Anatomy of a Rhysida Intrusion

A real Rhysida kill chain mapped to MITRE ATT&CK — 24 stages across all 12 tactics, from no-MFA VPN login through Zerologon, ntds.dit exfiltration to domain-wide encryption. Step through stage by stage, or watch the 8-hour timeline play out.

Source: mr-r3b00t/org_cyber_attack_sim · Rhysida scenario, fully client-side, MITRE ATT&CK tagged.

24 stages

Across all 12 MITRE ATT&CK tactics

8-hour timeline

Realistic dwell time and exfil pacing

Rhysida TTPs

Real tooling and techniques mapped

Rhysida simulation runningOpen in new tab

Kill Chain Highlights

Initial Access — no-MFA VPN login

Credential Access — Zerologon (CVE-2020-1472)

Discovery — domain enumeration

Lateral Movement — DCSync, PsExec

Collection — ntds.dit extraction

Exfiltration — Rhysida blob upload

Impact — domain-wide encryption

Upstream

mr-r3b00t/org_cyber_attack_sim — live simulation
GitHub — source code