Initial Access Emulation

Definition

Initial access emulation is the controlled replication of the techniques adversaries use to gain the first foothold — phishing with attachments (T1566.001) and links (T1566.002), exploitation of public-facing applications (T1190), valid-account use (T1078), and external remote services (T1133) — against your own mail, web, and identity controls with explicit authorization, lab-safe payloads, and per-message test markers. The goal is measurement, not compromise: every emulated message or request is engineered to generate the same control decisions a real attack would (gateway verdicts, URL rewrites, MFA prompts, WAF blocks) while carrying none of the real payload’s capability. Emulating initial access well is the cheapest detection-validation investment in the whole program — the entry chain is where the most users, the most telemetry, and the most controls intersect, and every hop validates in minutes.

Why It Matters

Entry vectors are where security spending is most visible and least measured: mail gateways, awareness training, MFA, WAFs, and edge services all claim to stop specific behaviors, and initial access emulation is how you find out which claims are true — not annually on paper, but quarterly with a measured pass/block rate per control. The measurement cascades: a phishing attachment that should have been sandboxed but was delivered becomes a gateway rule gap; a lure URL that should have been rewritten but wasn’t becomes a proxy gap; an emulated MFA prompt that a lab user approved without scrutiny becomes an awareness-data point that no training video teaches as well. Emulation also serves the human control directly — simulated phishing (properly authorized and framed) is the only training method with individual-level measurement, and its data (who reports, who clicks, who replies) drives the program’s human-risk metrics. For the red/blue relationship, initial access is the friendliest emulation surface: payloads are inert by design, blast radius is a mailbox, and abort criteria are trivial (stop sending). Finally, the discipline matters because unmarked simulations are indistinguishable from real attacks — to users, to the SOC, and to external observers — so the marking, authorization, and coordination practices in this module are not bureaucracy; they are what keeps an awareness exercise from becoming an incident of its own.

Detailed Explanation

Each access vector has its own emulation shape, safety model, and measurement surface:

 PHISHING ATTACHMENT EMULATION (T1566.001)
 [sender] lab SMTP relay, per-message marker X-Emu-ID
    |  payload: benign maldoc with telemetry-shaped macro
    |  (M12 chain: AutoOpen -> powershell Write-Log only)
    v
[gateway] AV + sandbox + URL rewrite  <-- verdict 1 recorded
    v
[mailbox] lab recipient cohort (authorized users)
    |  user actions measured: open / enable-macro / report
    v
[endpoint] benign macro runs; EID 1 + 4104 telemetry
    <-- verdict 2: did the Office-lineage alert fire?

 PHISHING LINK EMULATION (T1566.002)
 lure URL -> your redirector (marker in query string)
    -> gateway safe-links verdict -> proxy log
    -> landing page (benign, credential-harvest-SHAPED:
       no submit capture, "This was a test" after entry)

 T1190 (public app) & T1133 (VPN/RDP) emulation:
 authorized weak-credential accounts, own vulnerable app
 instance, full chain on lab segment; measure WAF/IDS/EDR

The attachment path is the workhorse: the payload must be telemetry-shaped but capability-free — the maldoc structure matches what M12 documents (event hooks, PowerShell child process, registry or scheduled-task touch) so every downstream control sees the shape it’s supposed to detect, but the actual payload is a benign write-to-log or a marker beacon to your own listener. EICAR-style test files validate AV signatures but not behavioral chains, which is why the macro-harness approach exists. The link path exercises the different controls: safe-links rewriting, proxy categorization, browser isolation — your redirector carries per-recipient markers so the report can attribute each click, and the landing page measures entry (form fill on a non-capturing page) rather than harvesting anything. The identity path (T1078/T1133) validates the controls that phishing aims to bypass: MFA enforcement, impossible-travel detection, VPN geo rules — emulated with authorized accounts you control, never with stolen or guessed credentials, and the measurement is whether identity anomaly detection fires on the emulated behavior. Three coordination rules are non-negotiable across all vectors: written authorization with scope and window (who approved, which recipients, which apps), per-message test markers (X-Emu-ID headers, marker domains, distinctive macro strings) so any escaped artifact is identifiable as a test in seconds, and SOC notification with the exercise window — a phishing simulation that surprises the SOC wastes the blue team’s time and trains the wrong reflexes.

