Red › Module 3 › Lesson 2
Emulation Plan
Emulation plans sequence TTPs on $LAB_RT within RoE — methodology document, not operational attack guide for strangers.
Visual · rt_emulation_plan
Emulation plan literacy. $LAB_RT only. Original Cyberlium.
Opening
A good emulation plan fits on one page: scope, TTPs, timeline, purple contacts.
Emulation plans document campaign narrative on $LAB_RT: starting assumptions, technique sequence with ATT&CK IDs, C2 constraints, stop conditions, and purple-team check-in points. Plans align red actions with blue detection exercises — not open-ended compromise of unauthorized hosts. Cyberlium teaches plan structure without weapon cookbooks or stranger phishing steps. Next: Success Criteria.
1. Plan sections professionals expect
Executive summary, scope ($LAB_RT hosts), RoE reference, threat profile (group or custom), technique timeline, C2/lab-only constraints, communication plan, and rollback/snapshot notes.
Each technique row: ID, host role, expected artifact, detection owner, stop-if trigger.
Command guide
Try these commands — Plan sections professionals expect
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Emulation plan template — https://attack.mitre.org/resources/adversary-emulation-plans/ ATT&CK groups — https://attack.mitre.org/groups/ (pick ONE group for lab plan)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t21-rt"
python3 <<'PY'
plan = {'group': 'G0016', 'objective': 'lab purple-team exercise', 'scope': 'LAB_HOST only', 'never': 'stranger targets'}
for k, v in plan.items(): print(f'{k}: {v}')
PYCommand — copy this
curl -sS https://attack.mitre.org/groups/G0016/ | head -8
Primary tools to practice this lesson: python3, curl. Reference sites: Emulation plan template (https://attack.mitre.org/resources/adversary-emulation-plans/); ATT&CK groups (https://attack.mitre.org/groups/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Timeline and dependency realism
Sequence matters: initial access before persistence before lateral on $LAB_RT AD lab. Realistic pacing helps blue practice alert correlation — spray-everything-in-one-hour teaches little.
Forbidden: timeline steps on production, mass email phases, or ransomware deployment outside isolated $LAB_RT fixtures.
3. Plans are purple-team contracts
Share plan summary with blue lead before start — surprises erode trust. Plans attach to RoE pack and ATT&CK Navigator layer for $LAB_RT.
Ship: emulation plan outline with five technique rows for $LAB_RT. Next: Success Criteria.
4. What you ship: emulation plan outline for $LAB_RT
Outline: scope, five technique rows, timeline, purple contact. $LAB_RT only. NEVER stranger steps. chmod 600.
5. What you record before the next lesson
Date. Emulation plan outline. $LAB_RT named. File t21-m03-l02-emulation-plan.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write plan targeting classmate cloud tenant. Include phishing kit procurement steps.
Right
Write emulation plan outline for $LAB_RT. Next: Success Criteria.
Mission: draft emulation plan outline
1) Write plan sections list. 2) Add five technique rows with ATT&CK IDs for $LAB_RT. 3) Note purple contact line. 4) chmod 600. Never include stranger or mass-email phases.
Stuck? Ask Cyberlium AI Mentor
Plans blue can read beat secret operator improvisation.
Knowledge Check
APPLY: Emulation plan on Cyberlium documents:
Multiple choice
Knowledge Check
APPLY: True or False: Emulation plans should be shared with blue before $LAB_RT execution.
True or False
Knowledge Check
APPLY: Technique timeline on $LAB_RT should:
Multiple choice