Laccolith: Hypervisor-Based Adversary Emulation with Anti-Detection

arXiv:2311.08274v3 Announce Type: replace
Abstract: Advanced Persistent Threats (APTs) represent the most threatening form of attack nowadays since they can stay undetected for a long time. Adversary emulation is a proactive approach for preparing against these attacks. However, adversary emulation tools lack the anti-detection abilities of APTs. We introduce Laccolith, a hypervisor-based solution for adversary emulation with anti-detection to fill this gap. We also present an experimental study to compare Laccolith with MITRE CALDERA, a state-of-the-art solution for adversary emulation, …

advanced advanced persistent threats adversary adversary emulation apts arxiv attack attacks can cs.cr csos detection emulation hypervisor persistent persistent threats proactive proactive approach solution threats tools undetected