Indicators of Emulation
Proposes extracting indicators of emulation from cyber threat intelligence to model adversary behaviors more accurately.
Summary
Evolving Beyond Indicators of Compromise
Traditional cyber threat intelligence (CTI) programs focus heavily on compiling static indicators of compromise (IOCs) such as hashes and IP addresses for triage and alerting.
Defining Indicators of Emulation
Indicators of emulation (IOEs) capture behavioral patterns, environmental dependencies, and actionable procedural nuances extracted from threat telemetry, providing actionable blueprints for red and purple teams.
Operationalizing Intelligence for Threat Simulation
The speaker details methods for extracting IOEs from Windows-based malware analysis reports, translating threat intelligence directly into realistic adversary emulation campaigns.
Related talks
Adversary Village·31 min
Samuel Kimmons
Samuel Kimmons provides a foundational guide to adversary emulation, explaining how threat intelligence and the MITRE ATT&CK framework guide testing.
Blue Team Village·56 min
Ch33r10 · Jorge Orchilles
Ch33r10 and Jorge Orchilles turn standard threat reports into actionable intelligence, demonstrating advanced TTP extraction, adversary emulation, and hunting pivots.
Red Team Village·45 min
Ch33r10
Ch33r10 explains how to transform cyber threat intelligence (CTI) from static indicators of compromise into dynamic 'Indicators of Emulation' for red teams.