Becoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations
summary
MITRE ATT&CK Evaluations recreates a Latin‑American APT called Blind Eagle by building an AsyncRAT implant and a stripped‑down FSociety DLL to reproduce process hollowing via FSociety DLL, persistence through a user startup LNK, and credential theft from Edge; one CTI analyst plus a single developer at ~40% capacity deliver the emulation in six weeks, it succeeds in the lab C2 callbacks and credential exfiltration, and all code is released open source next week.
AI-written summary · about
chapters (13)
- 0:00Adversary emulation intro
- 5:42MITRE ATT&CK evaluations
- 8:12Blind Eagle selection
- 9:59CTI reporting details
- 14:16Emulation plan creation
- 18:09Malware dev overview
- 21:42Dev requirements breakdown
- 24:51Adversary behavior emulation
- 27:41Process hollowing details
- 32:16Persistence mechanisms
- 35:51CTI and red team collaboration
- 37:57Blind Eagle emulation execution
- 40:49Key takeaways and code
related talks
36mBeing A Better Defender By Channeling Your Worst Adversary:
36mCyber Werewolves: Emulating the Enemy Before the Full Moon Rises
40mAdversary Simulation: Close the Gaps in Your Security Posture
32mHey Attacker! I Can See You!
31mAdversary Emulation: Generating MITRE ATT&CK Technique Sequences
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
44m The Nation State Actor Ate My Homework!
50mAdversary Emulation: How I Stopped Being Polite and Got Real Results