Awesome GitHub RepositoriesAdversary Simulation

Atomic Red Team is an adversary simulation tool and detection validation suite designed to emulate attacker behaviors. It functions as a security control testing framework that uses a library of portable tests to verify if security monitoring and alerting systems correctly identify specific malicious techniques. The project serves as a MITRE ATT&CK emulation framework, mapping individual test executions to a standardized industry taxonomy of adversary behaviors. This mapping allows for the validation of security controls against the MITRE ATT&CK matrix to identify gaps in detection and respon

Caldera is an adversary emulation platform and command and control framework designed to simulate cyber attack patterns. It functions as an automated red team tool and threat framework orchestrator, executing attack sequences based on standardized cybersecurity threat frameworks to validate security defenses and detection capabilities. The platform distinguishes itself through the dynamic compilation of customized executable payloads and the use of framework-mapped adversary modeling to structure attack techniques. It manages asynchronous agents on targeted endpoints via a central server acce

Covenant 是一个基于 .NET 的命令与控制（C2）框架，专为红队行动和对抗模拟而设计。它作为一个协作平台，用于协调安全评估、管理远程植入物，并通过中央服务器在受损系统上执行任务。 该项目的特色在于其动态载荷生成器，可即时编译和混淆可执行二进制文件及脚本以绕过检测。它通过一个协作环境进一步脱颖而出，该环境允许多个经过身份验证的操作员共享同步状态、跟踪操作指标，并在单个界面内管理联合行动。 该框架提供了广泛的流量混淆功能，包括使用自定义网络配置文件、数据转换流水线以及基于网桥的协议转换来掩盖通信。它还涵盖了后渗透需求，如远程文件检索、集中式凭据收集，以及使用插件扩展模型开发自定义远程任务模块。 该系统使用 SSL 证书固定和加密密钥交换来保护服务器与代理之间的通信，以确保前向安全性。

Apfell 是一个红队框架和命令与控制服务器，专为协作式对抗模拟而设计。它提供了一个集中式基础设施来管理远程代理，并使用消息代理在多个操作系统之间分发任务以实现实时同步。 该系统作为一个分布式代理编排器，允许团队协调复杂的攻击链并同步容器数据。它具有多平台载荷管理器，支持从远程仓库下载和集成自定义代理及命令配置文件。 该平台涵盖对抗模拟管理、分布式命令控制以及使用模块化命令配置来在不同目标环境中保持一致的执行行为。

该项目是用于构建具有韧性和隐蔽性的红队基础设施的技术资源、蓝图和指南集合。它提供了一个全面的框架，用于设计能够抵御检测并在整个安全参与过程中保持运行的攻击性安全环境。 该存储库通过详细的对手模拟剧本和加固手册脱颖而出。它涵盖了高级混淆技术，如域名伪装 (domain fronting)、使用平台即服务 (PaaS) 重定向器，以及利用第三方内容站点来继承域名声誉并规避安全过滤器。 技术层面扩展到操作安全自动化，包括跨多个云提供商和地理区域的基础设施资产分发。它涵盖了通过中间人代理进行凭据捕获、集中式日志聚合以及实施不可变系统文件加固以保护操作服务器的功能。 该项目还包括用于域名分析的工具，例如验证供应商分类和识别信誉良好的过期域名，以便更好地融入目标网络。

Triton is a dynamic binary analysis framework designed to automate reverse engineering. It functions as a multi-architecture CPU emulator, an SMT-based symbolic execution engine, and a dynamic taint analysis tool. The framework translates raw machine instructions into abstract syntax trees, allowing it to represent binary program logic as a structured intermediate representation. This allows the system to map multiple hardware instruction sets to a single analysis framework and translate machine instructions into mathematical formulas for solving constraints. Its capabilities cover the simul

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.

A toolset to make a system look as if it was the victim of an APT attack

####

A utility to safely generate malicious network traffic patterns and evaluate controls.

Virtual Machine for Adversary Emulation and Threat Hunting

An information security preparedness tool to do adversarial simulation.

RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.

"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.

Automated Attack Simulation in the Cloud, complete with detection use cases.

Table of contents

Synthetic Adversarial Log Objects (SALO) is a framework for the generation of log events without the need for infrastructure or actions to initiate the event that causes a log event. The purpose of this framework is to allow security practitioners, data scientists, and researchers the ability to…