adversary-emulation

name	adversary-emulation
description	Threat-informed adversary emulation — pick a real APT, load its profile, and reproduce its TTPs within RoE scope to test detection & response. Index of available actor profiles + the emulation methodology.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"adversary emulation, emulate APT, threat actor, threat-informed, mimic adversary, APT29 APT28 APT33 APT34 APT41 Lazarus FIN7 Sandworm Volt Typhoon Scattered Spider Salt Typhoon Turla MuddyWater APT36 APT37 Mustang Panda Dark Caracal Patchwork Pink Sandstorm APT10 Kimsuky SideWinder, purple team, ATT&CK evaluation, TTP replay","tags":"adversary-emulation, threat-intel, mitre-attack, apt, purple-team, ttp, threat-informed","mitre_attack":"T1566, T1078, T1059, T1071, T1021, T1486"}

Adversary Emulation — index & methodology

Adversary emulation reproduces a specific, named threat actor's tactics, techniques and procedures (TTPs) — drawn from real, attributed intelligence — to test whether the target's people, process, and tooling detect and respond the way they should. It is distinct from generic penetration testing (opportunistic) and from simulation (abstract/random): emulation is threat-informed — every action traces to something a real group has been documented doing, mapped to MITRE ATT&CK.

Authorized use only. Emulate an actor's TTPs only within the engagement's Rules of Engagement and approved scope. Destructive techniques (Impact tactic: ransomware, wipers, ICS manipulation) are emulated as (e.g., a benign canary file, a dry-run) unless the RoE explicitly authorizes otherwise. The goal is to measure detection, not to cause damage.