>> Welcome to Module 3,
Lesson 3, threat emulation.
In this lesson, we will explore
my personal favorite application of
attack, emulating threats,
and appreciate how threat emulation
can use known adversary behaviors,
such as those documented within attack to assess,
measure, and eventually improve our defenses.
This lesson will focus on
what we call intelligence-driven
emulation or Red Teams mimicking known threats.
This process allows us to
operationalize intelligence we discussed in Lesson 1.
Specifically, we can use CTI to scope and
prioritize what threats and
behaviors as Red Teams we evaluate.
At the end of the day, this
allows us to observe and evaluate
our defenses from the perspective that
matters that of our adversaries.
Let's look back at the detection
>> analytic from Lesson 2.
>> As you recall, this analytic is targeting,
detecting adversaries,
dumping credentials via LSASS memory.
But the question arises after
developing and deploying this analytic,
what's the next step as a defender?
Do we wait for an adversary to
trigger or potentially bypass this analytic?
We can look back at attack and compare
this analytic to documented procedures.
We can also triage new CTI,
which may pose new questions such as,
are we safe against
these unknown or previously undocumented procedures?
This is where threat-informed assessments comes in.
As you can see what the example
adversary emulation plane below.
We can use intelligence to build out
real-world adversary TTPs into Red Team scenarios.
This process allows us to
actually build out a team TTPs that
provide outputs that are more quantitative and
closely measure how we
fare against real adversary behaviors.
Here's another example of using CTI to build out
Red Team scenarios and
behaviors that we can execute for better assessments.
With that, we've reached
our knowledge check for Lesson 3.
True or false? There's a limit to
the number of different ways
a single behavior can be emulated.
Please pause the video and take a second to
think of the correct answer before proceeding.
In this case, the correct answer is false.
Similar to procedures, there is no limit to the number of
ways a single behavior can be
emulated or executed by an adversary.
With that, we've reached the end of Lesson 3.
In summary, their emulation isn't offensive assessment
making particular adversary behaviors
such as those documented within attack.
We can use threat emulation to
address the unlimited number of procedures or
variations of how adversary techniques can be
executed by adversaries or at Red Teams.
Finally, we can use this threat emulation process to
understand how our defenses
fare against specific threats and their behaviors.