<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-mitre-attack-evaluation
description: >-
  Conduct structured MITRE ATT&CK Evaluations to assess security product
  detection and protection capabilities. Covers evaluation methodology,
  adversary emulation plans, result categorization (telemetry/general/tactic/
  technique), and comparative scoring across products.
domain: cybersecurity
subdomain: purple-team
tags:
  - mitre-attack
  - attack-evaluation
  - detection-categories
  - adversary-emulation
  - product-assessment
  - caldera
  - vendor-evaluation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001"]
---

# Performing MITRE ATT&CK Evaluations

## Overview

MITRE ATT&CK Evaluations assess how well security products detect and respond
to adversary behavior mapped to ATT&CK techniques. This skill implements the
evaluation methodology: building emulation plans from threat intelligence,
executing technique chains, and categorizing results using MITRE's detection
classification system (None, Telemetry, General, Tactic, Technique).

## Prerequisites

| Requirement | Install |
|---|---|
| CALDERA | Adversary emulation platform |
| Atomic Red Team | Individual technique tests |
| ATT&CK Navigator | Results visualization |
| Python 3.10+ | For agent tooling |
| Target endpoints | With EDR/AV products under evaluation |

## Key Concepts

### Detection Categories

| Category | Description | Score |
|---|---|---|
| None | No evidence of detection | 0 |
| Telemetry | Raw event data available but no processing | 1 |
| General | Alert or enrichment without ATT&CK context | 2 |
| Tactic | Detection identifies the ATT&CK tactic | 3 |
| Technique | Detection identifies the specific ATT&CK technique | 4 |

### Protection Categories

| Category | Description |
|---|---|
| None | Attack succeeded without interference |
| Blocked | Attack was prevented from executing |
| Delayed | Attack was blocked after partial execution |

### Evaluation Methodology

```
1. Select threat actor (APT29, APT3, Carbanak+FIN7, Wizard Spider, etc.)
2. Build emulation plan from CTI (ordered technique chain)
3. Deploy security product on target endpoints
4. Execute emulation plan step by step
5. For each step: classify detection (None → Technique)
6. Record protection events
7. Calculate aggregate scores
8. Generate comparative report
```

## Workflow

### 1. Build Emulation Plan

```bash
# Create evaluation plan from threat actor profile
node scripts/agent.js create-plan \
  --threat-actor APT29 \
  --phases "initial-access,execution,persistence,credential-access,lateral-movement" \
  --output eval-plan.json
```

### 2. Execute Evaluation Steps

```bash
# Execute a single evaluation step
node scripts/agent.js execute-step \
  --plan eval-plan.json \
  --step 1 \
  --technique T1566.001 \
  --description "Spearphishing attachment delivered via email"

# Record detection result
node scripts/agent.js record-result \
  --plan eval-plan.json \
  --step 1 \
  --detection-category technique \
  --protection none \
  --product "CrowdStrike Falcon" \
  --evidence "Alert: T1566.001 Spearphishing detected, severity High"
```

### 3. Score Products

```bash
# Calculate scores for a product
node scripts/agent.js score-product \
  --plan eval-plan.json \
  --product "CrowdStrike Falcon"

# Compare multiple products
node scripts/agent.js compare \
  --plans eval-plan-crowdstrike.json,eval-plan-sentinelone.json,eval-plan-mde.json \
  --output comparison.json
```

### 4. Generate Report

```bash
# Generate evaluation report
node scripts/agent.js generate-report \
  --plan eval-plan.json \
  --output eval-report.json

# Export as Navigator layer
node scripts/agent.js export-layer \
  --plan eval-plan.json \
  --product "CrowdStrike Falcon" \
  --output eval-layer.json
```

## Detection

```yaml
title: Mitre Attack Evaluation Detection
id: c74c7869-b476-4b0d-9eb3-f5d65e67d3f8
status: experimental
description: Detects suspicious activity related to performing mitre attack evaluation techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*mitre*"
  condition: selection
level: medium
tags:
  - attack.t1566.001
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| Plan covers all phases | Each tactic has at least 2 techniques |
| All steps executed | Plan shows 100% execution completion |
| Results categorized | Every step has detection category assigned |
| Scores calculated | Product scores computed across all dimensions |
| Navigator layer valid | Layer imports into ATT&CK Navigator |

## References

- [MITRE ATT&CK Evaluations](https://attackevals.mitre-engenuity.org/)
- [ATT&CK Evaluations Methodology](https://attackevals.mitre-engenuity.org/methodology)
- [Center for Threat-Informed Defense](https://ctid.mitre-engenuity.org/)
