18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
Key Takeaways
- BAS (Caldera, Infection Monkey, Atomic Red Team) continuously or on-demand executes known TTPs to test whether controls detect or block them; a pentest is a time-boxed human-led engagement and is not the same thing.
- Atomic Red Team is a small, focused test of one MITRE ATT&CK technique — a unit check for a detection rule, not a campaign platform.
- Caldera is MITRE's adversary-emulation platform: agents, abilities, and chained TTP campaigns, not a single atomic and not Impacket.
- Infection Monkey is breach-and-spread simulation: how far a planted agent can propagate, used to test segmentation and east-west controls.
- BAS still needs written RoE; published MITRE tests do not authorize production runs, and Infection Monkey in particular can be noisy if spread is allowed.
The rest of PT0-003 4.10 is breach and attack simulation (BAS). CompTIA names three tools: Caldera, Infection Monkey, and Atomic Red Team. This is still a matching exam, plus one conceptual split that recycles on test day: BAS is not a penetration test. Domain 4 remains 35 percent of the exam. 18.1 matched PowerShell, Python, and Bash libraries to attack jobs. This section matches a BAS product to the size of the control test, then refuses to let BAS cancel RoE or cancel the pentest.
BAS versus a pentest
Breach and attack simulation continuously or on-demand executes known tactics, techniques, and procedures (TTPs) — usually mapped to MITRE ATT&CK — so the client can see whether controls detect or block them. The tests are repeatable. Yesterday's Atomic test can run again after an endpoint detection and response (EDR) tune. The goal is control validation: did the alert fire, did the allow-list hold, did segmentation stop the spread.
A penetration test is a time-boxed, human-led engagement. The tester uses judgment, chains findings unique to example.com, and looks for unknown paths the playbook did not list. A pentest can still use the 18.1 scripts. It is not a scheduled library of known TTPs. CompTIA is scoring whether you can tell those jobs apart when leadership says "we already simulate breaches."
When you pick BAS: the stem wants continuous or on-demand control testing, purple-team detection checks, or "did EDR see T1059.001." When you pick a pentest: the stem wants a scoped, time-boxed assessment that finds what the playbooks missed. Exam trap: "we installed Atomic Red Team, so we do not need a pentest." Trap two: "the pentest team should only run Caldera and never think." BAS and pentests complement. Neither one writes the other's report, and neither one cancels RoE.
Purple-team programs often run BAS beside the pentest: security engineering owns the repeatable tests, the security operations center (SOC) watches detections, and the pentest team still arrives for the engagement window. If the stem mixes those roles, name the activity first (control test versus human-led assessment), then name the tool.
Atomic Red Team: one MITRE technique
Atomic Red Team is a library of small tests, each mapped to one MITRE ATT&CK technique (and often a sub-technique). You run a single atomic — for example a test tagged to T1059.001 (PowerShell) — and you watch whether logging, EDR, or a SIEM rule fires. Scale is unit test. It is not a campaign. It is not a worm. It does not replace PowerView, Impacket, or a two-week SoW.
When you pick it: "test this one technique," "validate a detection rule," "small, focused ATT&CK test." When you do not: emulate a full adversary profile with chained abilities (Caldera), or ask how far a breach can propagate (Infection Monkey). Exam trap: calling Atomic Red Team an adversary-emulation platform. It is a test library. Trap two: calling every PowerShell script an Atomic test. 18.1 PowerSploit automation is still PowerShell attack scripting. Atomic Red Team is BAS, and only when the stem is a mapped MITRE unit check.
The report line for an atomic is boring on purpose: technique identifier, host, timestamp, whether the control fired. That is a detection-engineering artifact. It is not a pentest finding with CVSS, business impact, and a unique attack path through example.com.
Caldera: adversary emulation platform
Caldera (MITRE) is an adversary emulation platform. You deploy agents, select abilities (techniques), and run an adversary profile that can chain TTPs into a campaign. Operators schedule or trigger operations; the platform walks a playbook against in-scope hosts. Scale is campaign, not one atomic.
