MITRE Caldera Hands-on Labs

Use the Interactive Lab to practise the MITRE Caldera workflow without executing a command, or use the Full Lab to deploy one authorised agent and validate a harmless discovery operation in isolated virtual machines.

Hands-on adversary-emulation proof of concept

Scope it. Emulate it. Validate it.

Start with one server, one agent, and two harmless discovery abilities. Prove what MITRE Caldera executed, compare the expected defensive evidence with what actually appeared, and report a conclusion that stays within scope.

⏱ 3–5 hours core◆ Guided beginner✓ Evidence required

Start the Full Lab

Self-hosted · 3–5 hours

MITRE Caldera Full Lab

Installation required

Use an isolated, authorised environment

Run abilities only on systems you own or are explicitly authorised to test. Review commands before execution, use low-impact discovery, and maintain a tested stop and recovery path.

How to use this guide with different releases

This lab describes outcomes and checkpoints rather than asking you to copy every screenshot. Navigation labels and button positions may change between releases. Keep this page open, follow the linked journey for each task, and return here when its checkpoint passes. The official getting-started guide remains the authority for the interface supplied with your pinned release.

Before you begin

You need: one Ubuntu server VM, one Ubuntu or Windows client VM, an isolated network, administrator access, temporary authorised download access, snapshots, and a place to retain operation and defensive evidence.

How to use this lab

Complete one session at a time. Stop when a checkpoint fails. Do not add another ability or endpoint until the existing scope, execution, evidence, cleanup, and recovery checks pass.

Recommended first

Beginner Core Lab

Use one MITRE Caldera server and one authorised client. Run hostname and process discovery, then compare MITRE Caldera results with defensive telemetry.

Expected time: 3–5 hours across three sessions.

Optional extension

Wider validation

After the core passes, add one agent, one reviewed ability, or one detection control. Change only one variable and repeat the baseline operation.

Expected time: one additional session.

1. Session 1Build and authorise
2. Session 2Connect and design
3. Session 3Run and validate

Objective

You are validating whether harmless discovery on WIN-LAB01 is visible and reviewable. Deploy MITRE Caldera, enrol only that endpoint, create profile CDK Safe Discovery, run two reviewed abilities, preserve MITRE Caldera and defensive evidence, clean up, and state what the exercise does and does not prove.

The beginner route contains only:

• one Ubuntu VM running the MITRE Caldera server;
• one isolated Windows or Ubuntu endpoint running Sandcat;
• one agent group containing only that endpoint; and
• two low-impact discovery abilities in one adversary profile.

Do not add PEASS-ng, credential access, persistence, destructive cleanup, multiple agents, or another planner until the core route passes.

01

Activity 1: Build and authorise

Record the test boundary

Before building anything, write down:

Decision	Beginner value
Validation question	Can the approved discovery actions execute on WIN-LAB01, and which defensive records observe them?
Authorised target	One disposable endpoint only
Permitted behaviour	Host/user identification and process discovery
Stop condition	Unexpected target, command, privilege, impact, or loss of service health
Recovery	Terminate the operation and agent; restore the last verified snapshot
Evidence owner	Named learner or analyst responsible for the final record

Prepare the downloads and virtual machines

Record the filename, release, architecture, source, checksum, download date, and licence condition for every item.

Item	Purpose	Authoritative source
Ubuntu installation media	Server operating system	Ubuntu releases
MITRE Caldera pinned release	Adversary-emulation server and plugins	MITRE Caldera releases
Windows or Ubuntu installation media	Authorised test endpoint	Vendor download source used by your organisation

VM	Suggested beginner allocation	Example address
MITRE Caldera server	2+ vCPU, 8 GB RAM, 40 GB disk	10.0.0.100
Authorised endpoint	2 vCPU, 4 GB RAM, 40 GB disk	10.0.0.50

1. Create an isolated virtual network and provide temporary NAT only for authorised downloads or updates.
2. Create the two VMs from the proof-of-concept topology.
3. Configure hostnames, addresses, DNS and time synchronisation, adapting the complete address plan consistently when necessary.
4. Confirm the VMs can reach only the required lab and update services.
5. Take base-os snapshots.
6. Follow Install MITRE Caldera, using a pinned release and the matching official requirements. Protect the generated credentials.
7. Confirm the interface opens and the server reaches All systems ready.
8. Take a working-caldera-server snapshot.

Milestone 1Authorised server readyThe server is recoverable, the interface opens, and the written boundary identifies one client and harmless discovery only.

Expected result Another analyst can identify exactly what may run, where, when, by whom, and how it will be stopped and reversed.

02

Activity 2: Connect and design

Follow these checkpoints in order. Stop at the first failed checkpoint rather than changing several settings at once.

