# Laccolith: Hypervisor-Based Adversary Emulation with Anti-Detection

arXiv: https://arxiv.org/abs/2311.08274 · HTML: https://mlsanity.com/paper/2311.08274/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Nov 2023.

## Built on by (most cited first, 2 of 2)

- [Red Team Redemption: A Structured Comparison of Open-Source Tools for Adversary Emulation](https://mlsanity.com/paper/2408.15645/) (2024)
- [MITRE ATT&CK Applications in Cybersecurity and The Way Forward](https://mlsanity.com/paper/2502.10825/) (2025)

## Abstract (arXiv)

Advanced Persistent Threats (APTs) represent the most threatening form of attack nowadays since they can stay undetected for a long time. Adversary emulation is a proactive approach for preparing against these attacks. However, adversary emulation tools lack the anti-detection abilities of APTs. We introduce Laccolith, a hypervisor-based solution for adversary emulation with anti-detection to fill this gap. We also present an experimental study to compare Laccolith with MITRE CALDERA, a state-of-the-art solution for adversary emulation, against five popular anti-virus products. We found that CALDERA cannot evade detection, limiting the realism of emulated attacks, even when combined with a state-of-the-art anti-detection framework. Our experiments show that Laccolith can hide its activities from all the tested anti-virus products, thus making it suitable for realistic emulations.