MITRE ATT&CK Adversary Emulation Plans

Adversary emulation is the practice of testing an organization’s defenses by executing the real-world tactics, techniques, and procedures (TTPs) of a specific threat actor, rather than a generic best-practices checklist. MITRE ATT&CK is the knowledge base those TTPs are mapped against, and the Center for Threat-Informed Defense (CTID) maintains the canonical open Adversary Emulation Library — full-scope plans that walk from initial access through exfiltration for a named adversary.

The plans are somewhat scattered across MITRE’s site and GitHub; direct entry points:

Entry points

Full emulation plans

AdversaryNotes
APT3The original ATT&CK-hosted emulation plan (Gothic Panda / UPS team)
APT29Cozy Bear; 2020-era tradecraft incl. SUNSPOT/SolarWinds-adjacent TTPs
FIN6Financially motivated; Magecart-style POS and e-commerce intrusion
FIN7Carbanak-adjacent financial intrusion crew
CarbanakBank-focused intrusion group (FIN7-linked tooling)
menuPassChina-nexus group targeting managed service providers and Japanese organizations

Micro emulation plans

CTID also publishes micro emulation plans — small, automatable bundles of compound adversary behaviors designed to lower the barrier to entry versus a full multi-day emulation. Useful for continuous control validation in CI-style detection pipelines.

Usage notes

  • Each full plan ships an operations flow, ATT&CK technique mappings, step-by-step procedures, and detection/cleanup guidance — they are designed to be executable by a red team (or an automated agent such as CALDERA) rather than read as prose.
  • Emulation plans are snapshots of documented adversary behavior at a point in time; pair them with current ATT&CK technique pages when a group has evolved.

Related: linux-reconnaissance-commands, windows-reconnaissance-commands (both map commands to ATT&CK Discovery techniques), psexec (T1569.002), chisel (T1572).

Sources

See also