Common Techniques

Emulation technique	Vector	Measures	Safety model
Marker-marked maldoc cohort	T1566.001	Gateway + user + endpoint chain	Benign macro, marker headers
Credential-harvest-shaped landing	T1566.002	Safe-links, proxy, user entry	Non-capturing form
Lure redirector with per-user tags	T1566.002	Click attribution	Your infra only
Authorized weak-account VPN/RDP	T1133	Identity anomaly, geo rules	Accounts you own
Emulated MFA prompt fatigue (consented)	T1621 [verify ID]	User response behavior	Opt-in cohort, debrief
Own vulnerable app instance	T1190	WAF/IDS/EDR chain	Lab segment, no real data
USB-drop on lab bench	T1200	DLP/EDR autorun handling	No production endpoints
Reply-to monitoring	T1566.003 [verify]	User reply behavior	Test inbox only
Calendar-invite lure (lab)	T1566 via .ics	Mail controls + user	Marker-marked
Pretext-thread continuation	T1566	Thread-hijack gateway rules	Own threads, marker-marked

Full Working Code

emuphish.py — an authorized phishing-emulation harness: generates marker-marked test messages (per-recipient unique IDs), sends them through your lab SMTP relay, records the cohort and markers to a CSV, and — when pointed at the mail server’s export later — reconciles which messages were delivered, blocked, or quarantined. It sends nothing without an explicit --authorized flag carrying the approval reference, and the payload URL/macro markers are configurable. stdlib only.

#!/usr/bin/env python3
"""emuphish.py — authorized phishing-emulation message harness.
AUTHORIZED SECURITY TESTING ONLY: requires written approval,
lab recipients, marker-marked messages. Refuses to run without
--authorized <approval-ref>.

Usage:
  python emuphish.py --relay 10.0.0.5 --from "IT Test <emu@lab.local>" \
      --cohort cohort.csv --subject "Mail quota notice" \
      --lure "https://emu-lab.local/q" --authorized "APPR-2026-117"
cohort.csv: email,uid  (lab recipients only)
stdlib only (smtplib, email, csv).
"""
import argparse, csv, hashlib, smtplib, sys, datetime
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from email.utils import formataddr

MARKER_HEADER = "X-Emu-ID"
REPORT = "emu_campaign_log.csv"

def load_cohort(path):
    rows = []
    with open(path, encoding="utf-8", newline="") as fh:
        for r in csv.DictReader(fh):
            addr = (r.get("email") or "").strip()
            uid = (r.get("uid") or "").strip()
            if addr and uid:
                rows.append((addr, uid))
    return rows

def build_message(sender, recipient, uid, subject, lure,
                  approval):
    """Marker-marked, per-recipient test message."""
    day = datetime.date.today().isoformat()
    token = hashlib.sha256(f"{uid}|{day}|{approval}".encode()
                           ).hexdigest()[:12]
    msg = MIMEMultipart("alternative")
    msg["From"] = sender
    msg["To"] = recipient
    msg["Subject"] = f"[EMU {token}] {subject}"
    msg[MARKER_HEADER] = f"{approval}/{token}"
    msg["X-Mailer"] = "emu-phish-harness (authorized test)"
    text = (f"Lab emulation message.\nApproval: {approval}\n"
            f"Marker: {token}\nLure: {lure}?u={uid}&t={token}\n")
    html = f"""<html><body style="font-family:sans-serif">
<p>Hello lab user {uid},</p>
<p>Please review the notice for your mailbox:
<a href="{lure}?u={uid}&t={token}">Open notice</a></p>
<p style="color:#999;font-size:11px">
AUTHORIZED SECURITY EMULATION — approval {approval}<br>
If you received this outside a scheduled exercise, notify
the security team and quote marker {token}.</p>
</body></html>"""
    msg.attach(MIMEText(text, "plain"))
    msg.attach(MIMEText(html, "html"))
    return token, msg

