Simulating a Ransomware Attack with Caldera.

Josh Beck
2 min readJun 7, 2024

--

iCSI@NEISD SOC Classroom

You can find the lab directions here.

What is Caldera?

Caldera is an advanced, automated adversary emulation system designed to replicate the tactics, techniques, and procedures (TTPs) used by Advanced Persistent Threats (APTs). Developed by MITRE, it allows cybersecurity professionals to simulate real-world attack scenarios, providing a deeper understanding of how adversaries operate and helping to identify potential vulnerabilities within a system.

Why Think Like an APT Actor?

Understanding and thinking like an APT actor is crucial for effective cybersecurity defense. APT actors are highly skilled and persistent, often using sophisticated methods to infiltrate and compromise systems. By emulating their strategies, defenders can anticipate potential attack vectors, strengthen their security posture, and develop more robust incident response plans. This proactive approach enables organizations to stay ahead of threats and minimize the risk of successful attacks.

Requirements:

  • Ability to run VMWare
  • Ubuntu 22.04 and Windows 10 will be run as guest operating systems.

What You’ll Learn:

  • Utilize the Caldera framework to maintain persistence post-compromise.
  • Explore the MITRE ATT&CK Framework and its application in real-world scenarios.
  • Understand the Cyber Kill Chain and how adversaries progress through each stage.
  • Practice data exfiltration techniques used by cybercriminals.
  • Get hands-on with PowerShell for automation and execution of sophisticated attacks.

--

--