The goal of this diploma thesis is to prepare automated adversary cyber threat scenarios in MITRE CALDERA [1] organized according to the kill chain model using MITRE ATT&CK [2]. These scenarios should provide data that will be captured by Security Information and Event Management (SIEM) to allow evaluating threat modeling approaches. The work consists of the following subtasks:

1. Familiarize with Advanced Persistent Threats and their techniques, MITRE ATT&CK, MITRE CALDERA tool for emulation of adversary scenarios, and Wazuh SIEM [3]. Familiarize also with the current state of cybersecurity emulation.
2. Prepare evaluation environment and automated scenarios using cyber sandbox creator [4], vagrant, ansible, Wazuh SIEM, and MITRE CALDERA. It is possible to use also other tools.
3. Prepare detection rules for all techniques from these scenarios that cannot be automatically detected by Wazuh. Use log events for this purpose. All techniques from scenarios must be detected, and SIEM must contain the necessary captured data.
4. Configure human plugin from MITRE CALDERA so that benign human actions could be executed at the same time as adversary scenarios.

The scenarios should contain enough techniques from MITRE ATT&CK and the lateral movement tactic. Ideally, the scenarios must contain techniques from different MITRE ATT&CK tactics of the Enterprise matrix. The count of steps in scenarios should be realistic and the scenarios should not be artificially long. As a result, the diploma thesis should provide at least two different scenarios.

• [1] https://caldera.mitre.org/
• [2] https://attack.mitre.org/
• [3] https://wazuh.com/
• [4] https://gitlab.ics.muni.cz/muni-kypo-csc/cyber-sandbox-creator