def send_cohort(relay, port, sender, cohort, subject, lure,
                approval):
    """Send one marker-marked message per recipient."""
    log = []
    with smtplib.SMTP(relay, port, timeout=15) as s:
        s.ehlo()
        for addr, uid in cohort:
            try:
                token, msg = build_message(
                    sender, addr, uid, subject, lure, approval)
                s.sendmail(sender_addr(sender), [addr],
                           msg.as_string())
                log.append({"email": addr, "uid": uid,
                            "token": token, "status": "sent",
                            "when": datetime.datetime.now(
                                datetime.timezone.utc
                            ).isoformat()})
            except smtplib.SMTPException as e:
                log.append({"email": addr, "uid": uid,
                            "token": "", "status": f"smtp-error",
                            "when": datetime.datetime.now(
                                datetime.timezone.utc
                            ).isoformat()})
    return log

def sender_addr(sender):
    """Return the bare address from 'Name <addr>'."""
    from email.utils import parseaddr
    return parseaddr(sender)[1]

def write_log(log):
    with open(REPORT, "w", encoding="utf-8", newline="") as fh:
        w = csv.DictWriter(fh, fieldnames=["email", "uid",
            "token", "status", "when"])
        w.writeheader()
        w.writerows(log)

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--relay", required=True)
    ap.add_argument("--port", type=int, default=25)
    ap.add_argument("--from", dest="sender", required=True)
    ap.add_argument("--cohort", required=True)
    ap.add_argument("--subject", required=True)
    ap.add_argument("--lure", required=True)
    ap.add_argument("--authorized", required=True,
                    metavar="APPROVAL-REF")
    args = ap.parse_args()
    if not args.authorized.startswith("APPR-"):
        sys.exit("refusal: --authorized must carry an "
                 "approval reference (APPR-...)")
    cohort = load_cohort(args.cohort)
    if not cohort:
        sys.exit("empty cohort — nothing to do")
    print(f"[+] cohort: {len(cohort)} lab recipients, "
          f"approval {args.authorized}")
    log = send_cohort(args.relay, args.port, args.sender,
                      cohort, args.subject, args.lure,
                      args.authorized)
    sent = sum(1 for r in log if r["status"] == "sent")
    errs = len(log) - sent
    print(f"[+] sent: {sent}, errors: {errs}")
    write_log(log)
    print(f"[+] campaign log: {REPORT} — tokens recorded "
          f"for verdict reconciliation and click attribution")

if __name__ == "__main__":
    main()

Code Walkthrough

• The authorization gate (lines 116-121) is the tool’s most important feature: --authorized must carry an APPR- reference or the tool exits. This is not decoration — awareness-testing tools that send without an authorization trail are how simulations turn into policy violations, and the reference ties every message header to the approval document.
• build_message() (lines 45-63) constructs the marker system: a per-recipient token (SHA-256 of uid|date|approval — deterministic, so a recovered message always maps back to recipient and exercise), duplicated in the Subject prefix ([EMU token]), a custom header (X-Emu-ID), the lure query string (?u=uid&t=token for click attribution), and a visible disclaimer paragraph. Four independent marking layers, because gateways strip headers, users strip subjects — redundancy is the design.
• send_cohort() (lines 66-83) opens one SMTP session and sends sequentially, recording per-recipient status into the campaign log — the log file is the exercise’s input for verdict reconciliation later (M13’s chainjoin shape), and SMTP errors are recorded, not retried, so the log reflects reality.
• sender_addr() (lines 86-89) extracts the bare address from the display-name form with parseaddr — SMTP needs the address only, while the header keeps the friendly name; splitting the two here keeps sendmail’s envelope correct regardless of how --from was written on the command line.

