Emulate: Adversary Emulation Plans, Human-Led and AI-Assisted

All courses / AI Purple / Module 2 / Chapter 7

Learning objectives

After the lesson the participant can:

• Draft an emulation plan record that binds scenarios to the signed scope and names measurable abort conditions.
• Explain the four groups of people in a live exercise and what each can and cannot do.
• Compare what a person contributes to a campaign with what AI adds in planning and variation.
• Design an event log that is tagged at the source and that testers cannot rewrite.

Key concepts

Emulation plan record

The plan as code (EMU): the manifest it runs under, ordered scenarios with techniques and safety classes, expected outcomes copied from the scenarios, target scope by reference, window, abort conditions, roles, delegation profile, tag scheme and event-log store. It contains no exploit detail.

Blue team that does not know

Everyone on the defending side who is not told of the exercise, so that it measures what they would do on an ordinary day. They are measured in aggregate and never by name.

Event log

A timestamped, tamper-evident record of every action taken, written as it happens to an append-only store held by the white team. It includes any agent's actions and records the unexpected, such as side effects and stops.

Ceiling and boundary for execution

An agent executes only catalogued, benign, reversible scenarios inside the signed scope at Level 3 Bounded, and the agent that executes does not decide what to execute: a person chooses the scenario from a catalogue.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The plan asks for one scenario written by a person and shown to no assistant. What does that scenario test that a library scenario cannot?
2. The white-team lead's signature, not the red team's own approval, opens the window. What goes wrong when the red team authorises itself?
3. Nordvik Region demands the event log, the plan and the drilled stop path as contract deliverables. What would you add to a tester's contract after this lesson?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. How does the emulation plan state the targets of a campaign?

   1. As a new list of hosts chosen by the red-team lead for the window.
   2. As whatever the emulation agent discovers during the first day.
   3. As a reference to the scope in the signed manifest, never as a wider list.
   4. As a description agreed verbally with the system owners beforehand.
   Show the answer

   C. As a reference to the scope in the signed manifest, never as a wider list.
   The plan carries the target scope as a reference to the scope in the rules-of-engagement manifest and never as a wider or new list, so that the policy decision point and the white team work from one signed scope.

2. Which contribution does the chapter attribute to a person in a campaign, as distinct from AI?

   1. Judgement that depends on consequence and context.
   2. Breadth across the scenario library at low cost.
   3. Speed in drafting the plan record from the scenarios.
   4. Listing the techniques in a report that lack a scenario.
   Show the answer

   A. Judgement that depends on consequence and context.
   The chapter says a person contributes judgement that depends on consequence and context, while AI adds breadth, speed and cost. It adds that the division is not a ranking of value and that a plan needs both.

3. Where is the event log of an exercise written, according to the chapter's design rules?

   1. To the testers' own workstations, to be cleaned up after the report.
   2. To an append-only store held by the white team, which testers cannot rewrite.
   3. To the SIEM of the blue team, alongside the production detections.
   4. To the emulation agent's memory, exported when the window closes.
   Show the answer

   B. To an append-only store held by the white team, which testers cannot rewrite.
   The log goes to an append-only store held by the white team. Testers can add entries and annotations but cannot alter what is written, and an agent's action log is part of the same record.