Tenacity: An Adversary Emulation Tool for Persistence
Atul and Harshal present Tenacity, an adversary emulation tool automating the deployment and testing of complex Windows persistence mechanisms.
Summary
The Critical Importance of Persistence in Adversary Campaigns
Adversaries prioritize persistence mechanisms to maintain long-term access across reboots, accounting for over 30% of top techniques observed in the MITRE ATT&CK framework.
Architecture of the Tenacity Framework
Atul and Harshal introduce Tenacity, an automated adversary emulation toolkit engineered specifically to deploy, manage, and clean up Windows persistence techniques.
Simulating Diverse Persistence Primitives
Tenacity automates scheduled tasks, registry run keys, COM hijacking, service creation, and WMI event subscriptions across enterprise endpoints.
Validating Blue Team Hunting Playbooks
The authors demonstrate how defensive teams can use Tenacity to benchmark baseline persistence detection scripts and validate forensic readiness.
Related talks
Adversary Village·30 min
David Hunt
CALDERA creator David Hunt introduces Prelude Operator, an accessible desktop adversary emulation platform designed to automate offensive security testing.
Adversary Village·38 min
Mauricio Velazco
Mauricio Velazco presents PurpleSharp, an open-source C# adversary simulation tool that generates realistic Active Directory attack telemetry across Windows environments.
Adversary Village·31 min
Samuel Kimmons
Samuel Kimmons provides a foundational guide to adversary emulation, explaining how threat intelligence and the MITRE ATT&CK framework guide testing.