How It Reaches The Target

The emulated message reaches the target environment through the same path a real attack takes — relay, gateway, mailbox, user — and that sameness is the measurement’s whole point: the gateway’s verdict (block, quarantine, deliver, sandbox-pending), the user’s action (report, open, click, enter data), and the endpoint’s telemetry (Office lineage alert or silence) are all the control decisions the real attack would have produced. The campaign log reaches the reconciliation step as ground truth: which tokens were sent to whom, so the gateway’s export and the proxy’s click log can be joined per message (M13’s joiner generalizes here directly). Each verdict reaches a different owner — the gateway gap reaches email security as a rule ticket, the unreported click reaches awareness as a cohort data point, the silent endpoint reaches detection engineering as a lineage-rule gap, and the whole campaign reaches leadership as a human-risk trend line (report rate over quarters is the metric that shows whether the awareness program works). The SOC reaches the exercise in the opposite direction: the notification and window mean their triage of [EMU ...] messages is a five-second tag-and-close, and the ones they don’t recognize as tests are the finding — either the marking is insufficient or the SOC’s visibility is; both are valuable measurements. The discipline that makes all of this reach safely is the marker system: any artifact — a forwarded message, a screenshot in a ticket, a URL pasted into a chat — identifies itself as an authorized test in seconds, which is what keeps the exercise’s blast radius at exactly the size the approval document promised.

Exploitation Chain

1. Approve — written authorization APPR-2026-117: 60 lab users, one week window, SOC notified
2. Prepare — maldoc payload built per M12 harness (telemetry-shaped, capability-free); lure redirector stood up with per-user tags
3. Send — emuphish.py pushes 60 marker-marked messages through lab relay; campaign log records tokens
4. Gateway — 41 delivered, 19 blocked/quarantined: verdict 1 recorded per token
5. User — 12 users open, 4 click lure, 1 enters data on non-capturing page, 5 report
6. Endpoint — Office-lineage alert fires on 3 of 4 opens: verdict 2 recorded; 1 silent pass = gap
7. Reconcile — campaign log joined with gateway export + proxy clicks: full chain per token
8. Report — gateway rule gap filed, awareness cohort briefed, detection gap assigned: measurements, not stories

Building Your Own Tool

verdictmix.py — the verdict reconciler: joins the campaign log (per-token sends) with a gateway verdict export (per-message dispositions) and a proxy click log (per-URL fetches) into one per-recipient chain table — the initial-access version of M13’s chainjoin, specialized to the marker-token join key and emitting the four metrics an exercise report actually needs (delivery rate, click rate, report rate, detection rate).

Design decisions

• Token as join key. Headers, subjects, and lure URLs all carry the same token; the reconciler accepts any of the three as the gateway/proxy export’s key and normalizes — exports differ, tokens don’t.
• Chain, not verdicts. Output is one row per recipient with the full chain (sent → verdict → action → detection), because the report’s value is the joins (delivered-but-unreported, clicked-but-detected) — isolated percentages hide exactly the interesting cohorts.
• Cohort-level anonymity toggle. The detail table can drop to uid only (no emails) for the leadership view; the analyst keeps the keyed version.
• Stdlib CSV discipline. Gateway exports differ per vendor; the tool expects three simple CSV shapes and documents them — adapters belong at the edge, per M13’s pattern.

Full source

#!/usr/bin/env python3
"""verdictmix.py — phishing-emulation verdict reconciler.
Usage:
  python verdictmix.py --log emu_campaign_log.csv \
      --gateway gw_export.csv --clicks proxy_clicks.csv \
      [--anon] [--out report.md]
CSV schemas:
  emu_campaign_log.csv : email,uid,token,status,when
  gw_export.csv        : token,verdict        (deliver|block|quarantine)
  proxy_clicks.csv     : token,action         (click|form|report)
stdlib only.
"""
import argparse, csv, sys
from collections import Counter

def load_csv(path, keyfield):
    """Load CSV keyed by token."""
    out = {}
    try:
        with open(path, encoding="utf-8", errors="replace",
                  newline="") as fh:
            for row in csv.DictReader(fh):
                k = (row.get(keyfield) or "").strip()
                if k:
                    out[k] = row
    except OSError as e:
        sys.exit(f"cannot read {path}: {e}")
    return out

