Adversary Emulation: How I Stopped Being Polite and Got Real Results
summary
Red Canary shows defenders and testers behave differently from real intruders: the platform ingests 658–685 PB/day and records about 40,000 confirmed threats in 2022, with roughly 40% testing detections (likely closer to 50%). Testers favor noisy discovery commands and vendor-safe tools, while real adversaries use stealthy process injection, renamed system utilities and commodity malware; teams use Atomic Red Team for repeatable checks but note accuracy vs. speed/cost tradeoffs.
AI-written summary · about
chapters (21)
- 0:00RSAConference 2023
- 3:03First: why (and what) do we test?
- 4:47Next: how do we test?
- 6:18Methodologies
- 7:58Obligatory infosec slide
- 8:54Red Team Goal
- 11:26The testing trajectory
- 13:46Pyramid Climb
- 14:18A Maze
- 14:44The goal: the center of the maze
- 16:06Building out "adversary" testing
- 19:51Accurate threat information
- 22:09Another tortured analogy
- 25:11Test techniques vs. adversary techniques
- 26:12Discovery techniques are...
- 27:07Process injection is...
- 29:03Renaming system utilities is...
- 30:27Test threats vs. adversary threats
- 30:57Same techniques; different tools
- 32:22What the analysts say
- 37:22Takeaways (aka the Apply Slide)
related talks
53mAtomic Red Team: Where Adversary Emulation and EDR Testing Meet
36mCyber Werewolves: Emulating the Enemy Before the Full Moon Rises
53mIncreasing Security ROI with Adversary Simulation and Purple Teaming
40mFantastic Red-Team Attacks and How to Find Them
40mAdversary Simulation: Close the Gaps in Your Security Posture
35mBreaking Boundaries with Adversarial Testing
36mBeing A Better Defender By Channeling Your Worst Adversary:
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful