Becoming a Dark Knight - Adversary Emulation Demonstration for ATT&CK Evaluations

Overview

Explore adversary emulation for cybersecurity, learning how to study advanced threats, develop scenarios, and execute operations to improve industry defenses through MITRE ATT&CK Evaluations.

Syllabus

• Introduction to Adversary Emulation
Definition and importance in cybersecurity
Overview of MITRE ATT&CK Framework
Key objectives and outcomes of adversary emulation
• Understanding Advanced Threats
Types of advanced threats and APTs (Advanced Persistent Threats)
Case studies and historical analyses
Identifying threat actors and their techniques
• The MITRE ATT&CK Framework in Detail
Structure and components of ATT&CK
Use cases for ATT&CK in adversary emulation
Mapping adversary behavior to ATT&CK tactics and techniques
• Developing Emulation Scenarios
Creating realistic threat scenarios
Selection of tools and techniques for scenario development
Risk assessment and prioritizing threats
• Planning and Execution of Emulation Operations
Building an emulation plan
Execution of operations within a controlled environment
Use of red teaming tools and platforms
• Measuring and Improving Defenses
Monitoring and detection during emulation activities
Reporting findings from ATT&CK Evaluations
Incorporating results into security strategy and posture
• Legal and Ethical Considerations
Guidelines for ethical operation of adversary emulations
Compliance with legal frameworks and organizational policies
• Hands-on Labs and Simulations
Practical exercises with threat emulation tools
Simulated attack scenarios and defenses testing
Collaborative projects to develop custom emulation scenarios
• Review and Continuous Learning
Evaluating the effectiveness of emulation activities
Resources for staying updated with emerging threats and techniques
Building a community of practice around adversary emulation
• Conclusion and Future Directions
Summary of key learnings
Future of adversary emulation in cybersecurity
Career opportunities and path forward in threat intelligence and emulation

Subjects

Conference Talks