sliver

Sliver Sliver is an open-source, cross-platform adversary emulation and red team framework designed for organizations of all sizes to perform authorized security testing. Sliver implants support command-and-control C2 over Mutual TLS mTLS, WireGuard, HTTPS, and DNS. Implants are dynamically...

atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

brawl-public-game-001

BRAWL One of the challenging problems for cyber security researchers developing detection and response capabilities is finding a realistic environment in which to test their hypothesis and capabilities. The cheapest method is to test capabilities on a small lab network. But this environment is...

ATTPwn

ATTPwn / || || || | || || \ | o || || || o | | || | | ||| |||| ||| /| | | || | | | | | | | | | | | ' || | | | | | | | | | | | \ / | | | ||| || || || // ||| ATTPwn is a computer security tool designed to emulate adversaries. The tool aims to bring emulation of a real threat into closer contact...

AWS-Threat-Simulation-and-Detection

AWS Threat Detection with Stratus Red Team This repository is a documentation of my adventures with Stratus Red Team - a tool for adversary emulation for the cloud. Stratus Red Team is "Atomic Red Team for the cloud, allowing to emulate offensive attack techniques in a granular and self-contained...

caldera

Caldera™ Caldera™ is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response. It is built on the MITRE ATT&CK™ framework and is an active research project at MITRE. The framework consists of two components: 1. The core...

EasyTokens

EasyTokens A device-code phishing server for adversary emulation. Captures Microsoft 365 OAuth tokens via the Device Authorization Grant flow. Inspired by GraphSpy. Warning — Authorized Use Only. This tool is intended for penetration testers and red teamers operating under explicit written...

agent-opfor

Open-source adversary emulation for AI agents, LLM apps, and MCP servers. Test your AI like a real attacker would — from your CLI, your IDE, or a browser extension that anyone on your team can use. Website · Docs · GitHub · Browser Extension · Discord OPFOR is short for Opposition Force — a...

RedHunt-OS

RedHunt Linux Distribution VM v2 Virtual Machine for Adversary Emulation and Threat Hunting by RedHunt Labs RedHunt OS aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats...

presentations

Презентации Кристофера Пикока Год| Организация| Название доклада| Слайды| Видео ---|---|---|---|--- 2023| BSides Tampa| Введение в Purple Team| Слайды| 2022| SANS PenTest HackFest 2022| На передовой: Purple Team — что делать и чего не делать| Слайды| YouTube 2022| BSides St Petersburg| Пирамида...

adversary_emulation_library

Библиотека имитации действий противника В сотрудничестве с участниками Центра Центр MITRE по защите, основанной на данных об угрозах Center поддерживает библиотеку планов имитации действий противника, позволяющую организациям оценивать свои оборонительные возможности против реальных угроз, с...

red-team-scripts

Red Team Scripts Коллекция инструментов, скриптов, техник и заметок, связанных с red teaming и эмуляцией действий злоумышленника. Создано исключительно в образовательных целях; не используйте в незаконных целях...

offensive-security-adversary-emulation

Проект 5 — Наступательная безопасность и эмуляция противника Часть серии из 5 проектов домашней лаборатории SOC: создание → обнаружение и обогащение → расследование → мониторинг и охота → атака и перекрёстная проверка. Этот проект добавляет недостающую половину картины из проектов 1–4: всё, что...

dod-blue-team-network-lab

DoD Blue Team Network Security & Hardening Lab Executive Summary High fidelity defensive security lab simulating a DoD aligned enterprise network. This project demonstrates structured network segmentation, system hardening, centralized telemetry ingestion, detection engineering, adversary...

caldera-agent

Агент CALDERA Папка calderaagent содержит исходный код агента CALDERA или cagent — службы Windows, которая обеспечивает связь между сервером CALDERA и Rat-агентами CALDERA. Программа cagent должна быть установлена на каждом компьютере, участвующем в операции эмуляции действий противника. После...

RedTeamSimmer

RedTeamSimmer Интерфейс, о котором вы всегда мечтали для Atomic Red Team Веб-платформа эмуляции противника и оркестрации тестов Atomic Red Team. Обзор RedTeamSimmer — это открытая веб-платформа эмуляции противника, предоставляющая современный интерфейс для оркестрации тестов Atomic Red Team в...

Empire v7.0.2

Empire Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server...

AutoSUT: The Environment Semantics Gap in Structured CTI for Adversary Emulation

Structured Cyber Threat Intelligence CTI is increasingly used for adversary emulation, detection evaluation, and cyber range design. However, these workflows still require a target System Under Test SUT whose environment is not fully described by public CTI. We measure how much of that environmen...

Autonomous Adversary: Red-Teaming in the Age of LLM

Language Model Agents LMAs are emerging as a powerful primitive for augmenting red-team operations. They can support attack planning, adversary emulation, and the orchestration of multi-step activity such as lateral movement, a core enabling capability of advanced persistent threat APT campaigns...

Bounty Hunter: Autonomous, Comprehensive Emulation of Multi-Faceted Adversaries

Adversary emulation is an essential procedure for cybersecurity assessments such as evaluating an organization's security posture or facilitating structured training and research in dedicated environments. To allow for systematic and time-efficient assessments, several approaches from academia an...