Developing An Adversary Emulation Plan

Value of the Information & Strength of the Argument

The video offers high practical value for red teamers and cybersecurity professionals by outlining a repeatable process for adversary emulation planning. It emphasizes the importance of selecting threat actors based on industry and geography, and it provides concrete steps to gather and analyze CTI. The argumentation is logical and well-structured: from threat actor selection to TTP mapping and plan creation. The presenter acknowledges limitations, such as the need for sufficient CTI and the potential for deviation from the attack path. The demonstration reinforces the theoretical points, making the methodology actionable. The content is not groundbreaking but serves as a solid tutorial that consolidates best practices.

Scientific Rigor, Source Quality, Title Accuracy

The video demonstrates scientific rigor by relying on established frameworks like MITRE ATT&CK and reputable CTI sources. The sources cited in the description (APTnotes, APT & CyberCriminal Campaign Collection, ThreatTracking) are real and widely used in the cybersecurity community. The title accurately reflects the content, which is a detailed guide to developing an adversary emulation plan. The presenter does not overstate claims and clearly distinguishes between public and private CTI. The adéquation between title and content is strong, with no misleading elements.

The title accurately reflects the content: the video is a step-by-step guide to developing an adversary emulation plan, covering threat actor selection, CTI gathering, and TTP mapping.

8/10

The content is grounded in widely recognized frameworks (MITRE ATT&CK) and publicly available CTI repositories. The methodology presented is standard red team practice. No original research is claimed; the value lies in clear procedural guidance. Sources are real and verifiable.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 01:00Introduction to the adversary emulation series and overview of the video's purpose.
• 03:00Explanation of the first step: selecting a threat actor based on industry and geolocation.
• 06:00Discussion on the importance of CTI availability and private vs. public CTI.
• 09:00Using MITRE ATT&CK to find threat actors targeting specific industries.
• 12:00Example of Bronze Butler targeting Japanese organizations and mapping TTPs.
• 15:00Selecting TTPs to emulate and using the MITRE ATT&CK Navigator.
• 18:00Constructing an attack kill chain and dealing with repeated tactics.
• 21:00Converting TTPs into an emulation plan and handling deviations.
• 24:00Practical demo: searching for threat actors targeting financial sector in North America.
• 27:00Exploring CTI sources like APTnotes and APT & CyberCriminal Campaign Collection.

• APT Groups and Operations Directory — Comprehensive directory of APT groups by region, TTPs, and campaigns.
• APTnotes — GitHub repository of publicly available APT reports and papers.
• APT & CyberCriminal Campaign Collection — Collection of APT and cybercriminal campaign reports.

• MITRE ATT&CK Groups — Official MITRE page listing threat groups and their TTPs, used throughout the video.
• FireEye APT Reports — Vendor reports referenced for CTI on groups like FIN6.

• app.cyberranges.com
• apple.co
• spoti.fi