<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-custom-attack-scenarios
description: >-
  Design, author, and execute custom multi-step attack scenarios tailored to
  organizational threat profiles. Covers scenario planning, MITRE ATT&CK chain
  construction, Caldera adversary profiles, Atomic Red Team customization, and
  end-to-end validation of detection coverage across kill chains.
domain: cybersecurity
subdomain: purple-team
tags:
  - attack-scenarios
  - adversary-emulation
  - mitre-attack
  - caldera
  - kill-chain
  - custom-atomics
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003.001", "T1041", "T1053.005", "T1059.001", "T1566.001"]
---

# Building Custom Attack Scenarios

## Overview

Custom attack scenarios model real-world adversary behavior beyond single-technique
testing. They chain multiple ATT&CK techniques into coherent kill chains that mirror
threat intelligence reports, enabling validation of detection across the full attack
lifecycle from initial access through impact.

## Prerequisites

| Requirement | Install |
|---|---|
| MITRE Caldera | `git clone https://github.com/mitre/caldera.git && pip install -r requirements.txt` |
| Atomic Red Team | `git clone https://github.com/redcanaryco/atomic-red-team.git` |
| Python 3.10+ | For agent tooling and Caldera plugins |
| Sigma CLI | `pip install sigma-cli` |
| ATT&CK Navigator | `git clone https://github.com/mitre-attack/attack-navigator.git` |

## Key Concepts

### Scenario Structure

A custom attack scenario defines an adversary profile with chained techniques:

```yaml
scenario:
  name: "APT29 Initial Compromise"
  adversary: APT29
  objective: "Establish persistence and exfiltrate credentials"
  kill_chain_phases:
    - phase: initial-access
      technique: T1566.001
      description: "Spearphishing attachment via macro-enabled document"
      atomic_test: custom-apt29-phish-01
    - phase: execution
      technique: T1059.001
      description: "PowerShell stager execution"
      atomic_test: T1059.001-1
    - phase: persistence
      technique: T1053.005
      description: "Scheduled task for persistence"
      atomic_test: T1053.005-1
    - phase: credential-access
      technique: T1003.001
      description: "LSASS memory dump"
      atomic_test: T1003.001-1
    - phase: exfiltration
      technique: T1041
      description: "Exfiltration over C2 channel"
      atomic_test: custom-exfil-c2-01
  expected_detections:
    - rule: "proc_creation_win_powershell_encoded_cmd"
    - rule: "proc_access_win_lsass_dump"
    - rule: "schtask_creation_suspicious"
```

### Caldera Adversary Profile

```yaml
# caldera adversary profile
id: custom-apt29-scenario
name: APT29 Credential Theft
description: Emulates APT29 credential harvesting chain
atomic_ordering:
  - "a]f4c5b2-1234-5678-9abc-def012345678"  # T1059.001
  - "b2e3c4d5-2345-6789-abcd-ef0123456789"  # T1053.005
  - "c3f4d5e6-3456-789a-bcde-f01234567890"  # T1003.001
objective: credential-harvest
```

### Custom Atomic Definition

```yaml
attack_technique: T1566.001
display_name: "Phishing: Spearphishing Attachment"
atomic_tests:
  - name: "APT29 Macro Document Execution"
    auto_generated_guid: custom-apt29-phish-01
    description: >-
      Simulates APT29 spearphishing with macro-enabled document that
      spawns PowerShell stager.
    supported_platforms:
      - windows
    input_arguments:
      payload_url:
        description: URL for simulated C2 callback
        type: url
        default: "http://127.0.0.1:8080/callback"
    executor:
      command: |
        powershell.exe -NoProfile -Command "Invoke-WebRequest -Uri '#{payload_url}' -Method POST -Body 'beacon=init'"
      cleanup_command: |
        Remove-Item $env:TEMP\payload.* -ErrorAction Ignore
      name: powershell
      elevation_required: false
```

## Workflow

### 1. Threat Intelligence Mapping

```bash
# Query ATT&CK for threat group techniques
curl -s "https://attack.mitre.org/groups/G0016/" | \
  grep -oP 'T\d{4}(\.\d{3})?' | sort -u > apt29_techniques.txt

# Generate ATT&CK Navigator layer
node agent.js generate-layer \
  --group APT29 \
  --techniques-file apt29_techniques.txt \
  --output apt29_layer.json
```

### 2. Build Scenario from Intelligence

```bash
# Create scenario from technique list
node agent.js build-scenario \
  --name "APT29 Credential Theft" \
  --techniques T1566.001 T1059.001 T1053.005 T1003.001 T1041 \
  --output scenarios/apt29_cred_theft.yaml

# Validate scenario references valid atomics
node agent.js validate-scenario \
  --scenario scenarios/apt29_cred_theft.yaml \
  --atomics-dir atomics/
```

### 3. Create Caldera Adversary Profile

```bash
# Deploy scenario to Caldera
node agent.js deploy-caldera \
  --scenario scenarios/apt29_cred_theft.yaml \
  --caldera-url http://localhost:8888 \
  --api-key ADMIN123

# Verify adversary profile loaded
curl -s http://localhost:8888/api/v2/adversaries \
  -H "KEY: ADMIN123" | jq '.[] | select(.name == "APT29 Credential Theft")'
```

### 4. Execute Scenario

```powershell
# Execute full scenario chain
$techniques = @('T1566.001','T1059.001','T1053.005','T1003.001','T1041')
foreach ($t in $techniques) {
    Write-Host "[*] Executing $t" -ForegroundColor Yellow
    Invoke-AtomicTest $t -TestNumbers 1 -TimeoutSeconds 120
    Start-Sleep -Seconds 30  # Allow detection pipeline to process
}
```

### 5. Validate Detection Coverage

```bash
# Check detection coverage for scenario
node agent.js coverage-report \
  --scenario scenarios/apt29_cred_theft.yaml \
  --siem-url https://splunk:8089 \
  --timeframe 30m
```

## Detection

```yaml
title: Custom Attack Scenarios Detection
id: 4260e5b1-f2ed-44b5-943a-493ea128c8fa
status: experimental
description: Detects suspicious activity related to building custom attack scenarios techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*custom*"
  condition: selection
level: medium
tags:
  - attack.t1003.001
  - attack.t1041
  - attack.t1053.005
  - attack.t1059.001
  - attack.t1566.001
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| Scenario YAML valid | `node agent.js validate-scenario --scenario <file>` |
| All techniques have atomics | Each technique maps to an existing atomic test |
| Caldera profile deployed | Adversary appears in Caldera API listing |
| Kill chain executed end-to-end | All techniques return exit code 0 |
| Detection coverage measured | Coverage report shows alerts per technique |

## References

- [MITRE Caldera](https://github.com/mitre/caldera)
- [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)
- [Atomic Red Team Custom Tests](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [MITRE ATT&CK Groups](https://attack.mitre.org/groups/)
