Introduction to Adversary Emulation
Samuel Kimmons provides a foundational guide to adversary emulation, explaining how threat intelligence and the MITRE ATT&CK framework guide testing.
Summary
The Fundamentals of Threat-Informed Defense
Adversary emulation bridges the gap between vulnerability scanning and real-world defense by systematically replicating the tactics, techniques, and procedures (TTPs) of specific threat actors.
Leveraging Cyber Threat Intelligence (CTI)
Samuel Kimmons explains how to extract actionable TTPs from intelligence reports and map adversary campaigns onto the MITRE ATT&CK matrix.
Structuring Controlled Emulation Engagements
Kimmons walks through engagement lifecycles, from defining testing scope and rules of engagement to coordinating purple team collaboration between red and blue teams.
Measuring and Improving Security Posture
The presentation illustrates how security teams can use emulation results to close defensive gaps, tune SIEM correlation rules, and validate detection engineering.
Related talks
Adversary Village·38 min
Mauricio Velazco
Mauricio Velazco presents PurpleSharp, an open-source C# adversary simulation tool that generates realistic Active Directory attack telemetry across Windows environments.
Adversary Village·30 min
David Hunt
CALDERA creator David Hunt introduces Prelude Operator, an accessible desktop adversary emulation platform designed to automate offensive security testing.
Adversary Village·29 min
Atul · Harshal
Atul and Harshal present Tenacity, an adversary emulation tool automating the deployment and testing of complex Windows persistence mechanisms.