Lab 01 — CTI-to-Emulation-Plan Builder

Lenses: MITRE ATT&CK (tactics → techniques → procedures) + threat-informed defense. WARMUP: Chapters 3–6, 9, 11. Engagement tie-in: this is the Phase 01 deliverable for Operation Cedar Lattice — turning CTI on FIN-LATTICE into the ATT&CK-mapped emulation plan the rest of the engagement executes.

The problem

Adversary emulation does not start with a tool — it starts with threat intelligence. A CTI analyst gives the red team a flat, unordered fact: "FIN-LATTICE has been observed using techniques T1566, T1059, T1003, T1021, T1071, T1486." That list is not a plan. A plan is ordered along the attacker lifecycle, grouped by ATT&CK tactic, and — the part that separates a red team from a pentest — detection-paired: every step ships the telemetry the behavior emits and the detection that should fire on it, plus an explicit success criterion. That is what makes the artifact a purple-team plan the client keeps, not a throwaway attack script.

This lab turns the CTI profile into that plan and answers two analyst questions ATT&CK Navigator is built to answer: which tactics does this actor exercise (coverage)? and which tactics would we NOT test if we only emulate this actor (gaps)?

What you build (lab.py)

  • classify(tid) — {technique, name, tactic, order, procedure, telemetry, detection} for any technique id (unknown ids degrade to a documented unknown record, never crash).
  • detection_for(tid) — the break-the-chain / purple-team detection idea for a step.
  • build_plan(actor_tids) — the ordered, de-duplicated, numbered emulation plan. Each step carries the procedure stub, the telemetry/data-source it emits, the detection idea, and a success criterion. Ordering is (lifecycle order, technique id) so the plan reads top-to-bottom as one campaign and is deterministic.
  • tactics_covered(actor_tids) — distinct tactics the actor exercises, in lifecycle order.
  • coverage_summary(actor_tids) — techniques-per-tactic ({tactic: count}) — the Navigator coverage view.
  • coverage_gaps(actor_tids, all_tactics) — the lifecycle tactics the actor does not exercise — the threat-informed-defense "what would we miss?" question.

ATT&CK mapping

The corpus is a representative slice of ATT&CK Enterprise, one technique per cell of the lifecycle (reconnaissance → … → impact). Each row carries its ATT&CK tactic, a procedure stub (what the operator runs against the owned range), the ATT&CK data source / telemetry the behavior emits, and a detection idea. FIN-LATTICE's profile (T1566 → T1059 → T1003 → T1021 → T1071 → T1486) is a canonical financially-motivated chain: phish in, execute, dump creds, move laterally, beacon out, ransom.

Attack cases the tests cover

  • An actor profile given out of lifecycle order is reconstructed into an ordered, numbered plan (initial-access → execution → credential-access → lateral-movement → C2 → impact).
  • Every step ships a procedure, telemetry, a detection, and a success criterion (the detection pairing the standard requires).
  • coverage_summary counts techniques per tactic and preserves lifecycle order.
  • coverage_gaps returns the uncovered tactics in order, and respects a custom tactic sub-frame.
  • Unknown techniques are handled (sorted last, flagged as a detection gap) and never crash the plan; duplicates are de-duplicated; empty input yields an empty plan with all tactics as gaps.
  • Output is deterministic and independent of input order.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q   # reference passes (14 tests)
pytest -q                        # your implementation after the TODOs

Hardening / detection (the purple-team pairing)

This lab is the detection-pairing exercise: the plan's value to the client is the column that says, for each emulated behavior, what telemetry it emits and what detection should fire. On the range (see HITCHHIKERS-GUIDE.md) you run each step, observe whether the data source actually produced the event, and whether the detection fired — turning the plan into a detection-coverage scorecard.

Extensions (your own isolated range)

  • Load the real ATT&CK STIX bundle (full technique → tactic mapping, multi-tactic techniques, sub-techniques) instead of the slice.
  • Emit an ATT&CK Navigator layer (JSON) coloring covered techniques by tactic — the standard hand-off artifact.
  • Join each technique to Atomic Red Team test ids so the plan is directly runnable on the range.
  • Score the plan against a SOC data-source inventory: a technique whose data source is not being collected is a visibility gap, distinct from a detection gap.
  • Rank steps by Pyramid of Pain level so the plan exercises the controls that cost the actor most.

Interview / resume

"Built a CTI-to-emulation-plan builder that turns a named actor's observed ATT&CK techniques into an ordered, lifecycle-sequenced engagement plan — each step paired with the telemetry it emits, a detection idea, and a success criterion — and computes per-tactic coverage and the threat-informed gaps an emulation of that single actor would leave untested."

Limitations: a representative technique slice, not the full ATT&CK matrix; single-tactic per technique (real techniques can map to several); no sub-technique granularity; lifecycle order approximated by ATT&CK Enterprise tactic order; procedures are stubs over synthetic metadata — there are no payloads, no live targets, and no weaponization here.