Legacy Haven University

Mission Objectives

Welcome to the Breach & Attack Simulation (BAS) validation lab. In this exercise, you will configure MITRE Caldera with the AI-Driven ‘AutoPath’ plugin to simulate a cyber attack campaign and validate your endpoint detection and response (EDR) telemetry.

Lab Execution Steps

Step 1: Start the Caldera Server

1. Open the Terminal window from your lab desktop taskbar.
2. Navigate to the Caldera installation directory by entering the following command:cd /opt/caldera
3. Start the Caldera server by running:python3 server.py --insecure
4. Wait for the terminal to display [+] Caldera Server Active at http://localhost:8888 before proceeding.

Step 2: Access the Caldera Interface

1. Open the Secure Browser window from the taskbar.
2. In the URL bar at the top, enter the following address and press Enter: http://localhost:8888

Step 3: Log In

1. Once the MITRE Caldera login screen loads, authenticate using the default lab credentials:
   • Username: red
   • Password: admin
2. Click Log In to access the main dashboard.

Step 4: Deploy the Target Agent

1. Using the left-hand navigation sidebar, click on Agents.
2. Under the “Deploy an Agent” section, ensure Sandcat (54ndc47) is selected in the dropdown menu.
3. Click the Generate Deployment Cradle button.
4. Wait a few seconds for the agent to initialize and communicate with the server. You should see WIN-DESKTOP-01 pop up under the “Active Agents” list.

Step 5: Run the AutoPath Operation

1. Click on Operations in the left-hand navigation sidebar.
2. In the “Start New Operation” section, change the adversary profile in the dropdown menu to AutoPath AI Simulation.
3. Click the Run Operation button.
4. Watch the execution log output as the AI simulation evaluates target defenses, attempts evasion, and tries lateral movement.
5. Once the operation logs display [*] OP COMPLETE, click the green View Final Report button that appears.

Post-Lab Analysis

After completing the simulation, review the Executive Debrief in the final report. Pay special attention to the AI Planner Insights and map the executed TTPs (such as Discovery T1033 and Windows Remote Management T1021.006) to ensure your simulated SIEM rules are properly detecting adaptive threats.