Deep Dive into Adversary Emulation: Ransomware Tradecraft & Purple Teaming
SCYTHE CTO Jorge Orchilles details how to safely emulate multi-stage human-operated ransomware campaigns to test enterprise detection and response.
Summary
The Rising Threat of Human-Operated Ransomware
Modern enterprise ransomware attacks involve multi-stage campaigns combining credential theft, lateral movement, data exfiltration, and coordinated encryption.
Designing Safe Ransomware Emulation Playbooks
Jorge Orchilles explains how to simulate destructive ransomware behaviors—including volume shadow copy deletion, service stopping, and simulated encryption—without risking data loss.
Executing End-to-End Emulation with SCYTHE
The speaker demonstrates orchestrating realistic ransomware emulation campaigns across Windows environments to validate EDR alerts and SOC response SLAs.
Closing Defensive Gaps with Collaborative Purple Teaming
The presentation provides blue teams with specific detection rules, telemetry checklists, and incident response runbooks to neutralize real-world ransomware outbreaks.
Related talks
Red Team Village·55 min
Chris Cottrell
Chris Cottrell introduces the Guerrilla Red Team methodology, empowering distributed engineering teams to act as trusted internal ethical hackers.
Red Team Village·35 min
Erdener Uyan · Gökberk Gülgün
Erdener Uyan and Gökberk Gülgün present an open-source machine learning framework for generating dynamic, automated red team attack scenarios.
Red Team Village·57 min
Adam Pennington
MITRE ATT&CK lead Adam Pennington shares strategies for crafting realistic adversary emulation plans even when threat intelligence reports are incomplete or vague.