Adversary Emulation Platforms
Open-source frameworks and tools designed to simulate real-world attacker behaviors for testing security defense systems.
Adversary Emulation Platforms
Find the best repos with AI.We'll search the best matching repositories with AI.
- guardicore/monkey
guardicore/monkey
7,014View on GitHubMonkey is an adversary emulation platform and breach and attack simulation tool designed to test network defenses through automated lateral movement and exploit delivery. It functions as a network security testing system that evaluates security posture by attempting to propagate through vulnerabilities and extract sensitive system credentials. The platform distinguishes itself by simulating specific real-world attacker behaviors, such as ransomware encryption, cryptojacking, and the theft of browser-stored credentials and secure shell keys. It utilizes binary hash randomization to evade antiv
Monkey is a dedicated adversary emulation platform that automates lateral movement and exploit delivery to validate defensive controls, directly aligning with the requirements for testing infrastructure against simulated cyberattacks.
PythonAttack SimulationsSecurity Control Validations - redcanaryco/atomic-red-team
redcanaryco/atomic-red-team
12,089View on GitHubAtomic Red Team is an adversary simulation tool and detection validation suite designed to emulate attacker behaviors. It functions as a security control testing framework that uses a library of portable tests to verify if security monitoring and alerting systems correctly identify specific malicious techniques. The project serves as a MITRE ATT&CK emulation framework, mapping individual test executions to a standardized industry taxonomy of adversary behaviors. This mapping allows for the validation of security controls against the MITRE ATT&CK matrix to identify gaps in detection and respon
This is a comprehensive framework for executing and validating security controls against specific adversary behaviors mapped to the MITRE ATT&CK framework, though it functions as a library of modular tests rather than a centralized, agent-based orchestration platform.
CAdversary EmulationAdversary EmulationAdversary Emulation Tools - datadog/stratus-red-team
DataDog/stratus-red-team
2,264View on GitHubThis tool provides a framework for executing targeted, cloud-native attack scenarios mapped to the MITRE ATT&CK framework, making it a specialized platform for validating defensive controls in cloud environments.
GoAdversary EmulationAdversary Emulation Tools - endgameinc/rta
endgameinc/RTA
1,096View on GitHubRTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
This framework provides a collection of scripts for executing simulated malicious tradecraft mapped to MITRE ATT&CK, serving as a practical tool for blue teams to validate their detection capabilities.
PythonAdversary EmulationAdversary Emulation - nextronsystems/aptsimulator
NextronSystems/APTSimulator
2,750View on GitHubA toolset to make a system look as if it was the victim of an APT attack
This toolset simulates the artifacts and behaviors of an APT attack on a local system to test defensive detection capabilities, fitting the core purpose of an adversary emulation platform.
BatchfileAdversary EmulationAdversary Emulation - uber-common/metta
uber-common/metta
1,140View on GitHubAn information security preparedness tool to do adversarial simulation.
Metta is an adversary emulation tool that uses Python-based scripts to execute simulated attack scenarios, providing a practical way to test defensive controls against specific threat behaviors.
PythonAdversary EmulationAdversary Emulation - mitre/caldera
mitre/caldera
7,047View on GitHubCaldera is an adversary emulation platform and command and control framework designed to simulate cyber attack patterns. It functions as an automated red team tool and threat framework orchestrator, executing attack sequences based on standardized cybersecurity threat frameworks to validate security defenses and detection capabilities. The platform distinguishes itself through the dynamic compilation of customized executable payloads and the use of framework-mapped adversary modeling to structure attack techniques. It manages asynchronous agents on targeted endpoints via a central server acce
Caldera is a comprehensive adversary emulation platform that natively maps attack techniques to the MITRE ATT&CK framework, utilizes agent-based execution for automated scenarios, and provides the necessary orchestration to validate defensive security controls.
PythonAdversary EmulationAdversary Emulation - funnywolf/viper
FunnyWolf/Viper
4,964View on GitHubViper is a command and control infrastructure manager and post-exploitation framework designed for adversary attack simulation and security assessment. It functions as an orchestrator for penetration testing, combining a system for managing compromised hosts across multiple operating systems with tools for security workflow automation. The platform is distinguished by its use of large language model agents to coordinate red team tasks, automate data processing, and provide intelligent decision support. It includes a network pivot visualizer that uses directional graphs to map relationships an
Viper is a post-exploitation and command-and-control framework that facilitates adversary simulation through AI-driven orchestration, serving as a functional tool for executing red team operations and testing defensive responses.
Attack SimulationsRed Team Workflow Automations - alphasoc/flightsim
alphasoc/flightsim
1,360View on GitHubA utility to safely generate malicious network traffic patterns and evaluate controls.
This tool focuses on generating specific malicious network traffic patterns to test security controls, but it functions as a targeted traffic simulator rather than a comprehensive adversary emulation platform that manages full attack playbooks and agent-based infrastructure.
GoAdversary EmulationAdversary Emulation - bishopfox/sliver
BishopFox/sliver
10,707View on GitHubSliver is a command and control framework designed for adversary emulation and security assessment operations. It provides a centralized platform for managing remote systems, enabling security professionals to coordinate multi-operator sessions and maintain persistent, secure communication channels across diverse network environments. The framework distinguishes itself through its focus on stealth and infrastructure flexibility. It utilizes dynamic payload obfuscation to generate unique binaries and supports in-memory execution to minimize disk artifacts. Communication is secured through mutu
Sliver is a command-and-control framework that provides the necessary infrastructure for adversary emulation and red team operations, though it focuses more on post-exploitation management than on pre-built automated attack playbooks.
GoAdversarial Testing Resources - rapid7/metasploit-framework
rapid7/metasploit-framework
38,415View on GitHubThe framework is a comprehensive penetration testing platform designed for the development, testing, and execution of security exploits. It serves as a research toolkit and automated assessment environment, enabling security professionals to identify and validate vulnerabilities within networked systems and infrastructure through repeatable, standardized procedures. The platform distinguishes itself through a modular architecture that supports reflective payload injection, allowing for the execution of code directly in memory without writing to disk. It utilizes an asynchronous event loop to
This is a comprehensive penetration testing framework that provides the modular architecture and exploit execution capabilities required to simulate attacks and validate defensive controls, though it focuses more on manual exploitation than automated adversary emulation playbooks.
RubyPenetration Testing PlatformsExploit FrameworksExploitation Frameworks
