Cyber Attack Simulation — Cyber Kill Chain
End-to-end adversary emulation · Tuwaiq Academy — Best Project Award
- Tuwaiq Academy — Cybercrime & Advanced DFIR
- Best Cybersecurity Project
- Rayan Alharbi · Ziyad Alharbi
- Q1 2026
Overview
A controlled adversary emulation exercise walking a single target through all seven stages of Lockheed Martin's Cyber Kill Chain. The operation impersonated a Tuwaiq Academy instructor to social-engineer a top-performing student, delivered a WinForms-based trojan disguised as a project organiser, established command-and-control over a raw TCP listener, and exfiltrated sensitive documents over HTTP — while documenting defensive controls at every stage.
My Role
Lead operator — reconnaissance, weaponization, delivery, C2 infrastructure, and defensive write-up. Authored the full kill-chain report and the executive briefing.
Tools & Frameworks
1 · Reconnaissance
Passive OSINT against the target's LinkedIn profile using ContactOut to recover a mobile number, instructor identity, and cohort name. No active probing was performed; every artifact was already public.
- Defence — reduce public exposure of sensitive PII
- Awareness training on oversharing and privacy hygiene
2 · Weaponization
Built a spoofed 'Talent Recruitment' landing page mimicking the Tuwaiq Academy brand, generated a deepfake voice message of the instructor using an AI voice-cloning service, and packaged a Python trojan disguised as a project file organiser.
- Detonate suspicious payloads inside a sandbox before opening
- Monitor newly registered look-alike domains
3 · Delivery
The spoofed link and the deepfake audio were delivered over WhatsApp; the trojan followed via email framed as an official file for high-performing students.
- Secure Email Gateway with attachment sandboxing
- Audio forensics on suspicious voice notes (unnatural cadence, missing ambient noise, repeated phonemes)
4 · Exploitation
The target submitted full PII into the spoofed form (name, national ID, address, DOB) and executed the trojan believing it to be a benign organiser. The form captured every field server-side and confirmed submission back to the victim.
- Centralised SIEM log analysis on form submissions and endpoint executions
- Endpoint protection with EDR, modern AV, and exploit-guard policies
5 · Installation
The trojan renders an innocuous UI while silently indexing Desktop, Documents, and Downloads for high-value extensions (PDF, DOCX, XLS). A benign facade builds user trust and keeps the process resident.
- Application allow-listing to block untrusted binaries
- SIEM correlation across process-creation and file-access events
6 · Command & Control
The implant beacons to an attacker-controlled ncat listener on port 4444 and posts collected file snippets as JSON over HTTP. Full request captured on the attacker VM (Windows 10, VMware Workstation) shows python-requests/2.32.5 posting a 5,955-byte payload.
- Egress firewall rules — deny outbound HTTP to unknown IPs
- Network segmentation to limit lateral reach
7 · Actions on Objectives
Sensitive documents including 'Password.docx' were exfiltrated and rendered in the attacker's JSON response window, demonstrating full mission success on a single unaware human target.
- DLP inspection on outbound file content
- At-rest encryption on sensitive documents
Outcome
Full kill-chain executed successfully in the lab. Awarded Best Cybersecurity Project by Tuwaiq Academy. Deliverables include the executive brief, defensive playbook, and the attached slide report.
Supporting File
Full Kill Chain Report
PDF · 10 pages