Lion Cipher Lab

Build an adversary emulation plan from CTI

• Threat Intel Analyst
• Advanced
• ~2-3 hours
• Free · no account required

Why it matters

A penetration test asks 'can I get in?' and rewards creativity in any path to access. Adversary emulation asks a sharper question for a defended organization: 'if THIS specific known adversary did their specific known moves, would we notice?' The document that makes that question answerable is the emulation plan — an ordered, ATT&CK-mapped, CTI-sourced script of a named actor's behavior, with a concrete procedure and a detection idea for every step. It is the analytic bridge between a written threat report and a tool like CALDERA or Atomic Red Team that later executes it. Learning to author…

What you'll learn

• Turning cyber threat intelligence (CTI) into a threat-informed emulation plan
• Extracting reported TTPs from primary CTI and mapping each to ATT&CK technique IDs
• Sequencing techniques into an ordered plan across ATT&CK tactics / the kill chain
• Writing a concrete per-technique procedure (the command/tool the adversary is reported to use)
• Recording intelligence confidence and never inventing TTPs
• Writing a scope, rules-of-engagement, and authorization/safety section
• Producing a detection & mitigation mapping (data sources, an analytic, ATT&CK mitigations)
• Judging emulation (behavior-faithful) vs a generic penetration test
• Applying the MITRE Center for Threat-Informed Defense (CTID) methodology

Steps in this lab

1. What you're building — and why it is not a pentest or a report
2. Authorization, scope, and safety — write this section first
3. Pick a public, well-documented adversary with an existing reference
4. Extract the reported TTPs and map each to an ATT&CK ID — with confidence
5. Sequence the techniques into an ordered plan across the tactics
6. Worked mini-example: one full step (technique + procedure + detection)
7. Turn the plan into a detection & mitigation map (and a Navigator layer)
8. Assemble, self-review, and hand it to execution — when/why/do-it-better

Open the full interactive lab →