Indicators of Emulation: Extra Spicy Adversary Emulation - Ch33r10 & haydnjohnson

Red team practitioners Ch33r10 and Haydn Johnson present Indicators of Emulation (IOE), a methodology for designing highly authentic, threat-informed adversary emulation scenarios that test blue team detection capabilities without creating artificial testing artifacts [00:00]. The speakers discuss how offensive security testing often relies on generic public scripts that generate unrealistic detection signatures rather than reflecting real-world threat actor behaviors [09:09].

The presentation demonstrates how to analyze malware execution telemetry from sandboxes like Joe Sandbox and CAPE to extract precise execution sequences, API calls, and persistence mechanisms [18:19, 27:46]. The speakers illustrate this approach using real-world adversary playbooks, showing how threat actors establish persistence using scheduled tasks triggered at logon, manipulate Windows registry Run keys, and execute defense evasion through process hollowing [27:46, 44:56].

Ch33r10 and Johnson explain how to construct purple team emulation exercises that systematically test detection engineering pipelines [27:46]. They show how to incorporate pause controls, telemetry logging, and modular staging to give defenders granular feedback on whether specific telemetry events trigger alerts in Endpoint Detection and Response (EDR) and SIEM platforms [36:09].

(AI summary — Gemini Flash)