AI for adversarial emulation — primer and lab curriculum
Date: 2026-10-23 · Audience: the lab's operating manual for the Qwen adversary tier. Companion build doc: [lab/qwen-attack-box.md](../lab/qwen-attack-box.md).
1. What adversarial emulation is (and isn't)
Adversarial emulation is the practice of reproducing known adversary behavior — TTPs, not just vulnerabilities — against your own environment to test whether your detections and responders hold. The unit of work is the MITRE ATT&CK technique, not the CVE.
| Activity | Question it answers | Tooling generation |
|---|---|---|
| Vulnerability scanning | "Where am I exposed?" | Nessus, Nuclei |
| Penetration testing | "Can a skilled human break in?" | Cobalt Strike, custom tradecraft |
| Adversarial emulation | "Would we detect technique X if it ran today?" | Atomic Red Team, CALDERA, Infection Monkey, Prelude Operator |
| AI-agent emulation (new) | "Would we detect an adaptive, machine-speed adversary?" | PentestGPT, HackingBuddyGPT, Strix, ARTEMIS, XBOW-class |
Traditional emulation is scripted: Atomic Red Team runs procedure Y, you see if the rule fires. The weakness is that scripts don't adapt — they execute one procedure, one way. Real adversaries (and now AI agents) adapt: they read the environment, change approach when blocked, and chain techniques opportunistically.
2. What AI actually changes
Four properties, each documented in 2025–2026 incidents:
- Adaptivity. The agent observes tool output and retries with variation. UIUC HPTSA: agent teams exploited zero-days that defeated single agents (arXiv:2406.01637). Anthropic's 45-agent swarm found 266 vulns vs 21 for parallel singles (2026-08-13).
- Speed. GTG-1002: "thousands of requests, often multiple per second," 80–90% AI-run (Anthropic, 2025-11-13). A financial actor's multi-agent framework harvested thousands of credentials in <6 hours (Google GTIG, 2026-09).
- Polymorphism. Project Black (2026-10): an uncensored local model rewrote a LSASS dumper into an EDR-undetectable variant in one pass — new spawning, reduced access masks, sleeps, string scrubbing, new filenames. Per-generation uniqueness defeats signature/hash detection.
- Cost. ARTEMIS matched 9/10 professional pentesters at ~$18/hr of inference (arXiv:2512.09882, ICLR 2026).
The detection consequence that matters for this lab: polymorphism kills tool-centric detection; behavior remains OS-constrained. An AI-written LSASS dumper still must open LSASS with credential-read access, still must write a minidump, still spawns processes. Emulation with AI therefore stress-tests our behavioral rules far better than canned procedures — which is exactly the telemetry our Sigma rules need.
3. Anatomy of an AI emulation agent
| Component | Role | Reference implementations |
|---|---|---|
| Planner | decomposes goal → ordered TTP attempts; recovers from failure | HackingBuddyGPT harness, ARTEMIS scaffold |
| Model | the reasoning/adaptation engine — here, self-hosted Qwen | this tier (see build doc) |
| Tool layer | shell, HTTP, file ops, exploit wrappers, MCP tool arsenals | LiteLLM → agent-native tools; MCP-wrapped arsenals (150+ tools in 2025–26 frameworks) |
| Memory | session transcripts, host facts, credentials found; cross-session persistence is its own threat | agent state files; range-captured |
| Evaluator | "did the TTP land? what did the telemetry show?" | LLM-as-judge over tool output; our SIEM rules as ground truth |
4. Lab curriculum — learning by doing
Weekly loop, one tactic per week, from the ATT&CK Enterprise matrix. Every run produces a dataset + a detection delta.
| Week | Tactic focus | Emulation exercise | Detection output |
|---|---|---|---|
| 1 | Execution | Agent lands a payload 3 different ways on the range; you observe which Sysmon IDs fired | coverage baseline; gaps logged as beads |
| 2 | Persistence | Agent implants via 5 ATT&CK techniques incl. agent-config files (.cursor/mcp.json, AGENTS.md) | rule: config tampering (exists — validate against agent variants) |
| 3 | Credential Access | Project Black reproduction: Qwen iterates LSASS tooling against the Windows VM until telemetry-silent; then we hunt the behavior | new behavioral rules from capture |
| 4 | Lateral movement | Agent pivots range hosts using harvested creds; A2A delegation used as C2-analog | rules: delegation-chain patterns |
| 5 | Collection/exfil | Agent finds canaries and stages exfil; measure time-to-detect | correlation rule: read→stage→exfil |
| 6 | Multi-agent | 3-agent team with conflicting subgoals vs. range (Anthropic turf-war setup) | what does a swarm look like in telemetry? conformity/polling signatures |
Metrics per run: ATT&CK techniques attempted/succeeded, detection rate, time-to-detect, agent cost (tokens), and a human-effort comparison. These numbers are the backbone of every write-up.
5. Rules of engagement (non-negotiable)
- Targets: lab range hosts only (isolated bridge, default-deny egress, snapshot + kill switch). No third-party systems, ever.
- The model server and agent harness run in the adversary tier — physically/logically separate from the honeypot tier. Honeypot captures must never be contaminated by our own agents.
- Every agent run is logged (prompts, tool calls, outputs) — the logs are the dataset; dataset provenance is the publication's credibility.
- Human authorization gate before each campaign; one operator (you) approves scope per run.
- Range windows VMs/hosts are rebuilt from snapshot after credential-access weeks. No lab creds reused anywhere.
6. From lab to consulting line
AI-assisted adversarial emulation packages cleanly as a service: "we deploy adaptive AI adversaries against your environment and hand you a detection-coverage report with per-technique evidence." The lab's curriculum becomes the engagement methodology; the Sigma rules and datasets become the public proof-of-competence that sells it. Publish the curriculum's detection deltas, not client data.
Agentic Threat Lab (2026-10-23). AI for adversarial emulation — primer and lab curriculum. https://lab.cidari.ai/notes/2026-10-23-ai-adversarial-emulation