<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-adversary-tradecraft-documentation
description: >-
  Document adversary tradecraft systematically by creating structured TTP
  playbooks, emulation plans, detection mappings, and intelligence-driven
  procedure documentation that bridges offensive operations with defensive
  detection engineering.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - tradecraft-documentation
  - ttp-playbooks
  - emulation-plans
  - detection-mapping
  - intelligence-driven
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059", "T1082", "T1083", "T1018", "T1057"]
  frameworks: ["MITRE ATT&CK", "MITRE Engenuity", "Cyber Kill Chain"]
  tools: ["python3", "attack-navigator", "sigma", "caldera"]
---

# Implementing Adversary Tradecraft Documentation

## Overview

Adversary tradecraft documentation transforms raw offensive operation data
into structured, reusable intelligence artifacts — TTP playbooks mapped to
MITRE ATT&CK, detection opportunity matrices, emulation plan templates, and
procedure-level documentation that enables purple teams to reproduce and
validate adversary behavior systematically. This skill bridges the gap between
red team execution and blue team detection engineering.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `ATT&CK Navigator` | Security tooling |
| `Sigma rule tooling` | Security tooling |
| Engagement execution logs with technique-level detail | Environment requirement |
| MITRE ATT&CK framework knowledge for accurate mapping | Environment requirement |
| Access to CTI reports for threat actor procedure documentation | Environment requirement |

## Workflow

### Step 1: Capture and Structure Tradecraft

```bash
# Import raw engagement data and normalize to structured format
node scripts/agent.js import --source engagement-log.json --format caldera

# Map procedures to MITRE ATT&CK techniques
node scripts/agent.js map-ttps --procedures procedures.json --output ttp-map.json
```

### Step 2: Generate TTP Playbooks

```bash
# Create structured playbook from mapped TTPs
node scripts/agent.js create-playbook --ttp-map ttp-map.json --actor APT29 --output playbook.json

# Generate ATT&CK Navigator layer for visualization
node scripts/agent.js navigator-layer --ttp-map ttp-map.json --output layer.json
```

### Step 3: Detection Mapping

```bash
# Map each TTP to detection data sources and analytics
node scripts/agent.js detection-map --playbook playbook.json --output detections.json

# Generate Sigma rule stubs for undocumented detections
node scripts/agent.js sigma-stubs --detection-map detections.json --output sigma-rules/
```

### Step 4: Documentation Export

```bash
# Export complete tradecraft documentation package
node scripts/agent.js export --playbook playbook.json --detections detections.json --format markdown

# Generate engagement summary report
node scripts/agent.js report --scope full --output tradecraft-report.json
```

## Detection

```yaml
title: Adversary Tradecraft Documentation Detection
id: 4d0aba59-94f8-4e6d-9f22-fbcb98e50d8e
status: experimental
description: Detects suspicious activity related to implementing adversary tradecraft documentation techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*adversary*"
  condition: selection
level: high
tags:
  - attack.t1059
  - attack.t1082
  - attack.t1083
  - attack.t1018
  - attack.t1057
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Adversary Tradecraft Documentation Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1059, T1082, T1083, T1018, T1057 |

## Verification

- [ ] All engagement procedures mapped to ATT&CK techniques
- [ ] TTP playbooks include procedure-level reproduction steps
- [ ] Detection opportunities documented for each technique
- [ ] ATT&CK Navigator layer accurately reflects coverage
- [ ] Documentation package exportable for purple team consumption

## References

- [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) — ATT&CK visualization tool
- [CTID Adversary Emulation Library](https://github.com/center-for-threat-informed-defense/adversary_emulation_library) — Emulation plan templates
