<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-adversary-profiles
description: >-
  Build intelligence-driven adversary profiles from CTI sources, mapping threat
  actor TTPs to MITRE ATT&CK, generating emulation plans, and producing ATT&CK
  Navigator layers for detection coverage analysis.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - threat-intelligence
  - adversary-profiling
  - mitre-attack
  - attack-navigator
  - cti
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1595", "T1592", "T1589", "T1590"]
  frameworks: ["MITRE ATT&CK", "Diamond Model", "Kill Chain"]
  tools: ["python3", "attack-navigator", "stix2"]
---

# Building Adversary Profiles

## Overview

Adversary profiles translate threat intelligence into actionable emulation plans.
By mapping known threat actor TTPs to MITRE ATT&CK techniques, teams can design
realistic simulations that test detection and response capabilities against the
specific threats most relevant to their organization.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `stix2` | Security tooling |
| `mitreattack-python` | Security tooling |
| Access to CTI feeds (MISP, OpenCTI, or STIX/TAXII sources) | Environment requirement |
| MITRE ATT&CK Navigator for layer visualization | Environment requirement |
| Threat intelligence reports for target actor groups | Environment requirement |

## Workflow

### Step 1: Gather Threat Intelligence

```bash
# Query MITRE ATT&CK for threat group TTPs
node scripts/agent.js profile --actor "APT29" --format json

# Pull STIX bundles from CTI platform
node scripts/agent.js fetch-stix --source "https://cti-taxii.mitre.org" --group "APT29"
```

### Step 2: Map TTPs to ATT&CK

```python
from mitreattack.stix20 import MitreAttackData

attack = MitreAttackData("enterprise-attack.json")

# Get techniques used by threat group
group = attack.get_group_by_alias("APT29")
techniques = attack.get_techniques_used_by_group(group)

for tech in techniques:
    obj = tech["object"]
    print(f"{obj.external_references[0].external_id}: {obj.name}")
```

### Step 3: Generate Navigator Layer

```bash
# Export ATT&CK Navigator layer for visualization
node scripts/agent.js navigator --actor "APT29" --output apt29-layer.json

# Overlay with existing detection coverage
node scripts/agent.js coverage --layer apt29-layer.json --detections detections.json
```

### Step 4: Build Emulation Plan

```
Emulation Plan Structure:
├── Threat Actor Summary — Motivation, targets, capabilities
├── TTP Inventory — Ordered by kill chain phase
├── Technique Details
│   ├── ATT&CK ID and name
│   ├── Procedure example from CTI
│   ├── Emulation command or tool
│   └── Expected detection signature
├── Infrastructure Requirements — C2, redirectors, payloads
└── Execution Timeline — Phased approach with checkpoints
```

## Detection

```yaml
title: Adversary Profiles Detection
id: faa1b75d-b014-4f0f-a5ca-92bfd44cdb7a
status: experimental
description: Detects suspicious activity related to building adversary profiles techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*adversary*"
  condition: selection
level: high
tags:
  - attack.t1595
  - attack.t1592
  - attack.t1589
  - attack.t1590
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Adversary Profiles Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1595, T1592, T1589, T1590 |

## Verification

- [ ] Threat actor TTPs mapped to ATT&CK techniques
- [ ] Navigator layer generated with accurate scoring
- [ ] Detection coverage overlay identifies gaps
- [ ] Emulation plan includes all kill chain phases
- [ ] Procedure examples sourced from verified CTI

## References

- [MITRE ATT&CK Groups](https://attack.mitre.org/groups/) — Threat group profiles
- [MITRE CTI STIX/TAXII](https://github.com/mitre/cti) — Machine-readable ATT&CK data
- [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) — Layer visualization
