We evaluate the performance of a genetic algorithm to discover the best set of rules to implement an intrusion against an ICT network. The rules determine how the attacker selects and sequentializes its actions to implement an intrusion. The fitness of a set of rules is assigned after exploiting it in an intrusion. The evaluation of the distinct sets of rules in the populations the algorithm considers requires multiple intrusions. To avoid the resulting noise on the ICT network, the intrusions target a digital twin of the network. We present a preliminary experimental results that supports the feasibility of the proposed solution.
