# Emulation Overview

> Adversary-emulation playbook catalog — per-actor kill chains that turn an APT/eCrime threat profile into Decepticon CONOPS phases + OPPLAN objectives. Routing skill: pick the actor, seed plan/threat-profile.json, then map each kill-chain phase to the operational skill the executing agent runs. Triggers on: 'emulate', 'adversary emulation', 'APT playbook', 'threat actor playbook', 'emulation plan', 'attack flow'.

- Skill: `purpleailab/emulation-overview` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/emulation-overview`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/emulation-overview/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/emulation-overview

---


# Adversary Emulation Playbook Catalog

This is a **planning** routing skill for Soundwave. Each leaf playbook below converts
a named threat actor into a concrete, RoE-bounded kill chain: a `ThreatProfile` seed, an
ordered CONOPS `kill_chain`, and a phase→technique→skill map that the orchestrator turns
into OPPLAN objectives.

> **These playbooks reference operational skills (`/skills/standard/ad/...`, `/skills/standard/cloud/...`, etc.)
> that the EXECUTING agents load — not Soundwave.** Soundwave is a planning agent; its
> `load_skill` allowlist is `/skills/standard/soundwave/`. The skill paths in each
> playbook tell the orchestrator which agent + skill each objective maps to. Soundwave
> only reads them to author `plan/threat-profile.json` and the `conops.json` kill chain.

## Playbooks

| Actor | Playbook | Tier | Profile | Skills it exercises |
|---|---|---|---|---|
| **APT29** (Cozy Bear / Midnight Blizzard) | `emulation/apt29/SKILL.md` | tier-3 | Cloud-identity espionage, OAuth abuse, supply chain | recon, cloud, web (oauth/saml), post-exploit |
| **Sandworm** (APT44 / Seashell Blizzard) | `emulation/sandworm/SKILL.md` | tier-3 | ICS/OT disruption, destructive ops, LOTL | recon, exploit/cve, ics-ot, post-exploit |
| **Scattered Spider** (UNC3944 / Octo Tempest) | `emulation/scattered-spider/SKILL.md` | tier-2 | Help-desk social engineering → cloud/SaaS → ransomware | phish, cloud, ad, post-exploit |
| **Volt Typhoon** (Vanguard Panda) | `emulation/volt-typhoon/SKILL.md` | tier-3 | Edge-device access, LOTL, long-dwell pre-positioning | recon, exploit/cve, ad, post-exploit |
| **Lazarus** (Hidden Cobra) | `emulation/lazarus/SKILL.md` | tier-3 | Financial/crypto/DeFi theft, supply-chain, social | osint, phish, contracts, web, post-exploit |
| **FIN7** (Carbon Spider / Sangria Tempest) | `emulation/fin7/SKILL.md` | tier-2 | Spearphishing → big-game-hunting ransomware | phish, ad, post-exploit, exploit |
| **LockBit / RaaS affiliate** | `emulation/lockbit/SKILL.md` | tier-2 | Generic ransomware affiliate kill chain | recon, exploit/cve, ad, post-exploit |

For the one-card quick reference (attribution, targets, full TTP table) on any actor, see
`../references/apt-groups.md`. For tier archetypes when no named actor fits, see
`../references/adversary-archetypes.md`.

## How to use a playbook (Soundwave Phase 2)

1. **Pick the actor** from the operator's intake answer (or from the industry → actor map
   in `../references/apt-groups.md`). One dominant actor per engagement.
2. **Load the leaf**: `load_skill("/skills/standard/soundwave/threat-profile/emulation/<actor>/SKILL.md")`.
3. **Copy the `ThreatProfile` seed** into `plan/threat-profile.json`, then prune any
   `key_ttps` / `initial_access` techniques the RoE forbids (Step 3 of the `threat-profile`
   skill). A pruned technique whose whole phase is now empty drops that kill-chain row.
4. **Lift the kill chain** into `conops.json` → `kill_chain` (one `KillChainPhase` per
   surviving phase), and embed the one-entry `threat_actors` summary.
5. **Carry the safety gates** from the playbook's *RoE / safety gates* section into
   `abort.json` (destructive / ICS / identity-takeover actors need at least one
   `EMERGENCY` trigger) and the deconfliction identifiers into `deconfliction.json`.
6. Hand off. The orchestrator's OPPLAN-builder reads `threat-profile.json` + `conops.json`
   and emits `add_objective` calls; each objective's executing agent loads the skill named
   in that kill-chain row.

## Playbook anatomy (every leaf has these)

- **ThreatProfile seed** — a valid `decepticon.core.schemas.ThreatProfile` JSON (drop your
  `engagement_name`).
- **Kill-chain emulation table** — `# | phase | MITRE | emulated action | executing agent → skill`.
- **CONOPS kill_chain** — the phase order to copy into `conops.json`.
- **OPSEC & signature fidelity** — what to mirror so the emulation *reads* like the actor.
- **RoE / safety gates** — actor-specific authorizations and abort triggers.
- **Deconfliction** — identifiers so blue team can separate the exercise from a real intrusion.
- **Fidelity notes (deviations)** — where the emulation intentionally diverges (e.g. canary
  data instead of real destruction) and why.

## Discipline

- **Emulate behavior, not malware.** Decepticon reproduces an actor's *TTPs and sequencing*
  with its own tooling (Sliver, NetExec, certipy, etc.) — it does not run the actor's real
  implants. Fidelity comes from technique order + OPSEC posture, not from sample reuse.
- **RoE wins every tie.** If the actor's signature move (spearphishing, deauth, ICS write,
  encryption-for-impact) isn't authorized, drop it — never "emulate harder" past scope.
- **One actor per profile.** Multi-actor scenarios pick the dominant emulation target;
  note the secondary in `recent_cti_delta`.