# Emulation Strategy

## Phase 1: Technique Selection (budget: 15%)
1. Select ATT&CK technique(s) to emulate
2. Research: exact commands/tools used in real-world attacks
3. Prepare atomic test: specific command sequence that exercises the technique
4. Define expected observables: what logs/alerts SHOULD fire

## Phase 2: Pre-Emulation Check (budget: 10%)
1. Verify detection rules exist for this technique
2. Confirm log sources are active and forwarding
3. Note current alert queue state (to distinguish new alerts)
4. Coordinate with SOC if running in production

## Phase 3: Execute Emulation (budget: 30%)
1. Run the atomic test in the target environment
2. Record: exact commands, timestamps, source host, user context
3. Wait for log propagation delay (typically 1-5 minutes)
4. Check: did expected alerts fire?

## Phase 4: Detection Verification (budget: 30%)
1. If alerts fired: validate alert quality (accuracy, context, severity)
2. If no alerts: determine why — missing log source? Rule gap? Evasion?
3. For partial detection: identify what was caught and what was missed
4. Document: technique, emulation method, detection result, gaps

## Phase 5: Remediation (budget: 15%)
1. For missed detections: write or update detection rules
2. For partial detections: improve rule specificity or coverage
3. Re-run emulation to verify fix
4. Update ATT&CK coverage layer

## Pivot Triggers
- Emulation blocked by security controls → document prevention, test detection of blocked attempt
- Alert fatigue from noisy rule → tune before re-testing
- Technique not applicable → skip, document reason, move to next priority
