Automated Repeatable Adversary Threat Emulation with Effects Language (EL)
For cybersecurity researchers and practitioners, this work provides a formalized approach to automate threat emulation, though it is an incremental contribution building on existing concepts.
The paper addresses challenges in automating multi-step attack emulation for advanced persistent threats and introduces Effects Language (EL), a visual programming language, to improve repeatability and efficiency. Results show improvements in time and resource efficiency.
The emulation of multi-step attacks attributed to advanced persistent threats is valuable for training defenders and evaluating defense tools. In this paper, we discuss the numerous challenges and desired attributes associated with such automation. Additionally, we introduce the use of Effects Language (EL), a visual programming language with graph-based operational semantics, as a solution to address many of these challenges and requirements. We formally define the execution semantics of EL, and prove important execution properties. Furthermore, we showcase the application of EL to codify attacks using an example from one of the publicly available attack scenarios. We also demonstrate how EL can be utilized to provide proof-of-attack of complex multi-step attacks. Our results highlight the improvements in time and resource efficiency achieved through the use of EL for repeatable automation.