Becoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations

The talk comes from the MITRE ATT&CK Evaluations team, which builds threat-informed adversary emulations of a named actor, hands them to security vendors for blind testing, and publishes the results. The speakers explain how an emulation differs from a looser red team simulation, since it has to closely match one group's behavior. They walk through choosing an actor, using the Latin American group Blind Eagle as the example, with criteria such as recent open reporting, relevance to defenders, and enough technique variety to support backup plans.

The middle of the talk covers how threat intelligence feeds development. Reports with concrete detail such as file names, infection chains and C2 ports become an emulation plan, a software flow diagram and alternate pivot options. The developer scopes which behaviors are actually needed, studies community code and a public proof-of-concept to rebuild process hollowing, and found that the reported persistence did not work as described. The team resolved that gap by reconstructing a startup-folder shortcut chain that the reporting supported.

The session closed with a recorded demo of the full chain: a phishing PDF, a callback, credential theft from a browser, and reuse of those credentials against a lookalike banking site. Practical takeaways include scoping an emulation to the techniques that matter most, turning single techniques into automated tests to rerun against detections, and citing ATT&CK IDs in code so detection discussions with vendors stay precise. The emulation plan and code were slated for public release on GitHub the following week.