guardicore/monkey
Monkey
Monkey is an adversary emulation platform and breach and attack simulation tool designed to test network defenses through automated lateral movement and exploit delivery. It functions as a network security testing system that evaluates security posture by attempting to propagate through vulnerabilities and extract sensitive system credentials.
The platform distinguishes itself by simulating specific real-world attacker behaviors, such as ransomware encryption, cryptojacking, and the theft of browser-stored credentials and secure shell keys. It utilizes binary hash randomization to evade antivirus detection and employs relay-based traffic tunneling to bypass network firewalls.
The system includes a centralized command server for tracking simulation progress and visualizing the spread of adversarial agents across a network. Its capabilities cover network vulnerability assessment, security control validation, and the generation of security impact reports. To protect critical infrastructure, the platform incorporates target IP filtering to block interactions with specific subnets.
The project provides automated platform deployment scripts for operating system installation and supports binary packaging into container formats.
Features
- Adversary Emulation Frameworks - Functions as a platform for simulating realistic cyber attacks to evaluate network security controls.
- Lateral Movement - Simulates lateral movement across networks using stolen credentials and exploits to test security posture.
- Vulnerability Exploitation Frameworks - Uses a library of plugins to propagate through known network vulnerabilities and test security perimeters.
- Centralized Security Agents - Uses a central command server to manage agents and visualize the spread of the adversary.
- Attack Simulations - Mimics attacker behaviors including ransomware encryption and cryptojacking to identify visibility gaps and data leakage risks.
- Security Testing Tools - Evaluates security posture by attempting to propagate through vulnerabilities and extract sensitive system credentials.
- Vulnerability Assessment Frameworks - Identifies exploitable security gaps by automatically attempting to propagate through the network.
- Adversary Spread Visualizations - Ships a centralized command server for tracking simulation progress and reporting the spread of adversarial agents across a network.
- Adversarial Payload Execution - Runs malicious payloads on infected machines to test the depth and impact of a successful compromise.
- Traffic Tunneling - Routes agent communications through intermediate relays to bypass network firewalls.
- Attack Path Visualizations - Tracks simulation progress and reports agent activities through a command server to provide empirical security data.
- Cryptojacking Simulations - Deploys mining payloads to simulate the presence and resource consumption of cryptocurrency malware.
- Credential Extraction Utilities - Provides specialized collectors to extract browser credentials and SSH keys from targeted systems.
- Ransomware Impact Analysis - Simulates ransomware deployment to identify which files and systems are vulnerable to encryption.
- Security Software Evasion - Randomizes binary hashes and masquerades files to bypass antivirus and endpoint detection systems.
- Security Control Validations - Tests if antivirus and detection systems can identify and block malicious payloads and unauthorized agent activity.
- Security Report Generation - Produces detailed reports on ransomware impact and network security posture based on simulation data.
- Binary Signature Modifiers - Modifies binary signatures and file metadata to evade antivirus and security monitoring tools.
- Plugin Execution Engines - Employs a modular system of interchangeable plugins to execute attack simulations and vulnerability tests.
- Threat Simulation Tools - Breach and attack simulation tool for cloud environment resiliency.
- Malware And Defense Emulation - Tool for testing network segmentation and lateral movement.
- Security And Forensics - Tool for testing datacenter resiliency against internal breaches.
- Web Security Testing - Tool for semi-automated network penetration testing.