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--log", required=True)
    ap.add_argument("--gateway")
    ap.add_argument("--clicks")
    ap.add_argument("--anon", action="store_true")
    ap.add_argument("--out")
    args = ap.parse_args()
    sends = load_csv(args.log, "token")
    gw = load_csv(args.gateway, "token") if args.gateway else {}
    cl = load_csv(args.clicks, "token") if args.clicks else {}
    if not sends:
        sys.exit("campaign log empty — nothing to reconcile")
    rows = []
    for token, s in sends.items():
        verdict = (gw.get(token, {}).get("verdict")
                   or "no-export")
        action = (cl.get(token, {}).get("action") or "none")
        rows.append({"uid": s.get("uid", "?"),
                     "email": "" if args.anon
                              else s.get("email", "?"),
                     "sent": s.get("status"), "verdict": verdict,
                     "action": action})
    # the four metrics
    n = len(rows)
    delivered = sum(1 for r in rows
                    if r["verdict"] in ("deliver", "no-export"))
    clicked = sum(1 for r in rows
                  if r["action"] in ("click", "form"))
    reported = sum(1 for r in rows if r["action"] == "report")
    # detection rate: among chain-complete rows, endpoint alert
    # presence is carried in the gateway export as verdict=
    # "deliver+alerted" by convention [document your export's shape]
    detected = sum(1 for r in rows
                   if "alert" in r["verdict"].lower())
    print(f"== reconciliation: {n} recipients ==")
    print(f"delivery rate (reached mailbox): {delivered}/{n}"
          f" = {delivered/n:.0%}")
    print(f"click rate:   {clicked}/{n} = {clicked/n:.0%}")
    print(f"report rate:  {reported}/{n} = {reported/n:.0%}")
    print(f"alert rate:   {detected}/{n} = {detected/n:.0%}")
    # the joins that matter
    unreported = [r for r in rows
                  if r["verdict"] == "deliver"
                  and r["action"] == "none"]
    clicked_detected = [r for r in rows
                        if r["action"] in ("click", "form")
                        and "alert" in r["verdict"].lower()]
    print(f"\ncohort: delivered & no user action: "
          f"{len(unreported)}")
    print(f"cohort: clicked AND alerted: {len(clicked_detected)}"
          f"  <-- endpoint detection working")
    out_rows = rows
    print("\n| uid | email | sent | verdict | action |")
    print("|---|---|---|---|---|")
    for r in out_rows[:25]:
        print(f"| {r['uid']} | {r['email'] or '(anon)'} "
              f"| {r['sent']} | {r['verdict']} "
              f"| {r['action']} |")
    if args.out:
        with open(args.out, "w") as fh:
            fh.write(f"# Emulation reconciliation — {n} "
                     f"recipients\n\n")
            fh.write(f"- delivery: {delivered}/{n}\n"
                     f"- clicks: {clicked}/{n}\n"
                     f"- reports: {reported}/{n}\n"
                     f"- alerts: {detected}/{n}\n")
        print(f"[+] wrote {args.out}")

if __name__ == "__main__":
    main()

Walkthrough

• The three loaders (lines 17-29) share one token-keyed shape — the marker system from the sender tool pays off here: every downstream export joins on the same 12-hex string, no fuzzy matching needed.
• The four metrics (lines 47-58) are deliberately the report’s headline: delivery (gateway verdict), click (proxy), report (user behavior), alert (endpoint detection). The alert convention — gateway exports mark deliver+alerted — is documented in a code comment rather than hidden, because export shapes vary and the comment is where the next engineer looks.
• The two cohort extracts (lines 60-67) are the joins that drive action: delivered & no action is the awareness-worklist cohort, clicked & alerted is the proof the endpoint chain works. A report without these two lists is a scorecard; with them, it’s a worklist.
• --anon (line 44-46) blanks emails for the leadership copy — one flag enforces the privacy discipline that awareness programs (and their legal reviewers) require.

