adversary-emulation

Adversary Emulation — index & methodology

Adversary emulation reproduces a specific, named threat actor's tactics, techniques and procedures (TTPs) — drawn from real, attributed intelligence — to test whether the target's people, process, and tooling detect and respond the way they should. It is distinct from generic penetration testing (opportunistic) and from simulation (abstract/random): emulation is threat-informed — every action traces to something a real group has been documented doing, mapped to MITRE ATT&CK.

Authorized use only. Emulate an actor's TTPs only within the engagement's Rules of Engagement and approved scope. Destructive techniques (Impact tactic: ransomware, wipers, ICS manipulation) are emulated as non-destructive proofs (e.g., a benign canary file, a dry-run) unless the RoE explicitly authorizes otherwise. The goal is to measure detection, not to cause damage.

When to use this

• The operator (or roe.json threat profile) names a specific actor to emulate, or names a sector/region whose dominant threat is a known group.
• A purple-team / ATT&CK-evaluation engagement: run an actor's TTP chain while the blue cell measures detection (see kill-chain-analysis and the blue_cell).
• You want a realistic, defensible attack plan instead of an ad-hoc one.

Methodology (5 steps)

1. Select the actor. Map the engagement's industry/region/crown-jewels to a relevant group (see the catalog below). When unsure, ask the operator via ask_user_question. Record the choice in the OPPLAN.
2. Load the profile. load_skill <slug> (e.g. load_skill apt29-cozy-bear). Each profile carries attribution, targeting, dated campaigns, the actor's TTPs mapped to ATT&CK technique IDs, signature tooling, emulation guidance (how to reproduce each TTP with Decepticon's own tools), and detection notes.
3. Scope to RoE. Intersect the actor's TTPs with the approved scope. Drop or down-scope anything out of bounds (e.g., replace a real wiper with a canary). Forbidden-destination / out-of-scope checks still apply at tool-call time.
4. Emulate in kill-chain order. Walk Initial Access → Execution → Persistence → Priv-Esc → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → C2 → Exfiltration → (proof-of) Impact, using only the techniques this actor is known for. Cite the ATT&CK ID in each finding.
5. Measure & report. Record which actions the blue cell detected/blocked vs. missed (kill-chain-analysis, MTTD), and produce a threat-informed report that ties each result to the emulated actor + ATT&CK technique. Feeds the final report.

This complements soundwave/threat-profile (which picks the actor at planning time) and kill-chain-analysis (which scores detection across the chain).

Actor catalog

Profiles are grounded in MITRE ATT&CK group pages + public advisories; each lists its sources. ATT&CK technique IDs are the source of truth — verify against https://attack.mitre.org/groups/ if intel looks stale.