Adversary Emulation Platforms
For an adversary emulation toolkit, the strongest matches are mitre/caldera (Caldera is exactly the adversary emulation platform you're looking), guardicore/monkey (Guardicore Monkey is an adversary emulation platform that systematically) and cloud-architekt/azuread-attack-defense (This repository provides Azure AD attack scenarios and MITRE). ne0nd0g/merlin and sigmahq/sigma round out the shortlist. Each is ranked by relevance to your query, popularity and recent activity.
Open-source frameworks and tools designed to simulate real-world attacker behaviors for testing security defense systems.
Adversary Emulation Platforms
Find the best repos with AI.We'll search the best matching repositories with AI.
- mitre/caldera
mitre/caldera
7,047View on GitHubCaldera is an adversary emulation platform and command and control framework designed to simulate cyber attack patterns. It functions as an automated red team tool and threat framework orchestrator, executing attack sequences based on standardized cybersecurity threat frameworks to validate security defenses and detection capabilities. The platform distinguishes itself through the dynamic compilation of customized executable payloads and the use of framework-mapped adversary modeling to structure attack techniques. It manages asynchronous agents on targeted endpoints via a central server acce
Caldera is exactly the adversary emulation platform you're looking for — it automates attack campaigns mapped to MITRE ATT&CK, uses agent-based deployment, and generates detection reports, making it a comprehensive tool for security validation and red teaming.
PythonCommand and Control PlatformsAdversary Emulation FrameworksAdversary Technique Mappings - guardicore/monkey
guardicore/monkey
7,014View on GitHubMonkey is an adversary emulation platform and breach and attack simulation tool designed to test network defenses through automated lateral movement and exploit delivery. It functions as a network security testing system that evaluates security posture by attempting to propagate through vulnerabilities and extract sensitive system credentials. The platform distinguishes itself by simulating specific real-world attacker behaviors, such as ransomware encryption, cryptojacking, and the theft of browser-stored credentials and secure shell keys. It utilizes binary hash randomization to evade antiv
Guardicore Monkey is an adversary emulation platform that systematically simulates real-world attacker behaviors—lateral movement, credential theft, ransomware—using automated campaigns and evasion techniques, making it a direct fit for your red teaming and breach-and-attack simulation needs.
PythonAdversary Emulation FrameworksAttack SimulationsCentralized Security Agents - cloud-architekt/azuread-attack-defense
Cloud-Architekt/AzureAD-Attack-Defense
2,471View on GitHubThis repository provides Azure AD attack scenarios and MITRE ATT&CK mappings, but it is a collection of reference guides and detection patterns rather than a self-contained adversary emulation platform with automated campaign execution and agent-based deployment.
PowerShellMITRE ATT&CK AnalysisAttack Scenario MappingsCommon Attack Scenarios - ne0nd0g/merlin
Ne0nd0g/merlin
5,555View on GitHubMerlin is a cross-platform command and control framework and remote access tool. It provides a server and agent system for post-exploitation coordination, utilizing an HTTP/2 framework for secure communication and the execution of commands across multiple operating systems. The project features an in-memory code execution engine that runs assemblies and shellcode directly within a process to avoid writing files to disk. It implements a decentralized communication architecture through a peer-to-peer network, allowing agents to exchange data via direct bind or reverse connections. To evade det
Merlin is a command and control (C2) framework for post-exploitation, not a breach and attack simulation platform that orchestrates adversary emulation with MITRE ATT&CK technique libraries and automated campaigns — it lacks the core simulation and reporting capabilities needed for this search.
GoC2 AgentsNetwork Traffic ObfuscatorsC2 Frameworks - sigmahq/sigma
SigmaHQ/sigma
10,136View on GitHubSigma is a suite of tools for defining generic log signatures and translating them for multiple backends. It provides a structured way to define malicious behavior and detection logic independently of any specific backend technology, acting as a translation engine that maps generic event fields and correlation logic to the proprietary query languages of security data lakes and SIEM platforms. The project features a plugin-based multi-backend query generator that exports security detections into various database and log management formats. It also includes a threat framework mapping tool that
Sigma is a detection rule format and translation engine for SIEM queries, not a platform that simulates adversary tactics or executes attack campaigns — it helps detect attacks, not emulate them.
