TTP Designer — compose a realistic Cymulate scenario for one MITRE technique
cymulate_ttp_designerDesign attack and evasion scenarios for Cymulate security validation, producing realistic commands that trigger EDR/SIEM alerts, with IOCs and detection rules.
Instructions
LOCAL composition tool. Does NOT call the Cymulate API. Returns a structured directive the assistant uses to: (1) query the operator knowledge-rag for real tradecraft (LOLBAS, hacktricks, RTFM, Falcon detection queries), (2) fill a Cymulate scenario/template payload with commands that ACTUALLY trigger EDR/SIEM (not synthetic defaults), (3) produce Mermaid diagram + expected IOCs + detection rules. HARD BLOCK: this tool produces NEW scenarios/templates only. NEVER use this output to modify or delete Cymulate default templates. Always POST to /v2/scenario/create or /v1/purple-team/templates.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| intent | Yes | Natural-language description of what to simulate, e.g. "credential dumping via LSASS abuse using LOLBAS, evasion medium, target Windows 11 with Defender + Falcon" | |
| evasion_level | No | none = raw payload (baseline); basic = renamed binaries + encoded args; advanced = DLL sideloading + AMSI/ETW patching hints; apt = full tradecraft (staged C2, jitter, LotL) | basic |
| output_format | No | ev_scenario = simple EV scenario (POST /v2/scenario/create); advanced_template = Purple Team template with executions (POST /v1/purple-team/templates) | advanced_template |
| stack_context | No | Defender stack in target env, e.g. "CrowdStrike Falcon + Splunk ES + Zscaler + Defender for Endpoint" | |
| detection_focus | No | Which detection layers to target — used to enrich sigma/KQL rules for validation | |
| mitre_technique | No | MITRE ATT&CK technique ID, e.g. T1003.001. If omitted the assistant infers from intent. | |
| target_platform | No | windows | |
| cleanup_required | No | MUST be true for shared/production tenants to keep dashboards clean. Includes rollback command and artifact removal | |
| execution_context | No | user |