CALDERA - Automating Adversary Emulation

Explore the CALDERA framework for automating adversary emulation in this 52-minute Black Hat conference talk. Dive into the critical aspects of adversarial network assessment, focusing on replicating realistic adversary techniques that leverage existing system functionality rather than relying solely on exploits. Learn about the false negative problem, adversary modeling using finite state machines, and design requirements for effective emulation. Discover the CALDERA architecture, data model, and syntax through live demonstrations and software overviews. Gain insights into adversary operations, editing capabilities, and practical use cases. Understand how this open-source tool can enhance network security and defense strategies by simulating sophisticated adversary behaviors.

Introduction
The False Negative Problem
The Adversary Model
Finite State Machine
Design Requirements
Example
Emulation Chaining
Data Model
Syntax
Postconditions
Hints
Architecture
Live Demo
Software Overview
Adversary Demo
Adversary Operation
Edit Adversary
Architecture Diagram
Use Cases
Open Source
Tools
Brawl
GitHub
Defense