PythonSIEMDetection Coverage Heatmaps - n1nj4sec/pupy
n1nj4sec/pupy
8,942View on GitHubPupy is a command and control framework and post-exploitation suite used for remote administration and system management. It functions as a cross-platform tool for deploying payloads and controlling multiple remote agents through encrypted communication channels. The framework features a multi-platform payload generator that creates custom executable files using configurable network launchers. It employs a network traffic obfuscator that stacks encryption and obfuscation protocols to hide communication from observation. The system provides capabilities for in-memory code execution, remote pr
Pupy is a command and control framework and post-exploitation suite used for remote administration and controlling agents, which is a red-team tool but not an adversary emulation platform that systematically simulates attack techniques, models MITRE ATT&CK, or provides automated campaign execution and detection reporting.
PythonEvasive Payload GeneratorsNetwork Traffic Obfuscators - screetsec/thefatrat
screetsec/TheFatRat
11,038View on GitHubTheFatRat is a security exploitation framework designed to automate the creation, obfuscation, and deployment of payloads for penetration testing. It functions as a comprehensive toolkit that streamlines the exploitation lifecycle, enabling users to generate malicious executables, manage network listeners, and execute post-exploitation tasks through a unified command-line interface. The framework distinguishes itself by integrating various third-party exploitation utilities into a single, orchestrated workflow. It provides specialized capabilities for embedding code into legitimate binaries a
TheFatRat automates payload creation and exploitation for penetration testing, but it does not provide systematic adversary emulation with MITRE ATT&CK libraries, automated campaigns, or detection reporting — it is a lower-level exploitation tool rather than a full breach and attack simulation platform.
CEvasive Payload Generators - mukul975/anthropic-cybersecurity-skills
mukul975/Anthropic-Cybersecurity-Skills
19,327View on GitHub817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
This repo provides structured cybersecurity skills mapped to MITRE ATT&CK for AI agents to use in tasks like threat hunting, but it is a skill library for AI assistants—not a platform that executes automated adversary campaigns, deploys agents, or produces detection reports.
PythonMITRE ATT&CK Analysis - powershellempire/empire
PowerShellEmpire/Empire
7,843View on GitHubEmpire is a post-exploitation framework and command and control server designed to manage remote access agents. It provides a centralized system for coordinating these agents and executing specialized scripts across target systems. The project functions as a security evasion tool by adapting network communication patterns to bypass firewalls and monitoring tools. It utilizes a multi-language agent runtime and a modular plugin architecture to execute payloads across different operating systems. The framework covers a broad range of operational capabilities, including remote agent orchestratio
Empire is a real-world post-exploitation and C2 framework for offensive operations, not a simulation platform that systematically models adversary TTPs with a MITRE ATT&CK library or automated campaign execution for breach-and-attack simulation.
PowerShellNetwork Traffic Obfuscators - wangyu-/udp2raw
wangyu-/udp2raw
8,505View on GitHubudp2raw is a network tunneling tool designed to bypass firewalls and obfuscate UDP traffic. It wraps UDP packets in alternative headers and utilizes raw socket networking to move data through networks that otherwise block or throttle UDP traffic. The project distinguishes itself by simulating TCP connections, mimicking the three-way handshake and sequence numbering to trick firewalls into treating UDP streams as TCP traffic. It further stabilizes these connections through heartbeat-driven port rotation, which automatically switches ports to recover sessions after detected failures. The tool
This is a firewall-bypassing network tunneling tool, not a full adversary emulation platform with MITRE ATT&CK libraries, automated campaigns, or integrated detection reporting.
C++Network Traffic Obfuscators - mandiant/capa
mandiant/capa
6,062View on GitHubcapa is a binary capability scanner that identifies high-level behaviors and actions an executable can perform, such as network communication or file manipulation. It functions as a malware behavior analysis tool and a MITRE ATT&CK mapping framework, scanning PE, ELF, .NET, and shellcode files through both static analysis and dynamic sandbox report processing. The tool distinguishes itself through a YAML-based detection rule engine that defines detection logic in human-readable files, with conditions expressed as feature combinations and logical operators. It integrates with IDA Pro, Ghidra,
capa is a binary capability scanner that maps behaviors to MITRE ATT&CK techniques, but it is a static analysis tool for malware samples rather than a platform that simulates real adversary campaigns or deploys agents for red teaming.
PythonMITRE ATT&CK Analysis - byt3bl33d3r/offensivenim
byt3bl33d3r/OffensiveNim
3,033View on GitHubOffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje
OffensiveNim is a red teaming toolkit for building custom implants and evasion techniques, but it lacks the structured attack library, automated campaign orchestration, and reporting integration that define an adversary emulation platform.
NimEvasion Techniques
