Adversary Emulation with MITRE ATT&CK

Chapter 13. Adversary Emulation Resources

Understanding the tactics and techniques of potential adversaries is critical in the dynamic world of cybersecurity. Adversary emulation (AE) is a proactive approach to security testing that aims to mimic the behaviors and actions of real-world threat actors in order to assess an organization’s defenses. Organizations have the opportunity to acquire valuable insights into their vulnerabilities by putting themselves in the shoes of their adversaries, which allows them to fortify their defenses proactively. This section goes into AE resources and tools, emphasizing the importance of the Adversary Emulation Library and introducing the multifaceted Caldera framework. Both of these resources serve as guides for organizations attempting to stay ahead of adversarial tactics in the cybersecurity environment, providing creative solutions to emulate, understand, and counteract adversarial tactics.

Adversary Emulation Library

The Center for Threat-Informed Defense (the Center) is the driving force behind the Adversary Emulation Library, a shining example of cybersecurity innovation. This pioneering open source initiative offers organizations a unique lens to view their defense mechanisms by providing them with a comprehensive set of AE plans. These plans are crafted to simulate real-world TTPs employed by threat actors. The library’s offerings fall into the following broad categories:

Full emulation plans

These in-depth plans are tailored to emulate ...