Resources

Adversary Emulation Planning

A practitioner's guide to building threat-realistic test scenarios using the MITRE ATT&CK framework — from threat profiling through detection gap analysis.

Foundations

What makes adversary emulation different.

A penetration test answers: what can I exploit? An adversary emulation plan answers: if Threat Group X came after this organization today, what would they do, how far would they get, and would anyone know?

The distinction matters because the deliverable is different. Penetration tests produce vulnerability lists. Adversary emulation produces a behavioral map — which detections fired, which didn't, what the dwell time would have been, and where the kill chain could have been cut.

The MITRE ATT&CK framework provides the common language. Each technique in an emulation plan maps to a specific ATT&CK ID, enabling direct comparison between what was executed and what was detected.

An adversary emulation plan is not a script for finding vulnerabilities. It is a structured replication of threat actor behavior designed to test your detection and response capability against a named adversary.

Phase 01

Threat profiling and TTP selection.

Effective emulation starts with a credible threat. We identify which adversaries are realistically motivated to target the organization — based on industry sector, geography, size, and publicly known targeting patterns — then build the emulation around their documented behavior.

Sources include ATT&CK Group profiles, government advisories (CISA, NSA, NCSC), threat intelligence vendor reporting, and incident data from comparable organizations. Each TTP selected for the emulation plan maps to at least one corroborating source.

For organizations without a specific named threat, we build composite profiles around the most relevant threat categories: financially-motivated ransomware operators, nation-state initial access brokers, or supply chain compromise actors.

Sample Emulation Plan

Ransomware operator TTP chain.

A representative technique sequence for a financially-motivated ransomware operator. Each technique links to its MITRE ATT&CK entry.

Initial Access
T1566.001
Spearphishing AttachmentLure document delivered via targeted email. Macro-enabled Office file or PDF with embedded link to staged payload targeting a specific individual or role.
Execution
T1059.001
PowerShellEncoded PowerShell command executed from document macro. Downloads and executes second-stage loader from attacker-controlled infrastructure.
Persistence
T1547.001
Registry Run KeysPersistence established via HKCU Run key. Survives user logoff and system restart without requiring elevated privileges.
Credential Access
T1003.001
LSASS MemoryCredential material extracted from LSASS process memory. Yields plaintext passwords or NTLM hashes for domain accounts used in lateral movement.
Lateral Movement
T1550.002
Pass the HashHarvested NTLM hashes used to authenticate to additional hosts without plaintext credential requirements. Enables rapid spread across Windows environments.
Privilege Escalation
T1078.002
Valid Accounts: Domain AccountsDomain administrator credentials obtained via lateral movement. Enables access to backup infrastructure and domain controllers — prerequisite for maximum-impact ransomware deployment.
Impact
T1490
Inhibit System RecoveryVolume shadow copies deleted, backup agents disabled, recovery partitions targeted. Eliminates self-recovery options before encryption deployment.
Impact
T1486
Data Encrypted for ImpactRansomware payload deployed across domain-joined hosts via domain admin account. Targets file servers, database hosts, and hypervisor infrastructure.

Sample Emulation Plan

Assumed breach technique sequence.

An assumed breach exercise starts with the attacker already inside. This sequence tests detection and response capability from an established foothold with standard user access.

Starting Condition
T1078.003
Valid Accounts: Local AccountsSimulated foothold: standard domain user on a workstation. No elevated privileges. Represents a credential phish or initial access broker handoff.
Discovery
T1069.002
Domain Group EnumerationDomain groups queried to identify high-value targets: IT admins, service account owners, security team members. Informs targeting decisions for lateral movement.
Discovery
T1018
Remote System DiscoveryNetwork reconnaissance to identify active hosts, exposed services, and administrative infrastructure. Passive and active enumeration techniques combined.
Privilege Escalation
T1548.002
Bypass UACUser Account Control bypassed via documented technique (e.g., fodhelper, eventvwr). Achieves high-integrity process context without a credential prompt.
Defense Evasion
T1055
Process InjectionPayload injected into a trusted process to evade process-based detection controls. Tests EDR coverage and behavioral detection logic.
Credential Access
T1003.006
DCSyncDomain Controller synchronization request used to extract credential hashes for all domain accounts without requiring physical access to the DC.
Lateral Movement
T1021.006
Windows Remote ManagementWinRM used for lateral movement to high-value targets using obtained credentials. Tests detection of legitimate remote management protocol misuse.
Collection
T1074.002
Remote Data StagingSensitive data identified and staged in a temporary directory for simulated exfiltration. Tests DLP controls, file access monitoring, and data classification coverage.

Phase 04

Detection gap analysis and purple team follow-up.

Execution without analysis is just a demonstration. The value of adversary emulation is in the structured comparison between what was done and what was detected — mapped to ATT&CK technique IDs so findings are unambiguous.

For each technique executed, we record: whether an alert fired, whether a human investigated, how long elapsed before a response action was taken, and whether the response would have been effective against a real adversary.

The output isn't a vulnerability list — it's a detection coverage map. Your security team walks away knowing exactly which ATT&CK techniques they can detect, which have partial coverage, and which are genuine blind spots.

Purple team follow-up closes the loop. For each gap, we work with your detection engineering team to develop and validate the specific detection logic — tuned to your logging infrastructure, not generic SIEM content copied from the internet.

More Guides

Related reading.

How to Scope an Assumed Breach Engagement Starting conditions, objectives, rules of engagement, and what good deliverables look like. Read the guide → What Ransomware Negotiation Actually Looks Like The first 24 hours, whether to pay, how negotiation works, and what to tell the board. Read the guide → Case Studies Anonymized outcomes from adversary simulation, incident response, and executive advisory engagements. Read the cases →

Work With Us

Ready to test your detection capability?

We run a small number of adversary emulation engagements per year. If you want to understand what a motivated threat actor would actually find in your environment — and whether your security program would catch them — tell us about your situation.

Tell Us About Your Situation →