# Generating Emulation Scripts > Generating Emulation Scripts - Skill: `iimp0ster/generating-emulation-scripts` (Agent Skill) - Install (CLI): `npx skillmds@latest add iimp0ster/generating-emulation-scripts` - Raw SKILL.md: https://api.skillmd.com/api/skills/iimp0ster/generating-emulation-scripts/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: iimp0ster (https://skillmd.com/u/iimp0ster) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/iimp0ster/generating-emulation-scripts --- # Generating Emulation Scripts **Inputs:** - ATT&CK technique IDs from detection blueprint or threat intel package (e.g., T1059.001, T1003.001) - Target OS platform: Windows / Linux / macOS (or mixed) - Attack chain sequence (tactic order from threat intel or detection blueprint) - Optional: Specific Atomic test numbers or GUIDs to include or exclude - Optional: Environment constraints (no internet access, offline atomics, specific EDR platform) - Optional: Detection rule file(s) (Sigma, KQL, SPL) to map tests against **Workflow steps:** 1. **Collect and order ATT&CK technique IDs** - Gather all technique and sub-technique IDs in scope: - Pull technique IDs from the detection blueprint Metadata and Threat Context sections - Order by kill chain phase: Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Exfiltration → C2 → Impact - Flag any techniques with no current Atomic Red Team atomics coverage (requires a custom test placeholder) - Identify sub-technique variants relevant to the observed threat actor tradecraft 2. **Map techniques to Atomic test IDs** - For each ATT&CK technique, identify the best-fit Atomic tests: - Reference the Atomic Red Team atomics library: https://github.com/redcanaryco/atomic-red-team/tree/master/atomics - Prefer automated executors (PowerShell, bash, command_prompt) over manual steps - Select the test number(s) or GUID(s) that most closely match the threat actor's observed tradecraft - Note prerequisite dependencies (tools like Mimikatz, Rclone, WinRAR, ProcDump) that `-GetPrereqs` will fetch - Document rationale for each test selection in inline script comments 3. **Determine platform and executor** - Assess OS-specific test availability: - **Windows:** PowerShell 5.1+ using the `invoke-atomicredteam` module - **Linux / macOS:** PowerShell Core (`pwsh`) with `invoke-atomicredteam`, wrapped in a bash script - Cross-platform techniques: generate both Windows (`.ps1`) and Linux/macOS (`.sh`) variants - Note which atomic tests are platform-specific vs. cross-platform in script comments 4. **Sequence tests by attack phase** - Organize execution to mirror a realistic attack chain: - Group tests under phase header comments matching kill chain stages - Preserve logical dependencies (credential access before lateral movement, discovery before collection) - Insert `Start-Sleep` (Windows) or `sleep` (Linux) intervals between tests (default: 5 seconds) to allow EDR telemetry to flush - Place `-Cleanup` calls after each test or phase to restore system state 5. **Generate the Windows PowerShell emulation script** - Produce a well-commented `.ps1` file: **Script structure:** ``` [HEADER BLOCK] - Threat actor / campaign name - ATT&CK techniques covered - Atomic test IDs used - Target platform - Safety warnings (isolated test machine, admin privileges, EDR active) - Author, date, references [PREREQUISITES BLOCK] - Verify PowerShell version and admin privileges - Install invoke-atomicredteam module if missing - Install atomics folder if missing [PHASE BLOCKS — one block per kill chain tactic] For each technique in each phase: Invoke-AtomicTest -TestNumbers -GetPrereqs -PathToAtomicsFolder $AtomicsPath Invoke-AtomicTest -TestNumbers -PathToAtomicsFolder $AtomicsPath -ExecutionLogPath $LogPath Start-Sleep -Seconds $SleepBetweenTests Invoke-AtomicTest -TestNumbers -Cleanup -PathToAtomicsFolder $AtomicsPath [SUMMARY BLOCK] - Bulleted list of all tests executed with technique IDs - Prompt to review EDR / SIEM alerts - Links to Atomic test detail pages for each technique ``` 6. **Generate the Linux/macOS shell wrapper** - Produce a `.sh` file that drives the same tests via `pwsh`: - Check `pwsh` is installed; exit with install instructions if not - Install `invoke-atomicredteam` and atomics folder via `pwsh` if missing - Define a `run_atomic()` helper function to handle GetPrereqs / Execute / Sleep / Cleanup per test - Organize phases identically to the Windows script - Use `/tmp` for log output 7. **Build test-to-detection mapping table** - Document which emulation test validates which detection rule: ``` | Atomic Test | Technique ID | ATT&CK Tactic | Sigma Rule / Detection Name | Expected Alert | |----------------------|--------------|-------------------|---------------------------------|----------------| | T1059.001 - Test #1 | T1059.001 | Execution | win_powershell_encoded_cmd | High | | T1003.001 - Test #1 | T1003.001 | Credential Access | win_lsass_dump_procdump | Critical | ``` 8. **Generate pre-execution safety checklist** - Ensure safe test conditions: - [ ] Test machine is isolated from production network - [ ] EDR / AV agent is installed, active, and reporting - [ ] SIEM is ingesting endpoint logs from the test machine - [ ] Security team has been notified of the test window - [ ] Test machine OS and tooling match the production environment profile - [ ] Snapshot or backup taken of the test machine before execution - [ ] Internet access available (for prerequisite downloads) or offline atomics folder staged 9. **Generate post-execution validation checklist** - Specify what to verify in EDR/SIEM after running: - List expected process creation events per technique (parent/child chain) - List expected EDR alert names by common vendor (CrowdStrike, Defender for Endpoint, SentinelOne) - Provide a retrospective SIEM query per Sigma rule to search execution window - Calculate coverage score: (techniques that triggered detection) / (total techniques in emulation) - Document any techniques that produced no alert (feed back into Skills 1-6 as gap) **Outputs:** - Windows PowerShell emulation script (`.ps1`) with inline phase comments and safety header - Linux/macOS shell wrapper (`.sh`) calling the same atomics via `pwsh` - Test-to-detection mapping table - Pre-execution safety checklist - Post-execution SIEM/EDR validation steps - Gap list: ATT&CK techniques with no Atomic Red Team coverage requiring custom test development **Integration with the core workflow:** - **After Skills 1-6:** Run this skill to produce the emulation script for the completed detection blueprint - **After Skill 7 (Threat Intel Ingestion):** Run immediately after to generate a threat-actor-specific simulation script before the full detection is built — enables proactive coverage testing - **Feeding back to Skills 1-6:** Techniques in the emulation gap list that produce no detection become priority inputs for a new detection development cycle **References:** - Atomic Red Team atomics library: https://github.com/redcanaryco/atomic-red-team/tree/master/atomics - Invoke-AtomicRedTeam module: https://github.com/redcanaryco/invoke-atomicredteam - Invoke-AtomicRedTeam installation wiki: https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam - Reference implementation pattern (simulate-akira): https://github.com/skandler/simulate-akira - MITRE ATT&CK Enterprise Matrix: https://attack.mitre.org/matrices/enterprise/ - Atomic Red Team execution guide: https://www.atomicredteam.io/invoke-atomicredteam/docs - emulation_script_reference_windows.ps1 (this repo) — expected output format for Windows - emulation_script_reference_linux.sh (this repo) — expected output format for Linux/macOS