MITRE ATT&CK Adversary Emulation Plans
Adversary emulation is the practice of testing an organization’s defenses by executing the real-world tactics, techniques, and procedures (TTPs) of a specific threat actor, rather than a generic best-practices checklist. MITRE ATT&CK is the knowledge base those TTPs are mapped against, and the Center for Threat-Informed Defense (CTID) maintains the canonical open Adversary Emulation Library — full-scope plans that walk from initial access through exfiltration for a named adversary.
The plans are somewhat scattered across MITRE’s site and GitHub; direct entry points:
Entry points
- CTID Adversary Emulation Library — the current home of all full and micro emulation plans: https://ctid.mitre.org/resources/adversary-emulation-library/ (GitHub: center-for-threat-informed-defense/adversary_emulation_library)
- MITRE ATT&CK — Adversary Emulation Plans — the original ATT&CK-hosted page, including the APT3 plan: https://attack.mitre.org/resources/adversary-emulation-plans/
Full emulation plans
| Adversary | Notes |
|---|---|
| APT3 | The original ATT&CK-hosted emulation plan (Gothic Panda / UPS team) |
| APT29 | Cozy Bear; 2020-era tradecraft incl. SUNSPOT/SolarWinds-adjacent TTPs |
| FIN6 | Financially motivated; Magecart-style POS and e-commerce intrusion |
| FIN7 | Carbanak-adjacent financial intrusion crew |
| Carbanak | Bank-focused intrusion group (FIN7-linked tooling) |
| menuPass | China-nexus group targeting managed service providers and Japanese organizations |
Micro emulation plans
CTID also publishes micro emulation plans — small, automatable bundles of compound adversary behaviors designed to lower the barrier to entry versus a full multi-day emulation. Useful for continuous control validation in CI-style detection pipelines.
Usage notes
- Each full plan ships an operations flow, ATT&CK technique mappings, step-by-step procedures, and detection/cleanup guidance — they are designed to be executable by a red team (or an automated agent such as CALDERA) rather than read as prose.
- Emulation plans are snapshots of documented adversary behavior at a point in time; pair them with current ATT&CK technique pages when a group has evolved.
Related: linux-reconnaissance-commands, windows-reconnaissance-commands (both map commands to ATT&CK Discovery techniques), psexec (T1569.002), chisel (T1572).
Sources
- Adversary Emulation Library — MITRE CTID
- MITRE ATT&CK — Adversary Emulation Plans
- GitHub — center-for-threat-informed-defense/adversary_emulation_library