Compilation and test procedure

dry cohort and relay in the lab

$ cat cohort.csv email,uid u01@lab.local,u01 u02@lab.local,u02

$ python emuphish.py —relay 10.0.0.5 —cohort cohort.csv
—from “IT Test emu@lab.local”
—subject “Mail quota notice”
—lure “https://emu-lab.local/q”
—authorized “APPR-2026-117” [+] cohort: 2 lab recipients, approval APPR-2026-117 [+] sent: 2, errors: 0 [+] campaign log: emu_campaign_log.csv

verify marking layers survived the relay

$ swaks —server 10.0.0.5 —to u01@lab.local —quit-after DATA 2>/dev/null || true $ grep -l “X-Emu-ID” /var/mail/* 2>/dev/null || echo “check mailbox export”

reconcile with gateway + proxy exports

$ python verdictmix.py —log emu_campaign_log.csv
—gateway gw.csv —clicks clicks.csv —anon —out report.md == reconciliation: 2 recipients == delivery rate (reached mailbox): 2/2 = 100% click rate: 1/2 = 50% report rate: 1/2 = 50% alert rate: 0/2 = 0%

Detection considerations

Every artifact the harness produces is detection-test material: the maldoc payload is M12’s telemetry-shaped chain (Office → script host → log write), the lure URL exercises proxy categorization, the authorized VPN/OTP emulation exercises identity anomaly rules — each measured by the reconciliation report. Your own tooling hygiene: the harness sends only to the declared cohort through the declared relay; the code has no capability to widen scope at runtime (no ad-hoc recipients, no attachment of real payloads), which is the design property that makes it approvable. The SOC-facing discipline: the exercise window and marker formats are shared before sending, the SOC gets the campaign log at start, and any message found in the wild without matching the log is escalated as suspected real phishing — the marker system turns “is this the test?” into a lookup. Wazuh/EDR mapping of the endpoint-chain metric depends on your lineage rules (M12’s near-zero-FP alert); Suricata sees only plaintext lure fetches — expect proxy and endpoint to carry the measurement. The program-level metric worth defending: report rate is the leading indicator of human control maturity, and it only moves when exercises are regular, framed as safe-to-report, and closed with feedback — which is why the reconciliation report’s last line in every exercise should be the debrief date, not just the numbers.

Improvements to add

1. IMAP reconciliation adapter: poll the lab mailboxes’ IMAP folders directly to detect delivery/quarantine placement without gateway exports.
2. Reply-tracking: monitor the test inbox for replies to emulated threads (T1566.003-style measurement).
3. Time-to-report metric: join report timestamps with send timestamps for the response-latency curve per cohort.
4. Multi-lingo lure templates: per-cohort localization with the same marker discipline.
5. Integration: export reconciled rows into the campaigndb schema (M15) so awareness campaigns join the broader intelligence picture.

Detection — Defender View

Signal	Source	ID	Notes
Marked test messages [EMU ...]	Gateway/mail	header X-Emu-ID	Tag-and-close triage path
Unmarked messages during window	Gateway	gateway verdicts	Marking insufficiency finding
Office→script host from emulation	Sysmon	EID 1 lineage + 4104	M12 chain validation
Lure fetches in proxy	Proxy logs	URL with ?u=&t= markers	Click attribution
Report submissions	Reporting workflow	mailbox rule	Report-rate metric
Authorized VPN/OTP anomalies	Identity/VPN logs	4624 type 10 geo rules	Identity-control validation
Quarantine placement per token	Gateway export	per-token verdict	Delivery-rate metric
Endpoint silent passes	After-action	per-token	Detection backlog driver
Wazuh tagging of exercise events	HIDS/SIEM	[verify rule IDs per deployment]	Distinguish exercise from real
Maldoc dropped files (benign)	Sysmon	EID 11	Chain completeness check