1. The server is healthyRestore or clone working-caldera-server, open the interface, and confirm the selected release and enabled plugins.
2. One agent checks inFollow Deploy MITRE Caldera Agents, enrol only the authorised endpoint, and confirm its status is alive.
3. The identity matchesRecord the paw, hostname, platform, group, privilege, executors, contact and last-seen time. Stop if any value identifies the wrong system.
4. Removal is understoodRecord how to terminate the Sandcat process, remove its files and restore the endpoint before running an ability.
5. Two abilities are reviewedFollow Build Abilities and Adversaries. Confirm every platform command, executor, ATT&CK mapping, timeout, output and cleanup action.
6. The profile is boundedCreate CDK Safe Discovery with host/user identification first and process discovery second. Include no other abilities.
7. The core is recoverableAsk another person to review the profile, then take a working-caldera-core snapshot.

Before continuing, predict one result for each ability:

Ability	Expected MITRE Caldera result	Expected defensive evidence
Identify host and user	Hostname and account output with exit code 0	Process creation plus command-line or shell telemetry
Process discovery	A process list with exit code 0	Process or PowerShell telemetry showing the discovery command

Milestone 2One agent and profile readyThe endpoint identity is verified and another analyst can review both abilities without executing them.

Expected result The profile contains only the two approved discovery actions and targets no system outside the written boundary.

03

Activity 3: Run and validate

Run the operation

Restore or clone working-caldera-core. Confirm the server and endpoint are healthy and the single agent has checked in recently.

Use this configuration when following Run Operations and Report:

Setting	Required value
Operation name	VAL-1042 Safe Discovery
Agent group	The group containing only the authorised endpoint
Adversary	CDK Safe Discovery
Planner	atomic, so the reviewed profile order is followed
Obfuscator	plain-text for the first run
Autonomous mode	Use the release default only after confirming the exact two-ability plan

1. Recheck the group membership immediately before starting.
2. Start the operation and watch the two links and service health.
3. Stop immediately if the target, command, privilege or impact differs from the written boundary.
4. Open each completed or failed link and preserve the ability, agent, command, executor, timestamps, status, stdout, stderr and skipped reason.
5. Export the operation report or event logs and store them as potentially sensitive evidence.

Compare execution with defensive evidence

Search a narrow time window around each link. Use the defensive product already available in your lab; installing a SIEM or EDR is not a prerequisite for proving MITRE Caldera execution.

Checkpoint	Expected	Observed	Result
Intended agent ran the ability	Matching paw and hostname	Record your evidence	Pass / fail
Command completed	Exit status and expected output	Record your evidence	Pass / fail
Endpoint telemetry arrived	Process, shell or PowerShell record	Record your evidence or not available	Pass / gap / not tested
Detection fired	Only when a relevant rule was expected	Record alert evidence or not expected	Pass / gap / not tested

Do not call the defence validated merely because a link succeeded. Equally, do not call the operation failed merely because no SIEM or EDR was installed.

Conclude and clean up

1. Remove the agent and temporary test material using the recorded procedure.
2. Confirm the endpoint and MITRE Caldera server remain healthy.
3. Restore the working baseline when cleanup cannot be verified.
4. Assign each defensive gap an owner and retest date.

Answer:

• Did each ability execute on the intended endpoint?
• Which defensive evidence appeared, and which was missing?
• What is the first failed control boundary?
• Does the evidence prove execution, detection, both, or neither?
• What should change before the same operation is retested?

Milestone 3Scoped conclusion recordedThe operation, defensive evidence, cleanup, limitations, improvement owner, and retest decision are traceable.

Expected result MITRE Caldera execution is separated from defensive-control validation, and the conclusion does not claim broader ATT&CK or fleet coverage.

Full Lab evidence checklist

This checklist applies to the self-hosted Full Lab. If you completed only the Interactive Lab, retain its downloaded evidence summary instead.

• Question, authority, target, actions, window, owner, stop condition, and recovery plan.
• Versions, downloads, checksums, topology, addresses, time synchronisation, and snapshots.
• Agent identity, platform, group, privilege, executors, contact, and removal method.
• Reviewed profile, ability commands, mappings, expected evidence, timeout, and cleanup.
• Operation configuration, scope, timestamps, links, output, failures, and skipped reasons.
• Expected and observed endpoint, network, SIEM, or EDR evidence.
• Exported operation report or event log stored as potentially sensitive evidence.
• Conclusion, confidence, limitations, cleanup, improvement owner, and retest date.

0 of 8 recorded Mark each item when you have saved the evidence.Reset

Troubleshooting

Symptom	First check
Interface does not open	Server status, bind address, port, firewall, generated configuration, and selected release documentation
Agent does not appear	Contact address, network route, platform command, process state, group, and server logs
Ability is skipped	Platform, executor, required facts, payload, privilege, and adversary ordering
Link succeeds but no detection appears	Confirm the expected data source exists before changing the detection rule
Operation exceeds scope	Stop it, preserve logs, terminate agents, assess impact, and restore the last verified snapshot

Clean up

Stop operations, terminate and remove agents, delete test payloads and outputs, restore altered security controls, protect reports and credentials, and revert disposable VMs when appropriate.

PreviousRun operations and reportNextReturn to MITRE Caldera overview