Introducing the Adversary Emulation Library

Open-source adversary emulation for purple teams. No paywalls, no vendor lock-in.

We're releasing a library of adversary emulation plans that translates real threat actor behavior into working tools for security testing.

What You Get

Per threat actor:

TTPs mapped to MITRE ATT&CK
Caldera YAML abilities
Sigma detection rules
Atomic Red Team tests
Validation tooling
Full documentation

v1.0 target: 30+ techniques across 3 threat actors

Technique selection prioritizes emulation safety, detection value, and operational realism. Not all publicly reported techniques are emulated.

Open source. Works with your existing tools.

Why This Exists

Most adversary emulation research is behind paywalls or scattered across vendor blogs. We wanted something practical that security teams could use without buying a platform or stitching together fragments.

This is what we needed when setting up purple team operations.

Coverage

Starting with three diverse threat actors:

Threat Actor	Type	Focus	Why It Matters
Lazarus Group	APT	Crypto/Finance	Financially motivated, well-documented cross-platform TTPs
APT29	APT	Gov/Tech	SolarWinds actor, cloud-native and supply chain techniques
LockBit	Ransomware	All sectors	Most active ransomware, ESXi targeting

Nation-state APTs and ransomware. Broad enough for most security teams.

Process

Research → Document → Build → Test → Release

Research public threat intel (MITRE, CISA, vendor reports)
Map TTPs to ATT&CK, document actual commands
Build Caldera abilities and detection rules
Test in lab environments
Release everything

What gets released:

threat-actor-name/
├── caldera/abilities/          # Ready to import
├── detection-rules/sigma/      # Tested rules
├── atomic-red-team/            # Test cases
├── docs/                       # Full documentation
└── iocs.json                   # Sanitized indicators

Who This Helps

Purple teams testing detections
Security engineers validating controls
Detection engineers writing rules
Researchers studying threat actors
Anyone who needs emulation without buying a platform

Philosophy

Open source. No licensing. Works with your tools. Learn the techniques, don't just run them.

Community contributions welcome.

Get Involved

Hosted on GitHub at Secure-Origin.

Ways to contribute:

Download and test the emulation plans
Submit improvements or new techniques
Contribute threat actors
Help validate detection rules
Report issues

Write-ups published as each actor completes.

What's Next

Currently researching Lazarus Group's Linux and Windows TTPs.

First release includes:

10-15 documented techniques
Working Caldera abilities
Tested Sigma rules
Complete documentation

Follow for updates.