« Red Team Engineer

Phase 01 — Red Team Methodology & Adversary Emulation

Operation Cedar Lattice, Phase 01. Phase 00 gave you the authorization boundary, the Rules of Engagement, and the OPSEC plan for the engagement against Meridian Freight International. Now the work begins: Mandiant has been contracted to emulate FIN-LATTICE, a fictional financially-motivated intrusion set, end to end. This phase is the bridge from intelligence to plan — you take the CTI on FIN-LATTICE and turn it into an ATT&CK-mapped adversary-emulation plan, and you learn to read any intrusion through the three lenses every red teamer, threat hunter, and detection engineer shares.

The deliverable a real engagement produces here is not "we got domain admin." It is a narrative of the kill chain, mapped to MITRE ATT&CK, with every detection opportunity, and a plan to test them — the artifact the rest of Operation Cedar Lattice executes and the purple team replays.

Safety. Authorized-lab only. Every lab in this phase is an analyzer / planner / graph-solver / detection-mapper over synthetic metadata. There are no payloads, no live targets, no weaponization. Every offensive concept ends in its detection / break-the-chain control. This is the same boundary as the security track's offensive-methodology-mastery/.

Why this phase exists

The other phases teach attacker techniques locally — a privilege escalation here, a Kerberoast there. What is missing without this phase is the connective tissue: how an actor chains techniques into a campaign, and the mental models that let a defender detect the chain early and break it. You cannot emulate, hunt, or defend an adversary you cannot model end to end.

Adversary emulation is also what distinguishes a Mandiant red team from a generic pentest. A pentest asks "what can be exploited here?" Adversary emulation asks "would this organization detect and stop this specific actor, and where exactly does it fail?" — and answers it by reproducing that actor's tradecraft under contract, driven by threat intelligence, scored against the client's detections. That is threat-informed defense.

Learning Objectives

By the end of this phase you can, without notes:

1. Walk the attacker lifecycle end to end (reconnaissance → resource development → initial access → execution → persistence → privilege escalation → defense evasion → credential access → discovery → lateral movement → collection → command-and-control → exfiltration → impact) and name, for each stage, the goal, common techniques, the telemetry it emits, and the break-the-chain control.
2. Use the three lenses correctly and know when each helps: the Cyber Kill Chain (linear campaign phases — "how far along?"), the Diamond Model (adversary / capability / infrastructure / victim, and pivoting — "what else is connected?"), and MITRE ATT&CK (the tactic → technique → procedure matrix — "what behavior, and can we detect it?").
3. Place a behavior in the Mandiant Attack Lifecycle and explain how it relates to the Lockheed kill chain and to ATT&CK.
4. Turn CTI on a named actor into an ordered, ATT&CK-mapped emulation plan with procedures, the telemetry each step emits, a detection idea, success criteria, and stop conditions.
5. Read ATT&CK at every level — tactics, techniques, sub-techniques, procedures — and use the Navigator to express coverage and gaps.
6. Explain the Pyramid of Pain and use it to choose which detections cost the adversary most.
7. Distinguish adversary emulation vs simulation vs penetration test vs vulnerability scan, and run a purple-team replay that converts a detection gap into a durable detection.

The three lenses (read the WARMUP for depth)

CYBER KILL CHAIN   linear campaign phases        "how far along is this intrusion?"   → break early
DIAMOND MODEL      adversary / capability /        "what else is connected to this?"   → pivot & attribute
                   infrastructure / victim
MITRE ATT&CK       tactic → technique → procedure  "what behavior, can we detect it?"  → coverage / gaps

They are complementary, not competing. The kill chain orders an intrusion in time; ATT&CK names the behavior at each point and ties it to detection; the Diamond Model links separate events into one campaign and drives attribution. A red teamer uses all three on every engagement.

