Adversary Emulation with MITRE ATT&CK

All Indian Reprints of O'Reilly are printed in Grayscale

By incorporating cyber threat intelligence, adversary emulation provides a form of cybersecurity assessment that mimics advanced persistent threat (APT) tactics, techniques, and procedures (TTPs). This comprehensive guide introduces an empirical approach with strategies and processes collected over a decade of experience in the cybersecurity field. You'll learn to assess resilience against coordinated and stealthy threat actors capable of harming an organization.

Author Drinor Selmanaj demonstrates adversary emulation for offensive operators and defenders using practical examples and exercises that actively model adversary behavior. Each emulation plan includes different hands-on scenarios, such as smash-and-grab or slow-and-deliberate. This book uses the MITRE ATT&CK knowledge base as a foundation to describe and categorize TTPs based on real-world observations and provides a common language that's standardized and accessible to everyone.

You'll learn how to:

• Map cyber threat intelligence to ATT&CK
• Define adversary emulation goals and objectives
• Research adversary emulation TTPs using the ATT&CK knowledge base
• Plan and conduct adversary emulation and communicate your findings
• Automate adversary emulation to support repeatable testing
• Execute FIN6, APT3, and APT29 emulation plans

About the Author

Drinor Selmanaj is a cybersecurity frontier with over a decade of paramount experience in penetration testing, cyberterrorism combat, and global privacy amidst NATO representatives, multinational corporations, tech giants, and heads of state. Moreover, he is a prolific investor in the tech scene with several cybersecurity-related companies and initiatives under his name.

At Sentry, Drinor leads a global team of cybersecurity researchers while providing cutting-edge penetration testing and other cybersecurity services to unicorn corporations, including some of the Big Four.

Likewise, Selmanaj is well-known for his efforts in security education, having trained thousands of students while continuously responding to the chronic cybersecurity talent shortage. His students are renowned professionals employed in leading application security firms and have received multiple recognitions from numerous organizations, including the U.S. Department of Defense. At Cyber Academy, he has developed state-of-the-art courses covering a variety of topics, ranging from the foundations of cybersecurity to red teaming and adversary emulations. Additionally, Drinor has developed cyber ranges equipped with the latest offensive and defensive scenarios for training the new cybersecurity workforce.

As a consultant, he has assessed vulnerabilities, opportunities, and mitigation pathways for critical information infrastructures on a national level, the finance/health sector, and electoral systems. As a result, Drinor found success in providing a clear sight of national cybersecurity while delivering a comprehensive and concrete action plan.

Drinor Selmanaj is an award-winning cybersecurity professional, lecturer, public speaker, and executive aspiring to boost innovation, all the while perpetually pursuing excellence and standing one step ahead of cyber threats.