Automated Repeatable Adversary Threat Emulation with Effects Language (EL)

The emulation of multi-step attacks attributed to advanced persistent threats is valuable for training defenders and evaluating defense tools. In this paper, we present Effects Language (EL), a novel directly executable visual coordination programming language for such attack emulation, and its operational semantics. EL supports reactive orchestration of an attack graph including lazy precondition evaluation to emulate realistic attack scenarios. EL also enables separation of roles and responsibilities for the threat emulation workflow, and programming for attack resilience. Through a case study we demonstrate how EL can be utilized to bring efficiencies in time and resources in automated threat emulation.