Adversary emulation

Adversary emulation can be used to assess what a real adversary would do in an environment using their tools and methodologies. The red team can use known cyber kill chains to summarize and assess the steps and procedures of an engagement, or they can, if possible, gather intelligence on and study the APT group they are emulating.

Some reuseful resources:

• Lockheed Martin Cyber Kill Chain →

• Unified Kill Chain →

• Varonis Cyber Kill Chain →

• Active Directory Attack Cycle →

• MITRE ATT&CK Framework →

Lockheed Martin Kill Chain