  While the digitization of power distribution grids brings many benefits, it
also introduces new vulnerabilities for cyber-attacks. To maintain secure
operations in the emerging threat landscape, detecting and implementing
countermeasures against cyber-attacks are paramount. However, due to the lack
of publicly available attack data against Smart Grids (SGs) for countermeasure
development, simulation-based data generation approaches offer the potential to
provide the needed data foundation. Therefore, our proposed approach provides
flexible and scalable replication of multi-staged cyber-attacks in an SG
Co-Simulation Environment (COSE). The COSE consists of an energy grid
simulator, simulators for Operation Technology (OT) devices, and a network
emulator for realistic IT process networks. Focusing on defensive and offensive
use cases in COSE, our simulated attacker can perform network scans, find
vulnerabilities, exploit them, gain administrative privileges, and execute
malicious commands on OT devices. As an exemplary countermeasure, we present a
built-in Intrusion Detection System (IDS) that analyzes generated network
traffic using anomaly detection with Machine Learning (ML) approaches. In this
work, we provide an overview of the SG COSE, present a multi-stage attack model
with the potential to disrupt grid operations, and show exemplary performance
evaluations of the IDS in specific scenarios.
