Adversary Emulation, index & methodology

Adversary emulation reproduces a specific, named threat actor's tactics, techniques and procedures (TTPs), drawn from real, attributed intelligence, to test whether the target's people, process, and tooling detect and respond the way they should. It is distinct from generic penetration testing (opportunistic) and from simulation (abstract/random): emulation is threat-informed, every action traces to something a real group has been documented doing, mapped to MITRE ATT&CK.

Authorized use only. Emulate an actor's TTPs only within the engagement's Rules of Engagement and approved scope. Destructive techniques (Impact tactic: ransomware, wipers, ICS manipulation) are emulated as non-destructive proofs (e.g., a benign canary file, a dry-run) unless the RoE explicitly authorizes otherwise. The goal is to measure detection, not to cause damage.

When to use this

• The operator (or roe.json threat profile) names a specific actor to emulate, or names a sector/region whose dominant threat is a known group.
• A purple-team / ATT&CK-evaluation engagement: run an actor's TTP chain while the blue cell measures detection (see kill-chain-analysis and the blue_cell).
• You want a realistic, defensible attack plan instead of an ad-hoc one.

Profile interpretation

A profile groups attribution, targeting, dated campaigns, ATT&CK technique IDs, tooling, implementation examples and detection notes. Industry, geography and crown-jewel similarity suggest candidate profiles; they do not establish the operator's chosen mission or authorize the actor's full campaign.