Understand RAZE adversary modeling

The Red-team Adversary eXecution Engine helps teams examine how an attack could unfold. Starting with a security question, it describes a possible sequence of known techniques and the activity they might produce. Teams can use the scenario to review their detection coverage.

Despite its name, RAZE models adversary movement. It does not exploit assets, invoke cloud actions, generate attack traffic, or change the protected environment. Its output is a supported hypothesis, not an observed incident.

Objective-led scenario

A specific question about an asset, identity, cloud risk or security control that the team wants to assess.

MITRE-aligned path

A plausible sequence organized around recognizable adversary techniques for a common review language.

Expected observables

The evidence each modeled stage should leave behind, without generating that activity in the environment.

Coverage perspective

A comparison between expected evidence and available detections or retained sources that exposes questions for validation.

Assumptions to check

The context, limitations, and inferences a reviewer can challenge before using the scenario.

1. 01
   Frame

   State the security objective, protected scope, and question the team needs to test.

2. 02
   Map

   Describe a possible sequence of relevant attack techniques.

3. 03
   Anticipate

   Describe the evidence that should be observable at each stage.

4. 04
   Compare

   Relate the expected evidence to available sources, detections, and known gaps.

5. 05
   Review

   Challenge the assumptions and turn supported gaps into investigation or coverage questions.

• What might an adversary attempt after gaining access to the selected identity or workload?
• Which observable evidence should each modeled stage produce?
• Which existing data sources and detections could identify that evidence?
• Where does the scenario depend on an unverified assumption or missing source?
• Which coverage question should move to hunting, detection review, or a controlled validation exercise?

• A RAZE path is a hypothesis and is never presented as a confirmed attack path.
• Expected observables remain expectations until independent evidence confirms them.
• The engine performs no provider action and makes no change to the protected environment.
• Any response recommendation remains advisory and follows the separate DRX governance path.