At BSides Las Vegas 2025 I have run a hands-on workshop on threat and adversary emulation, in a lab with AV, web proxies, EDR and a SIEM in place.
We went from gathering usable threat intelligence to planning an emulation, running it with common tools and frameworks, mapping it to ATT&CK and hunting for it afterwards. By the end, everyone had built a custom emulation plan for their own organisation.