.png){kind=link}
->Adversary Emulation using MITRE ATT&CK and Red Team Tools
This project simulates real-world adversary behavior using the MITRE CALDERA automated adversary emulation platform. It demonstrates tactics and techniques mapped to the MITRE ATT&CK framework, offering hands-on experience in red teaming, persistence, privilege escalation, lateral movement, and more.
-Project Objectives
- Emulate adversaries using the MITRE ATT&CK framework
- Understand attacker Tactics, Techniques, and Procedures (TTPs)
- Gain hands-on experience with tools like CALDERA, Sandcat agents, and plugins
- Simulate real-world cyber attacks safely in a virtual lab environment
- Build a red team portfolio project suitable for LinkedIn and job applications
-Tools & Technologies
| Tool | Purpose |
|---|---|
| MITRE CALDERA | Adversary emulation platform |
| Sandcat Agent | Communication agent (GoLang) |
| Linux (Kali) | Target endpoint |
| VirtualBox/VMware | Virtual lab setup |
| MITRE ATT&CK | Adversary behavior framework |
-MITRE ATT&CK Techniques Demonstrated
| Tactic | Example Technique(s) |
|---|---|
| Initial Access | Spearphishing Simulation, Direct Execution |
| Execution | cmd, bash scripts, reverse shell commands |
| Persistence | Cron Jobs, Bash profile modification |
| Privilege Escalation | Sudo misconfig, SetUID exploitation |
| Defense Evasion | Obfuscated payloads |
| Credential Access | Shadow file exfiltration |
| Discovery | Host/network enumeration |
| Lateral Movement | SSH-based simulation |
| Command and Control | Simulated ping back to C2 server |
| Exfiltration | File exfiltration using curl/wget |
-How the Project Works
- Set up CALDERA on an Ubuntu/Kali VM
- Deploy Sandcat Agent to the target endpoint
- Create or import adversaries using ATT&CK techniques
- Run operations to simulate attack chains
- Review the results and extracted artifacts
-What I Learned
- Red team automation using CALDERA
- Deep understanding of MITRE ATT&CK framework
- How to simulate real-world attacks safely
- How to build cybersecurity projects for a public portfolio
-Environment Setup
This project was executed using the MITRE CALDERA platform in a virtual lab (Kali Linux). CALDERA was run locally, and the Sandcat agent was deployed to emulate real-world adversary behaviors. This project was executed using the MITRE CALDERA platform in a virtual lab (Kali Linux). CALDERA was run locally, and the Sandcat agent was deployed to emulate real-world adversary behaviors. https://localhost:8888