Adversary Emulation Fundamentals

GASAE · 20 questions

• A city purple team wants to map planned validation tests to MITRE ATT&CK before buying a BAS tool. Which approach best frames those municipal control checks?
• A county fusion center debates Atomic-style technique libraries versus a full multi-stage campaign plan for purple-team validation. What distinction should the lead emphasize?
• A transit authority asks whether a Caldera-class open emulation framework fits better than a commercial BAS for its first purple-team year. What selection criterion best matches civic maturity?
• A water utility SOC wants emulation coverage only for techniques relevant to Windows jump hosts and VPN gateways. How should the team scope the emulation framework?
• A school-district purple team must document which ATT&CK tactics each quarterly emulation covers for auditors. What practice best turns the framework into an evidence map?
• A housing authority evaluates continuous BAS agents versus scheduled campaign runs on shared workstations. Which operating model best fits low-disruption municipal environments?
• A public-health department wants automated phishing-resilience checks without running live social-engineering against residents. Which BAS approach stays inside authorized municipal scope?
• A court IT team needs breach simulation that proves EDR detections without encrypting evidence shares. Which BAS scenario choice is appropriate?
• A 311 operations center asks how BAS reporting proves detection gaps to city council IT oversight. What interpretation is most useful?
• A library consortium prefers cloud BAS targeting Entra-joined staff laptops over on-prem only. What platform alignment best matches that hybrid municipal reality?
• A parks department security lead wants scripts that replay known ransomware precursor behaviors in a lab VLAN. What automation practice best fits?
• A county assessor office needs repeatable emulation of credential-dumping detections after each patch Tuesday. How should automation be designed?
• An emergency-management agency wants to parameterize emulation playbooks so the same chain runs in staging then limited prod. What design choice supports safe reuse?
• A municipal SOC asks whether technique automation should be detection-as-code triggered or manually queued. Which guidance fits adversary-behavior automation in SOC workflows?
• A city red/blue working group stores emulation plans as versioned YAML beside detection rules. What benefit does that practice provide?
• A transit SOC wants to chain initial access → persistence → discovery in one authorized exercise window. What readiness goal does that chaining serve?
• A county IR lead insists emulation chains stop before impact and always page change control. Which principle is being applied?
• A public works IT team maps each hop in an emulation chain to expected SIEM alerts and playbook steps. Why is that mapping valuable?
• A housing IT purple team reuses the same chain monthly but rotates hosts to avoid detector overfitting. What validity concern does host rotation address?
• A city CISO asks whether BAS chain coverage should prioritize crown-jewel permit and payroll systems first. What prioritization approach is sound?