Emulating an Adversary with Imperfect Intelligence
MITRE ATT&CK lead Adam Pennington shares strategies for crafting realistic adversary emulation plans even when threat intelligence reports are incomplete or vague.
Summary
The Reality of Incomplete Threat Intelligence
Public cyber threat intelligence reports rarely contain exhaustive playbooks, often leaving gaps in specific command-line arguments, tool configurations, and timelines.
Bridging the Gaps in Adversary Profiles
Adam Pennington demonstrates how purple team planners interpolate missing technical details by analyzing adversary objectives, tool capabilities, and analogous campaigns.
Structuring Emulation Plans with MITRE ATT&CK
The author explains mapping ambiguous report text into concrete ATT&CK techniques, sub-techniques, and actionable procedural tests.
Maximizing Defensive Validation and Training Value
The presentation offers practical guidance for red and blue teams to maximize the educational impact of emulation exercises despite imperfect adversary telemetry.
Related talks
Red Team Village·46 min
Pablo González
Pablo González presents ATTPwn, an open-source adversary emulation framework designed to automate MITRE ATT&CK techniques and validate defensive controls.
Red Team Village·45 min
Ch33r10
Ch33r10 explains how to transform cyber threat intelligence (CTI) from static indicators of compromise into dynamic 'Indicators of Emulation' for red teams.
Red Team Village·55 min
Chris Cottrell
Chris Cottrell introduces the Guerrilla Red Team methodology, empowering distributed engineering teams to act as trusted internal ethical hackers.