Indicators of Emulation: Spicy Adversary Emulation & CTI Translation
Ch33r10 explains how to transform cyber threat intelligence (CTI) from static indicators of compromise into dynamic 'Indicators of Emulation' for red teams.
Summary
The Evolution of Cyber Threat Intelligence (CTI)
Historically, CTI focused on extracting static Indicators of Compromise (IOCs) for reactive blocklists and post-incident digital forensics.
Introducing Indicators of Emulation (IOEs)
Ch33r10 proposes shifting CTI consumption toward generating actionable Indicators of Emulation (IOEs) that offensive teams execute to test defenses.
Deconstructing Threat Actor Procedures and Tool Configurations
The author demonstrates extracting specific procedural behaviors, command execution patterns, and timing characteristics from raw intelligence reports.
Operationalizing Intelligence for Purple Team Exercises
The presentation illustrates how purple teams use IOEs to validate detection rules, tune SIEM alerts, and verify defensive resilience against specific adversaries.
Related talks
Red Team Village·57 min
Adam Pennington
MITRE ATT&CK lead Adam Pennington shares strategies for crafting realistic adversary emulation plans even when threat intelligence reports are incomplete or vague.
Red Team Village·55 min
Chris Cottrell
Chris Cottrell introduces the Guerrilla Red Team methodology, empowering distributed engineering teams to act as trusted internal ethical hackers.
Red Team Village·46 min
Pablo González
Pablo González presents ATTPwn, an open-source adversary emulation framework designed to automate MITRE ATT&CK techniques and validate defensive controls.