Evasion Techniques

The emulation-to-real gap concentrates at the mail boundary, and adversaries attack it systematically — every gap your reconciliation finds is a technique they already rotate through. Infrastructure rotation: fresh sender domains per campaign defeat sender-reputation; your counter is measuring on your emulated rotation (the harness should occasionally emulate a brand-new sender domain to validate reputation-independent rules). Payload rotation: macro → XLM → DDE → LNK → OneNote waves defeat specific content rules — emulate one shape per exercise so each control class gets its turn under test. Thread hijacking (replying inside a real compromised thread) defeats content filters that trust established threads; emulation of this is delicate (it requires a real thread) — a lab-only variant with your own aged thread measures the control honestly. TDS-style gating shows scanners a blank page and users the lure; emulated redirects with UA/IP gates validate your proxy’s behavior precisely as M13 described. Marker-stripping is the adversary-shaped risk on the defensive side: if your marking is only in headers, some gateways strip it and your reconciliation silently misses rows — which is why the harness marks in four independent places and the reconciler accepts any of them. The meta-discipline: emulate the rotation, not just the technique — a program that tests the same shape every quarter measures only the control that shape happens to hit, and its green matrix says nothing about the wave that arrives next month.

⚠️ What caught me: our second awareness campaign was going cleanly until a forwarded test email landed in the inbox of an executive who wasn’t in the cohort — she saw a credential-phish-shaped page with no context, raised an incident, and the SOC spent an hour on a “live phishing attack” that was our own harness. The forward had stripped nothing — my marker was only in the URL, and she’d clicked from a cached short-link that dropped the query string. Since then: markers go in the page body itself (visible, un-strippable), every exercise briefing includes the “what if a test escapes” one-pager, and the harness refuses to run without the SOC’s acknowledgment logged. The escape cost us an hour; the fixes have saved dozens.

Lab Practice

1. Stand up the lab loop end-to-end: SMTP relay, two lab mailboxes, the harness sending two marked messages — verify all four marking layers survive relay and delivery (headers, subject, URL, body disclaimer).
2. Build the maldoc payload per M12’s harness shape and send it as an attachment; confirm the gateway’s sandbox verdict, then detonate on the lab endpoint and confirm the Office-lineage alert — the full T1566.001 measurement chain in one afternoon.
3. Run verdictmix.py with deliberately incomplete exports (gateway missing, clicks partial) and observe how the metrics degrade; then document the export requirements as your exercise runbook’s preflight checklist.
4. Emulate an authorized T1133 test: connect to the lab VPN from a lab account with an anomalous geo (VPN client + lab network address translation), and measure whether identity anomaly detection fires — the identity-side control most programs never test.
5. Run the escape drill: forward a marked message outside the cohort, then time how long it takes the SOC to identify it as a test using the markers alone — the number that tells you whether your marking system actually works.

Interview Questions

• Technical: What makes a phishing emulation payload “telemetry-shaped but capability-free”, and why is that property the safety boundary?
• Technical: Explain the four marking layers in the harness and why any single layer is insufficient for escape detection.
• Scenario: A forwarded test message escaped the cohort and raised a real incident. Walk through containment of the confusion and the permanent fixes.
• Conceptual: Why is report rate a leading indicator of human-control maturity, and what program conditions make it move?
• Conceptual: How does emulating one payload shape per exercise differ from testing “everything” — and which measurement is more honest?
• Deep-dive: Design the identity-side emulation (T1078/T1133) for an estate: which accounts, which anomalies, which detections, and what authorization does each require?
• Practical: Leadership asks for one number from this quarter’s exercise. Which do you give — delivery, click, report, or alert rate — and why does the answer depend on the audience?

Related Modules

T1 (ATT&CK Mapping & Emulation Planning) · T3 (Execution & Persistence Emulation) · M12 (Script and Macro Malware Analysis) · M13 (Delivery Chain Analysis) · BT2 (IDS Rules)