When you pick it: the stem says adversary emulation, automated campaign, agent-based platform, or MITRE Caldera. When you do not: a one-line test of a single technique (Atomic Red Team), or a worm-like "see how far we spread" (Infection Monkey). Exam trap: Caldera is not Impacket. It is not PowerSploit. It is not Scapy. Those automate a protocol or a module. Caldera orchestrates known adversary behaviors to test whether the blue team sees the chain. Trap two: treating Caldera as the pentest. A Caldera operation still executes known abilities. The pentest is still the human-led search for what the profile never encoded.
Caldera's agents need a place to run. That place must be in-scope. An agent on a kiosk is not permission to hop into payroll because the default profile includes a lateral-movement ability. Disable or constrain abilities the RoE forbids. 4.10 is matching the platform; Domain 1 still owns authorization.
Infection Monkey: breach-and-spread
Infection Monkey is a breach-and-spread simulation. After you plant the monkey (an agent) on an authorized starting host, it tries to propagate using known techniques to map how far a breach can go. The picture is ransomware-style or worm-style movement for segmentation and lateral-movement controls, not a written pentest report and not a single ATT&CK unit test.
When you pick it: "how far from this foothold," "test east-west spread," "breach-and-spread," "can a kiosk reach finance." When you do not: one ATT&CK unit test (Atomic Red Team), or a multi-technique adversary playbook platform (Caldera). Exam trap: Infection Monkey is not a malware sample you submit as a finding. It is a simulator the client authorizes. Trap two: treating spread as Domain 5 pivoting that the tester performs by hand. Domain 5 is the human-led movement after a pentest foothold. Infection Monkey is BAS asking whether controls contain an automated spread.
Infection Monkey is noisy when spread is allowed. It will touch more hosts than an atomic. That is the point of the product — and the reason RoE must name the start host, the stop conditions, and the VLANs that are off-limits. If finance is out of scope, do not plant a monkey whose job is to find finance.
Still need rules of engagement
BAS does not get a free pass because the tests are published. Running Atomic Red Team, Caldera, or Infection Monkey against production without written authorization is still unauthorized testing. RoE must name the systems, the window, the techniques that are allowed, and what is forbidden (for example, no production data destruction, no domain-wide worm). Infection Monkey in particular can touch many hosts if spread is allowed — that must be explicit.
Exam trap: "Atomic tests are MITRE, so they are always in scope." MITRE publishes the catalog. The client publishes the RoE. Trap two: "continuous BAS means we can run it any afternoon." Continuous still sits inside a standing authorization: named owners, named environments, named blast radius. A SoW that authorized a two-week pentest of the user VLAN did not silently authorize Infection Monkey on the SQL cluster.
| Tool | Job on 4.10 | Scale | Pick when the stem says | Exam trap |
|---|---|---|---|---|
| Atomic Red Team | Small test of one MITRE technique | Unit | One T-code, detection-rule check | Calling it a campaign platform |
| Caldera | Adversary emulation platform | Campaign | Agents, abilities, chained TTPs | Calling it Impacket or a worm |
| Infection Monkey | Breach-and-spread simulation | Propagation | How far can a breach go | Calling it the pentest |
| Pentest (not BAS) | Time-boxed human-led engagement | Engagement | Unknown paths, scoped assessment | Replacing it with Atomic tests |
Worked example.com BAS
example.com already booked a two-week pentest. Meanwhile the SOC wants to know whether the new EDR rule for PowerShell script-block logging fires. That is Atomic Red Team against one in-scope workstation, in a change window, with RoE that names that host. Leadership then asks whether a ransomware-like agent could reach the finance VLAN from a kiosk. That is Infection Monkey, only if RoE allows spread and names the start and stop points. A quarterly purple-team operation that chains several ATT&CK techniques through agents is Caldera. None of those three is the two-week pentest. If someone runs Infection Monkey on finance servers this afternoon because "BAS is continuous," and the statement of work never authorized it, that is an authorization failure — the same failure as an out-of-scope Nmap.
Leadership wants a continuous or on-demand program that executes known MITRE TTPs to see whether EDR and segmentation detect them. A two-week human-led pentest is already on the calendar. Which statement is exam-correct?
A purple team wants one small, focused test of MITRE ATT&CK T1059.001 to see if EDR fires, not a multi-technique campaign and not a worm-like spread. Which BAS tool matches?
The statement of work for example.com authorizes a time-boxed pentest but does not mention production BAS. An engineer wants to run Infection Monkey across finance servers this afternoon. What is the exam-correct constraint?