CALDERA: Automating Adversary Emulation
summary
CALDERA is an open source system that automates post‑compromise adversary emulation by encoding MITRE ATT&CK techniques as actions with preconditions and postconditions, planning chains of actions with a heuristic reward to choose the next step. Implementation: Python3 server, C# agents (“rats”), MongoDB, ~30 techniques; demo compromises four Windows hosts end‑to‑end, then auto‑cleans. Planner scales to about 15–20 hosts before planning cost rises. Code and plugins live on GitHub for community extension.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:05The False Negative Problem
- 8:43The Adversary Model
- 10:48Finite State Machine
- 11:57Design Requirements
- 13:28Example
- 17:29Emulation Chaining
- 19:59Data Model
- 21:54Syntax
- 23:10Postconditions
- 24:54Hints
- 25:59Architecture
- 27:46Live Demo
- 28:18Software Overview
- 28:35Adversary Demo
- 29:54Adversary Operation
- 34:23Edit Adversary
- 38:01Architecture Diagram
- 39:30Use Cases
- 40:39Open Source
- 41:19Tools
- 41:41Brawl
- 43:37GitHub
- 45:28Defense
related talks
40mAdversary Simulation: Close the Gaps in Your Security Posture
31mMirage: Cyber Deception Against Autonomous Cyber Attacks
36mBeing A Better Defender By Channeling Your Worst Adversary:
31mAdversary Emulation: Generating MITRE ATT&CK Technique Sequences
51mHack in your sleep
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
43mBecoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations
50mAdversary Emulation: How I Stopped Being Polite and Got Real Results