Cyber Werewolves: Emulating the Enemy Before the Full Moon Rises
summary
Claim: emulating live adversaries using open sources catches the “werewolf” behavior that generic advice misses. Steps shown: pull a live hash from VirusTotal or malware bazaar, inspect HTTP DNS and sandbox traces in any.run, map the TTPs with MITRE ATT&CK mapping, pick an Atomic test from Atomic Red Team or CALDERA, run it in a safe VM and verify the scheduled task or PowerShell RAT behavior appears. A cited study shows the informed minority wins, and several micro and full emulation plans and cadences (monthly micro, quarterly or biannual full) are published and usable.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 3:17Threat actor emulation basics
- 7:35Frameworks and intel
- 10:50Emulation vs simulation vs red teaming
- 12:16Threat emulation tools
- 16:56Live threats with MITRE ATT&CK
- 19:48Atomic Red Team demo
- 22:22Diversity in cybersecurity
- 24:29Breaking security silos
- 26:15Emulate threats at home
- 28:09MITRE emulation plans walkthrough
- 32:15Q&A
related talks
43mBecoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations
50mAdversary Emulation: How I Stopped Being Polite and Got Real Results
36mBeing A Better Defender By Channeling Your Worst Adversary:
32mHey Attacker! I Can See You!
40mAdversary Simulation: Close the Gaps in Your Security Posture
26mWhen Models Write Malware: Defending Against On-demand Exploits
42mKeynote: The Expanding Universe of Cyber Threats
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity