Skip to content

Build Abilities and Adversaries

An ability is a test action with platform and executor definitions. An adversary profile organises abilities into an emulation plan. Review the action itself before relying on its ATT&CK label.

Create a beginner profile

Create a profile with a clear validation question and only harmless discovery abilities. The preserved example used the name Red Haast Eagle.

Open adversaries and create a new profile Add an ability to the adversary profile Search for the Check Python ability Open the ability for review Confirm the platform executors and save the profile

Before adding an ability, verify:

  • the tactic and technique describe the behaviour accurately;
  • each command is understood for its platform and executor;
  • required facts and payloads are available;
  • privileges and timeout are appropriate;
  • cleanup reverses every intended change; and
  • output will provide evidence for the validation question.

Create a custom ability

The preserved proof of concept created LinPEAS and WinPEAS discovery abilities. Those tools perform broad enumeration and are optional advanced content, not a beginner prerequisite.

Choose Create an Ability Define the Run LinPEAS ability and ATT&CK mapping Add the Linux shell executor, timeout, and cleanup Define the Run WinPEAS ability Add the Windows PowerShell executor and cleanup

Correct the preserved cleanup commands

Avoid broad destructive commands such as rm -rf when removing a single test file. Use explicit paths and verify the target. The legacy Windows example also created notes.txt but removed only the executable; cleanup should account for every file created by the ability.

Optional payload hosting

The original lab downloaded PEASS-ng assets and served them from a temporary Python web server on the MITRE Caldera VM.

Temporary payload web server used by the preserved proof of concept

If you reproduce that extension, pin a release, verify hashes, bind the server only to the isolated interface, record access, and stop it after the exercise. Do not fetch a moving latest payload during a repeatable validation.

Add reviewed abilities to the profile

Add the custom abilities to the adversary profile

Order abilities deliberately. For the beginner route, use a short profile such as hostname discovery followed by a process listing. Predict the expected endpoint telemetry and alerting before the operation runs.

Profile checkpoint

Another analyst should be able to review the profile and identify its question, ability order, commands, ATT&CK mappings, expected evidence, scope, cleanup, stop condition, and limitations without executing it.

PreviousDeploy agentsNextRun operations and report