
Practical Threat Intelligence and Data-Driven Threat Hunting
By :

Before creating our emulation plan, we need to make sure that we understand what we mean when we talk about "adversary emulation."
There is not a clear definition of the concept of adversary emulation and there have even been discussions about the words used to describe the activity (see, for example, Tim MalcomVetter's article on the subject: Emulation, Simulation & False Flags (https://medium.com/@malcomvetter/emulation-simulation-false-flags-b8f660734482).
But I prefer the definition provided by Erik Van Buggenhout in his SANS Pentest Hackfest 2019 presentation: Automated adversary emulation using Caldera (also presented at BruCON: https://www.youtube.com/watch?v=lyWJJRnTbI0), in which he defines the activity as follows:
Adversary emulation is an activity where security experts emulate how an adversary operates. The ultimate goal is to improve how resilient the organization is versus...
Change the font size
Change margin width
Change background colour