# Adversary Emulation

Actor-profile taxonomy, ATT&CK technique fidelity, technical prerequisites and...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill adversary-emulation -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill adversary-emulation -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill adversary-emulation -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill adversary-emulation -g -a gemini-cli -y`

## Description

Actor-profile taxonomy, ATT&CK technique fidelity, technical prerequisites and detection interpretation for authorized adversary emulation.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Adversary Emulation, index & methodology

**Adversary emulation** reproduces a *specific, named* threat actor's tactics,
techniques and procedures (TTPs), drawn from real, attributed intelligence, to test whether the target's people, process, and tooling detect and respond
the way they should. It is distinct from generic penetration testing
(opportunistic) and from *simulation* (abstract/random): emulation is
**threat-informed**, every action traces to something a real group has been
documented doing, mapped to [MITRE ATT&CK](https://attack.mitre.org/).

> **Authorized use only.** Emulate an actor's TTPs **only** within the engagement's
> Rules of Engagement and approved scope. Destructive techniques (Impact tactic:
> ransomware, wipers, ICS manipulation) are emulated as *non-destructive proofs*
> (e.g., a benign canary file, a dry-run) unless the RoE explicitly authorizes
> otherwise. The goal is to measure detection, not to cause damage.

## When to use this

- The operator (or `roe.json` threat profile) names a specific actor to emulate,
  or names a sector/region whose dominant threat is a known group.
- A purple-team / ATT&CK-evaluation engagement: run an actor's TTP chain while the
  blue cell measures detection (see `kill-chain-analysis` and the `blue_cell`).
- You want a *realistic, defensible* attack plan instead of an ad-hoc one.

## Profile interpretation

A profile groups attribution, targeting, dated campaigns, ATT&CK technique IDs,
tooling, implementation examples and detection notes. Industry, geography and
crown-jewel similarity suggest candidate profiles; they do not establish the
operator's chosen mission or authorize the actor's full campaign.

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/SKILL.md