Home

Adversary Emulation Library 📚

Adversary emulation is a specific style of offensive assessment that uses cyber threat intelligence to describe behaviors observed in specific campaigns or malware samples. Using real-world adversaries, the Center for Threat-Informed Defense (Center) maintains this library of adversary emulation plans and maps them to MITRE ATT&CK techniques. The goals of these emulations plans are to enable organizations to evaluate their defensive capabilities and provide red teams a template to emulate adversaries.

Emulation plans provide a step-by-step execution of the adversaries actions based on open-source intelligence reporting and mapped to MITRE ATT&CK techniques. Source code and commands are provided to execute the plan. The library contains two types of adversary emulation plans:

Full emulation 🥧 - starting with initial access that build on each previous step until the adversary's objective are accomplished
Micro emulation 🍰 - a focused approach to emulating compound behaviors seen across multiple adversaries

For more information, we have blogs! ✍️

📓 Adversary Emulation Library 📔 Micro Emulation Plans