Adversary Simulation: Close the Gaps in Your Security Posture

on YouTube ↗40m

" summary

Practical guide to building a repeatable adversary simulation program that maps specific attacker TTPs to measurable outcomes: use MITRE ATT&CK and the APT3 Excel plan to pick techniques, run tools like Caldera, Atomic Red Team and APT Simulator against a Detection Lab image, collect logs with Security Onion and Sysmon, and exercise metrics such as meantime to decision, time to compromise and time to sweep the enterprise. A low‑risk demo uses the BT3 Python agent (generated payloads produce ~31,000 events/day) and emphasizes quarterly runs, willing partners, timestamped records and root‑cause CAPs.

AI-written summary · about

" chapters (19)

1. 0:00Intro
2. 0:14Don Murdoch Intro
3. 1:02Where do you start? What is your Value Chain?
4. 3:29The Security Architecture Protects the Value Chain Think Red to find the threats, Act Blue to design and test defense
5. 5:01Historically: Organizations performed security assessment in isolation. Today we Integrate
6. 7:09Breakdown: What is Adversary Emulation
7. 8:33Adversary Simulation Needs a Plan
8. 12:45Gaining Support for Adversary Simulation
9. 17:22Generate and Observe Scenario Information Flow
10. 22:04Key Timeline Measures and Event Reconstruction
11. 23:44Prerequisites
12. 26:40Which SOC Security Service will you test?
13. 29:13Candidates for your Tool Inventory
14. 30:40Game Day: Make Sure you have Air Cover!
15. 33:29After Action Reporting with Info Exchange
16. 34:08Incident Response Report
17. 35:00Success Story: Impact Analysis Operations
18. 36:04Takeaways, Actions, and Next Steps
19. 38:08BT3 Client Side

" related talks

• 36mBeing A Better Defender By Channeling Your Worst Adversary:John Stoner · 34th Annual FIRST Conference 2022
• 53mIncreasing Security ROI with Adversary Simulation and Purple TeamingJonathan Baker, Jorge Orchilles, Abhijith B R, Daniel DeCloss · RSAC 2023
• 30mShall We Play a Game?J. Wolfgang Goerlich · BSidesSF 2019
• 48mMITRE ATT&CK: The Play at Home EditionRyan Kovar, Katie Nickels · Black Hat USA 2019
• 01h 11m2024 Security BSides // Adam PenningtonAdam Pennington · Security BSides Cayman Islands 2024
• 38mAdversary Detection Pipelines: Finally Making Your Threat Intel UsefulXena Olsen · Black Hat Asia 2020
• 52mCALDERA: Automating Adversary EmulationDouglas Miller, Andy Applebaum · Black Hat Europe 2017
• 31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting ActivityJohn Stoner · BSidesSF 2019