Focus on the attacks a threat actor would perform when inside an infected system. Stages of Attacks, Malware Droppers, C2 Communications,etc.
More inputs needed on creating the environment and Expanding the idea.