Concepts

Labs

Each lab follows LAB-STANDARD.md: lab.py (TODOs), a complete solution.py, adversarial test_lab.py, README.md, requirements.txt — pure Python (stdlib + pytest), offline, deterministic, with the detection pairing built in.

cd lab-01-emulation-plan-builder
LAB_MODULE=solution pytest -q   # reference passes (14 tests)
pytest -q                        # your implementation after the TODOs

cd ../lab-02-killchain-campaign-reconstructor
LAB_MODULE=solution pytest -q   # reference passes (16 tests)

Deliverables

• A CTI-to-emulation-plan builder that orders an actor's observed ATT&CK techniques along the lifecycle, attaches a procedure + the telemetry each emits + a detection idea + success criteria, and reports per-tactic coverage and the gaps an emulation of that single actor would leave untested.
• A campaign reconstructor that orders scattered events along the lifecycle, reports how far an intrusion got and the earliest break point with its control, and a Diamond-Model pivot that links events sharing infrastructure or capability into one campaign.
• A FIN-LATTICE emulation plan (the Operation Cedar Lattice Phase 01 artifact) and an ATT&CK Navigator layer of its coverage.
• The fluency to explain the lifecycle and the three frameworks in an interview and scope a safe emulation engagement (scope, technique selection, stop conditions, the purple-team loop).

Readings (primary sources)

• MITRE ATT&CK matrix + the ATT&CK Navigator; the Center for Threat-Informed Defense (CTID) Adversary Emulation Plans library and Atomic Red Team.
• Hutchins, Cloppert, Amin — Intelligence-Driven Computer Network Defense (the Lockheed Martin Cyber Kill Chain paper).
• Caltagirone, Pendergast, Betz — The Diamond Model of Intrusion Analysis.
• Mandiant M-Trends reports and the Mandiant Attack Lifecycle.
• David Bianco — The Pyramid of Pain.
• Red Team Development and Operations — Vest & Tubberville. MITRE D3FEND for the defensive mapping.

Common Mistakes

• Treating a CTI technique list as a plan. A list is not ordered, not procedural, and not paired with detection. The plan is the work (Lab 01).
• Confusing the three lenses or treating them as rivals. They answer different questions and are used together.
• Mapping a behavior to a tactic but never to its telemetry or detection. ATT&CK without the data source / detection is half the value — and fails this track's detection-pairing bar.
• Calling a pentest an emulation. Emulation reproduces a named actor's tradecraft, driven by intel, scored against detections. A pentest hunts whatever is exploitable.
• Chasing the bottom of the Pyramid of Pain. Blocking a hash or IP costs the adversary minutes; detecting a TTP costs them a redesign. Aim at the tip.
• Defending right. Building the impact-stage detection while ignoring the cheap initial-access break point ("defend left").
• Skipping the purple-team loop. An emulation that does not turn a gap into a durable detection delivered no lasting value.

Interview Questions

1. Explain the Cyber Kill Chain, MITRE ATT&CK, and the Diamond Model — what question does each answer, and how do you use them together on one engagement?
2. Walk me from CTI on a named actor to a runnable emulation plan. What is in each step?
3. What is the difference between adversary emulation, adversary simulation, a penetration test, and a vulnerability scan?
4. What is the Pyramid of Pain and how does it change which detections you prioritize?
5. A SOC hands you 200 scattered alerts from one night. How do you reconstruct the campaign, decide how far the actor got, and choose where to break the chain?
6. What is threat-informed defense, and how does a purple-team replay produce a durable detection?
7. How does the Mandiant Attack Lifecycle differ from the Lockheed kill chain, and why does the "loop" matter?

(Full principal-level answers are in WARMUP.md.)

Portfolio artifact

The FIN-LATTICE adversary-emulation plan for Operation Cedar Lattice: the ordered, ATT&CK-mapped plan (Lab 01 output) with procedures, telemetry, detection ideas, success criteria, and stop conditions; an ATT&CK Navigator layer of its coverage and gaps; and a one-page campaign- reconstruction narrative (Lab 02 output) showing the kill chain, the earliest break point, and a Diamond pivot — all over synthetic metadata, no real targets, no weaponization. This is 01-emulation- plans/ in the capstone portfolio.

Guides

• WARMUP.md — the from-zero, stage-by-stage deep dive on the lifecycle, the three frameworks, ATT&CK at every level, the Pyramid of Pain, the CTI→plan workflow, and purple teaming.
• HITCHHIKERS-GUIDE.md — how to build and run an adversary-emulation plan on the owned range: pick the actor, select techniques, define procedures + success criteria + stop conditions, run Atomic-Red-Team-style tests, observe telemetry, score coverage, replay as purple team.