Tradecraft Development in Adversary Simulations
Fatih Ozavci shares systematic methodologies for developing custom tradecraft, repurposing public tools, and tuning evasion for high-maturity adversary simulations.
Summary
Building Campaign-Specific Adversary Tradecraft
Real-world threat actors rarely develop entirely new tools for every engagement; they strategically select, modify, and repurpose existing open-source and commercial tooling.
Analyzing Tool Selection and Weaponization Tradeoffs
Fatih Ozavci examines the operational calculus behind tool selection, analyzing when to build custom implants versus when to pack and modify public frameworks.
Developing Resilient Evasion Primitives
Ozavci demonstrates practical techniques for modifying public tools to strip known IOCs, implement custom memory loaders, and bypass endpoint inspection hooks.
Structuring Continuous Tradecraft Development
The author provides red team leads with a structured operational pipeline to research, build, and maintain evasive tradecraft across simulation lifecycles.
Related talks
Adversary Village·30 min
David Hunt
CALDERA creator David Hunt introduces Prelude Operator, an accessible desktop adversary emulation platform designed to automate offensive security testing.
Red Team Village·1 hr
Sajal Thomas
Sajal Thomas examines the technical gap between commercial red teams and state-sponsored APT groups, sharing advanced tradecraft to elevate offensive testing.
CSIT Village·24 min
Shao Xiang
Shao Xiang examines understanding the adversary mindset is essential for cyber defenders to anticipate how attackers operate and strategically strengthen defenses.


