adversary-emulation

name	adversary-emulation
description	Threat-informed adversary emulation — pick a real APT, load its profile, and reproduce its TTPs within RoE scope to test detection & response. Index of available actor profiles + the emulation methodology.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"adversary emulation, emulate APT, threat actor, threat-informed, mimic adversary, APT29 APT28 APT33 APT34 APT41 Lazarus FIN7 Sandworm Volt Typhoon Scattered Spider Salt Typhoon Turla MuddyWater APT36 APT37 Mustang Panda Dark Caracal Patchwork Pink Sandstorm APT10 Kimsuky SideWinder, purple team, ATT&CK evaluation, TTP replay","tags":"adversary-emulation, threat-intel, mitre-attack, apt, purple-team, ttp, threat-informed","mitre_attack":"T1566, T1078, T1059, T1071, T1021, T1486"}

Adversary Emulation — index & methodology

Adversary emulation reproduces a specific, named threat actor's tactics, techniques and procedures (TTPs) — drawn from real, attributed intelligence — to test whether the target's people, process, and tooling detect and respond the way they should. It is distinct from generic penetration testing (opportunistic) and from simulation (abstract/random): emulation is threat-informed — every action traces to something a real group has been documented doing, mapped to MITRE ATT&CK.

Authorized use only. Emulate an actor's TTPs only within the engagement's Rules of Engagement and approved scope. Destructive techniques (Impact tactic: ransomware, wipers, ICS manipulation) are emulated as non-destructive proofs (e.g., a benign canary file, a dry-run) unless the RoE explicitly authorizes otherwise. The goal is to measure detection, not to cause damage.

When to use this

• The operator (or roe.json threat profile) names a specific actor to emulate, or names a sector/region whose dominant threat is a known group.
• A purple-team / ATT&CK-evaluation engagement: run an actor's TTP chain while the blue cell measures detection (see kill-chain-analysis and the blue_cell).
• You want a realistic, defensible attack plan instead of an ad-hoc one.

Methodology (5 steps)

1. Select the actor. Map the engagement's industry/region/crown-jewels to a relevant group (see the catalog below). When unsure, ask the operator via ask_user_question. Record the choice in the OPPLAN.
2. Load the profile. load_skill <slug> (e.g. load_skill apt29-cozy-bear). Each profile carries attribution, targeting, dated campaigns, the actor's TTPs mapped to ATT&CK technique IDs, signature tooling, emulation guidance (how to reproduce each TTP with Decepticon's own tools), and detection notes.
3. Scope to RoE. Intersect the actor's TTPs with the approved scope. Drop or down-scope anything out of bounds (e.g., replace a real wiper with a canary). Forbidden-destination / out-of-scope checks still apply at tool-call time.
4. Emulate in kill-chain order. Walk Initial Access → Execution → Persistence → Priv-Esc → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → C2 → Exfiltration → (proof-of) Impact, using only the techniques this actor is known for. Cite the ATT&CK ID in each finding.
5. Measure & report. Record which actions the blue cell detected/blocked vs. missed (kill-chain-analysis, MTTD), and produce a threat-informed report that ties each result to the emulated actor + ATT&CK technique. Feeds the final report.

This complements soundwave/threat-profile (which picks the actor at planning time) and kill-chain-analysis (which scores detection across the chain).

Actor catalog

Profile (load_skill <slug>)	Aliases	Attribution	Motivation	Notable for
apt29-cozy-bear	Midnight Blizzard, NOBELIUM, The Dukes	Russia (SVR)	Espionage	Stealthy cloud/identity intrusions; SolarWinds supply chain
apt28-fancy-bear	Forest Blizzard, Sofacy, STRONTIUM	Russia (GRU)	Espionage / influence	Credential phishing, election & defense targeting
apt33-elfin	Peach Sandstorm, HOLMIUM	Iran	Espionage (destructive links)	Aerospace & energy, Gulf-region targeting
apt34-oilrig	Helix Kitten, Hazel Sandstorm	Iran	Espionage	DNS-tunneling C2, Middle-East supply-chain access
apt41-double-dragon	Wicked Panda, BARIUM	China	Espionage and financial	Software supply-chain compromise; dual-use ops
lazarus-group	Hidden Cobra, Diamond Sleet	North Korea	Financial + destructive	Bank/crypto heists, WannaCry, supply chain
fin7-carbanak	Carbon Spider, Sangria Tempest	Financially motivated	Financial	POS/retail intrusions, Carbanak, ransomware affiliate
sandworm-team	Voodoo Bear, Seashell Blizzard	Russia (GRU)	Destructive / disruptive	NotPetya, Ukraine power-grid attacks, ICS
volt-typhoon	Vanguard Panda, Insidious Taurus	China	Pre-positioning	Living-off-the-land in US critical infrastructure
scattered-spider	UNC3944, Octo Tempest, Muddled Libra	Financially motivated	Financial / extortion	Help-desk social engineering, SIM-swap, MFA fatigue
salt-typhoon	Earth Estries, GhostEmperor, FamousSparrow	China	Espionage / pre-positioning	Edge-device exploitation, telecom targeting, DEMODEX rootkit

Profiles are grounded in MITRE ATT&CK group pages + public advisories; each lists its sources. ATT&CK technique IDs are the source of truth — verify against https://attack.mitre.org/groups/ if intel looks stale.