ai-evals

adversary_emulation_library

Name: adversary_emulation_library
Author: center-for-threat-informed-defense

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

2,175 stars+3★ this week363 forksCUpdated 5/28/2025100% free · open source

What it does

Provides ready‑to‑use, MITRE ATT&CK‑aligned adversary emulation plans so you can safely test your security controls against real‑world tactics.

When to use it

•You want to validate that your detection rules catch techniques used by known threat groups.
•You need a repeatable, documented playbook for red‑team or purple‑team exercises.
•You want to benchmark security products (EDR, SIEM) with realistic attack sequences.

Ready-to-paste prompt

./ael run --plan ./adversary_emulation_library/plans/fin7.yaml --target 192.168.1.100 --output report.json

Heads up: The C code requires libyaml‑dev and a recent GCC (>=9); missing the dev headers will cause the `make` step to fail.

Saves to your device

Use with Claude

New

Skip the builder — one click puts this in Claude, Cursor, Antigravity and more.

✅ Light setup

Installs with a command or two; your AI agent can do it for you.

Try it instantly — no install

Claude Code

mkdir -p ~/.claude/skills/adversary-emulation-library && curl -fsSL https://workflowstacks.com/api/skills/adversary-emulation-library/claude-skill -o ~/.claude/skills/adversary-emulation-library/SKILL.md

Open in another AI app

Opens the app with this repo with the prompt ready to go — no copy-paste needed.

Connect the whole catalog (MCP)

claude mcp add --transport http workflowstacks https://workflowstacks.com/api/mcp

Adds a WorkflowStacks connector to Claude Code: search and load any skill here by chatting.

What's inside — free to inspect

No purchase needed

Read the entire source before you build — unlike paid marketplaces that hide it behind a buy button.

top-level files

folders

640.9M

source size

Apache-2.0

license

Key files

README.md

File tree

.github/

apt29/

blind_eagle/

carbanak/

fin6/

fin7/

menu_pass/

micro_emulation_plans/

ocean_lotus/

oilrig/

resources/

sandworm/

structure/

turla/

wizard_spider/

.gitignore

CONTRIBUTING.md

LICENSE