How to Emulate the Threat?

There are many tools that can be used to emulate threats; some of them take the form of automated scripts to execute and others give the analyst the possibility of carry out manual emulation of the techniques; some of them are private and some of them are open source.

Among the private solution are Cobalt Strike, Cymulate, Attack-IQ, Immunity Adversary Simulation, SimSpace and many other vendors’ solutions. But in this book we are going to work mostly with three open source solutions: Atomic Red Team (https://github.com/redcanaryco/atomic-red-team), Mordor (https://github.com/hunters-forge/mordor) and Caldera (https://github.com/mitre/caldera).

Atomic Red Team

Atomic Red Team, developed by Red Canary, is an open source project to carry out scripted atomic test towards your organization’s defenses executing the same techniques as the threat actors. As an extra bonus, Atomic Red Team is mapped to the MITRE ATT&CK™ Framework and offers...