This thesis examines the automation of adversary emulation by leveraging Large Language Models (LLMs) to convert unstructured threat intelligence reports (e.g., detailed campaigns) into actionable cybersecurity attack workflows.
The initial phase of the study will employ an abstract approach, assessing whether a full attack cycle—including adversarial tactics, techniques, and procedures (TTPs) with detailed execution steps—can be extracted from human-readable reports and represented as machine-readable Collaborative Automated Course of Action Operations (CACAO) attack playbooks.
Building on this, the research will then explore the extent to which fully executable playbooks/emulations can be constructed by operationalizing Caldera "using a hybrid approach" (generating and integrating MITRE Caldera emulation plans and scripts within CACAO playbooks), creating end-to-end adversary scenarios.
These scripts and playbooks enable standardized, shareable workflows across organizational boundaries. By automating this process, the work aims to accelerate red team operations, reduce human error, and enhance organizational readiness against evolving cyber threats.