racketeer

Racketeer Project - Ransomware simulation toolkit The goal of this project is to provide a way for teams to simulate and test detection of common ransomware operation, in a controlled manner, against a set of company assets and network endpoints. Deployment model The Racketeer toolkit operates on...

Invoke-Obfuscation

Invoke-Obfuscation v1.8 Introduction Invoke-Obfuscation is a PowerShell v2.0+ compatible PowerShell command and script obfuscator. Background In the Fall of 2015 I decided to begin researching the flexibility of PowerShell's language and began cataloguing the various ways to accomplish a handful ...

threatest

Threatest Threatest is a CLI and Go framework for testing threat detection end-to-end. Threatest allows you to detonate an attack technique, and verify that the alert you expect was generated in your favorite security platform. Read the announcement blog post:...

dorothy

Created by David French @threatpunter at Elastic Security Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and...

MalwLess

MalwLess Simulation Tool MST MalwLess is an open source tool that allows you to simulate system compromise or attack behaviours without running processes or PoCs. The tool is designed to test Blue Team detections and SIEM correlation rules. It provides a framework based on rules that anyone can...

Log4J-Log4Shell-CVE-2021-44228-Spring-Boot-Test-Service

CVE-2021-44228 Spring Boot Test Service This is a dirty hack spring boot hello world proejct to test your tooling/payloads/detection capabilities locally before you hit production targets with them. The configured Log4j version is 2.13.0 Building the docker image bash build.sh Running the docker...

EVTX-ATTACK-SAMPLES

Windows EVTX Samples 200 EVTX examples: This is a container for windows events samples associated to specific attack and post-exploitation techniques. Can be useful for: Testing your detection scripts based on EVTX parsing Training on DFIR and threat hunting using event logs Designing detection u...

RedTeamCoin

RedTeamCoin RedTeamCoin is a blockchain-based cryptocurrency mining pool implementation designed for authorized security testing and red team operations. Built in Go with Java client support, it simulates real-world cryptomining attacks to help organizations assess their detection capabilities an...

RTA

Red Team Automation RTA RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK. RTA is composed of python scripts that generate evidence of over 50 different ATT&CK tactics, as well as a compil...

ludus-defender-lab

Ludus Defender Lab Ludus range config and Ansible roles for a Windows security lab pre-staged for MDE and MDI, with a fully misconfigured ADCS installation for detection coverage testing. Config| VMs| Purpose ---|---|--- zsec-mde-mdi-lab.yml| DC01 + WKS01| MDE/MDI detection lab with ADCS ESC1–ESC...

magnet

Magnet Draw the Signals, Detect the Threats. Abstract Magnet is Purple-team telemetry & simulation toolkit. Purpose: modular, cross-platform eventually generator for telemetry and malicious activity. Why the name? Because this attracts SOC analysts and detection rules! 😜 As a secondary use case,...

VECTR

VECTR documentation: https://docs.vectr.io VECTR Community Discord Channel: https://discord.gg/2FRd8zf728 VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios. VECTR provides the...

VeilTransfer

VeilTransfer 2.0 VeilTransfer is a data exfiltration utility designed to test and enhance detection capabilities. This tool simulates real-world data exfiltration techniques used by advanced threat actors, allowing organizations to evaluate and improve their security posture. By leveraging multip...

doublepulsar-usermode-injector

Author: Matt Hillman [email protected] - @sp1nl0ck Company: Countercept @countercept Website: https://countercept.com A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or...

PurpleSharp

PurpleSharp Defending enterprise networks against attackers continues to present a difficult challenge for blue teams. Prevention has fallen short; improving detection & response capabilities has proven to be a step in the right direction. However, without the telemetry produced by adversary...

Empire

Invoke-Obfuscation v1.8 Introduction Invoke-Obfuscation is a PowerShell v2.0+ compatible PowerShell command and script obfuscator. Background In the Fall of 2015 I decided to begin researching the flexibility of PowerShell's language and began cataloguing the various ways to accomplish a handful ...

attack_range

Splunk Attack Range v5 El Splunk Attack Range construye entornos cloud instrumentados AWS, Azure, GCP, simula ataques y reenvía datos a Splunk para el desarrollo y pruebas de detección. Qué hace: Construye laboratorios — Despliega un laboratorio pequeño y similar a producción Splunk, servidores...

exfilkit

exfilkit Utilidad de exfiltración de datos para probar capacidades de detección Descripción Utilidad de exfiltración de datos utilizada para probar capacidades de detección de productos de seguridad. Obviamente solo con fines legales. Cómo exfiltrar /etc/shadow - Solicitudes HTTP GET Servidor...

brawl-public-game-001

BRAWL Uno de los problemas desafiantes para los investigadores de ciberseguridad que desarrollan capacidades de detección y respuesta es encontrar un entorno realista para probar sus hipótesis y capacidades. El método más económico es probar capacidades en una pequeña red de laboratorio. Pero est...

chain-reactor

Chain Reactor Chain Reactor es una herramienta de código abierto para probar la cobertura de detección y respuesta en máquinas Linux. La herramienta genera ejecutables que simulan secuencias de acciones como la creación de procesos y la conexión de red. Chain Reactor no asume experiencia previa e...