial Access)
- Lateral Movement Testing (Internal Network Spread)
- Command and Control (C2) Simulation
- EDR/AV Bypass and Malware Persistence
- Ransomware Payload Simulation (Post-Exploitation)
2. Our Approach
[Pre-engagement & Test Scope Definition] → [Malware Simulation Setup] → [Phishing & Payload Delivery] → [Initial Access & Exploitation] → [Lateral Movement & C2] → [Persistence & Data Exfiltration] → [Containment Testing & Remediation] → [Reporting & Retesting]
3. Methodology
[Client Kickoff & Scope Agreement] → [Malware Family Simulation Plan] → [Payload Development & Delivery] → [Malware Execution & Detection] → [Lateral Movement Testing] → [C2 Simulation & Exfiltration] → [Post-Exploitation & Data Exfiltration] → [Containment Testing] → [Final Report & Recommendations]
4. Deliverables to the Client
- Malware Simulation Plan: Overview of simulated Emotet campaign and tactics
- Attack Path Mapping: Visual representation of lateral movement and escalation
- EDR/AV Bypass Findings: Detailed report on detection evasion and persistence
- Containment Gap Analysis: Testing of containment capabilities during attack lifecycle
- Executive Summary: High-level report of findings for management
- Detailed Technical Report: In-depth analysis of attack stages, detection gaps, and remediations
- Remediation Plan: Actionable steps to improve detection, containment, and prevention
- Retesting & Readiness Certification: Validation of improvements and final security posture
5. What We Need from You (Client Requirements)
- Access to target network or simulation environment
- Information on deployed endpoint security (AV/EDR/NGAV)
- Approval to run simulated Emotet attack and persistence techniques
- Access to internal team for containment validation
- Collaboration with the SOC or incident response team during testing
- Specific restrictions on operational impacts during simulation (e.g., downtime limits)
6. Tools & Technology Stack
- Cobalt Strike / Brute Ratel
- Metasploit Framework
- Emotet Malware Simulator (custom-developed)
- Phishing Simulation Tools (GoPhish, KingPhisher)
- Remote Access Tools (RATs)
- Custom Evasion Scripts and Payloads
- EDR/AV Testing Scripts
- Custom Tools / Scripts
7. Engagement Lifecycle
1. Discovery Call → 2. Scope & Strategy Alignment → 3. Malware Simulation Setup → 4. Test Execution (2-3 weeks) → 5. Detection Testing & Analysis → 6. Draft Report & Client Review → 7. Final Report + Remediation Plan → 8. Retesting & Final Certification
8. Why Sherlocked Security?
| Feature | Sherlocked Advantage |
|---|---|
| Advanced Malware Simulation | Simulate real-world Emotet tactics and techniques |
| Custom Payload Development | Tailored Emotet payloads that bypass endpoint defenses |
| Lateral Movement Testing | Emulate post-exploitation techniques, from internal spread to C2 |
| Comprehensive Detection & Evasion Testing | Test endpoint detection, sandbox evasion, and persistence |
| Containment Validation | Ensure your organization’s incident response can handle a live attack |
| Retesting Included | 1 round free, additional at a reduced cost |
9. Real-World Case Studies
Financial Institution Emotet Simulation
Objective: Test Emotet malware delivery and lateral movement on the corporate network.
Outcome: Successfully bypassed EDR and spread through internal systems via SMB and PowerShell.
Fix: Strengthened endpoint monitoring, implemented SMB traffic analysis, and added PowerShell script blocking.
Government Department Phishing Campaign
Client: Local government cybersecurity team
Scenario: Emotet phishing emails used to test user response and internal escalation.
Findings: 20% of employees clicked on malicious links, malware spread internally.
Result: Phishing training implemented, multi-factor authentication (MFA) enforced.
10. SOP – Standard Operating Procedure
- Initial discovery call and approval for phishing tests
- Setup of malware simulation environment
- Define test boundaries and simulation parameters
- Launch Emotet phishing campaign and initial access tests
- Malware execution, persistence, and lateral movement testing
- Evaluate EDR/AV effectiveness during attack simulation
- Monitor containment and response effectiveness
- Draft report for client review and feedback
- Final report delivery with remediation plan
- Retesting after remediation and security certification
11. Emotet Simulation Checklist
1. Initial Access
- Simulate phishing emails with weaponized attachments (T1566)
- Simulate credential harvesting via fake login pages (T1071)
- Emulate document macros or exploit payloads (T1203)
- Test email filtering and sandbox evasion techniques
- Bypass email security tools (SPF, DMARC, DKIM checks)
2. Execution & Persistence
- Use PowerShell, WMI, or regedit for persistence (T1064, T1100)
- Deploy malicious DLL or backdoor trojans
- Test persistence using AutoRun keys or Scheduled Tasks
- Simulate download and execution of secondary payloads
- Inject code into trusted processes (T1055)
3. Lateral Movement & C2 Simulation
- Test lateral movement via SMB, RDP, or PsExec (T1075, T1021)
- Simulate domain escalation or password spraying attacks (T1071)
- Create or use rogue user accounts for movement (T1078)
- Simulate C2 communications via HTTP/HTTPS, DNS, or SMB
- Test beaconing mechanisms for command and control persistence
4. Data Exfiltration & Impact
- Test data exfiltration through encrypted channels (T1041, T1071)
- Simulate data staging in cloud services or email
- Test automated exfiltration via scripts or payloads
- Verify endpoint data loss prevention mechanisms (DLP)
- Test remote desktop or remote access techniques
5. Containment & Response Testing
- Test endpoint isolation and network segmentation
- Validate incident response team’s detection & escalation process
- Test effectiveness of quarantine or removal methods
- Evaluate response time during simulated breach
- Assess effectiveness of containment during attack lifecycle