Lion Cipher Lab
Authorized adversary emulation with MITRE Caldera
- Penetration Testing / Red Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
A penetration test asks "can I get in?" Adversary emulation asks a more useful question for a defended organisation: "if a specific known attacker did their specific known moves, would we notice?" You take documented adversary behaviour, mapped to the MITRE ATT&CK framework, and replay a scoped, safe slice of it on purpose so the blue team can test whether their logging, alerts, and detections actually fire. MITRE Caldera is the open-source platform built for exactly this. Learning to run it — and, crucially, to treat the operation report as feedback for improving defence rather than a…
What you'll learn
- adversary emulation vs. penetration testing
- MITRE ATT&CK mapping
- installing and running MITRE Caldera
- deploying a Caldera agent to a lab VM
- running a scoped, benign ability chain
- reading an operation report
- using emulation to validate detections
- authorized-use discipline
Steps in this lab
- The one rule: authorization comes before anything else
- Emulation vs. a pentest: replaying a known adversary, not hunting flags
- ATT&CK-mapped abilities: the shared language underneath Caldera
- Install Caldera on your lab server
- Deploy an agent to a target VM you own
- Run a small, benign ability chain: Discovery only
- Read the operation report and use it to validate detections
- Why the report, not the compromise, is the point