ATTPwn: An Open-Source Framework for Adversarial Emulation
Pablo González presents ATTPwn, an open-source adversary emulation framework designed to automate MITRE ATT&CK techniques and validate defensive controls.
Summary
The Need for Accessible Adversary Emulation Tooling
Validating security control efficacy requires automated tooling that accurately simulates real-world threat actor techniques without complex commercial licensing.
Architecture of the ATTPwn Framework
Pablo González introduces ATTPwn, an open-source platform that structures adversary emulation campaigns around mapped MITRE ATT&CK techniques.
Executing Dynamic Attack Plans and Evaluating Telemetry
The author demonstrates orchestrating automated multi-step attack simulations—including credential dumping, persistence, and discovery—across endpoint fleets.
Improving SOC Detection Engineering with Empirical Data
The presentation shows how purple teams leverage ATTPwn execution logs to identify detection gaps and refine SIEM/EDR alert rules.
Related talks
Red Team Village·57 min
Adam Pennington
MITRE ATT&CK lead Adam Pennington shares strategies for crafting realistic adversary emulation plans even when threat intelligence reports are incomplete or vague.
Red Team Village·55 min
Chris Cottrell
Chris Cottrell introduces the Guerrilla Red Team methodology, empowering distributed engineering teams to act as trusted internal ethical hackers.
Red Team Village·45 min
Ch33r10
Ch33r10 explains how to transform cyber threat intelligence (CTI) from static indicators of compromise into dynamic 'Indicators of Emulation' for red teams.