├── ADVERSARY EMULATION MATRIX by Joas.pdf ├── ADVERSARY EMULATION MATRIX by Joas.png ├── ADVERSARY EMULATION MATRIX by Joas.xlsx ├── ADVERSARY EMULATION MATRIX by Joas.xmind └── README.md /ADVERSARY EMULATION MATRIX by Joas.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/CyberSecurityUP/Adversary-Emulation-Matrix/fb97d7968ee7023ab5de7adbc1b1f0058907bf6f/ADVERSARY EMULATION MATRIX by Joas.pdf -------------------------------------------------------------------------------- /ADVERSARY EMULATION MATRIX by Joas.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/CyberSecurityUP/Adversary-Emulation-Matrix/fb97d7968ee7023ab5de7adbc1b1f0058907bf6f/ADVERSARY EMULATION MATRIX by Joas.png -------------------------------------------------------------------------------- /ADVERSARY EMULATION MATRIX by Joas.xlsx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/CyberSecurityUP/Adversary-Emulation-Matrix/fb97d7968ee7023ab5de7adbc1b1f0058907bf6f/ADVERSARY EMULATION MATRIX by Joas.xlsx -------------------------------------------------------------------------------- /ADVERSARY EMULATION MATRIX by Joas.xmind: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/CyberSecurityUP/Adversary-Emulation-Matrix/fb97d7968ee7023ab5de7adbc1b1f0058907bf6f/ADVERSARY EMULATION MATRIX by Joas.xmind -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ADVERSARY EMULATION MATRIX by Joas 2 | 3 | ## What is? 4 | 5 | ### Adversary emulation is a type of red team engagement that mimics a known threat to an organization by blending in threat intelligence to define what actions and behaviors the red team uses. This is what makes adversary emulation different from penetration testing and other forms of red teaming. Adversary emulators construct a scenario to test certain aspects of an adversary’s tactics, techniques, and procedures (TTPs). The red team then follows the scenario while operating on a target network in order to test how defenses might fare against the emulated adversary. 6 | 7 | - https://medium.com/mitre-attack/getting-started-with-attack-red-29f074ccf7e3 8 | - https://attack.mitre.org/resources/adversary-emulation-plans/ 9 | - https://www.nviso.eu/en/service/21/adversary-emulation#:~:text=Adversary%20emulation%20aims%20to%20test,targets%20in%20a%20continuous%20fashion. 10 | - https://www.dxc.technology/security/insights/147214-adversary_emulation_measure_your_ability_to_detect_attackers 11 | - https://www.scythe.io/library/introduction-to-adversary-emulation 12 | - https://www.cybereason.com/blog/what-are-adversary-emulation-plans 13 | - https://hackerculture.com.br/?p=1047 14 | - https://depthsecurity.com/assessments/adversary-emulation 15 | - https://obscuritylabs.com/adversary-emulation/ 16 | - https://av.tib.eu/media/49170 17 | 18 | ## Training 19 | 20 | ### https://www.sans.org/cyber-security-courses/red-team-exercises-adversary-emulation/ 21 | 22 | ### https://academy.attackiq.com/ 23 | 24 | ### https://cybrary.it/ 25 | 26 | ### http://pluralsight.com/ 27 | 28 | ### https://codered.eccouncil.org/ 29 | 30 | ### https://www.eccouncil.org/ 31 | 32 | ### http://elearnsecurity.com/ 33 | 34 | ### https://www.comptia.org/ 35 | 36 | ### https://www.pentesteracademy.com/ 37 | 38 | ## Adversary Emulation - Practice 39 | 40 | ### https://medium.com/mitre-engenuity/introducing-the-all-new-adversary-emulation-plan-library-234b1d543f6b 41 | 42 | ### https://pt.slideshare.net/erikvanbuggenhout/adversary-emulation-using-caldera 43 | 44 | ### https://pt.slideshare.net/erikvanbuggenhout/adversary-emulation-using-caldera-232232038 45 | 46 | ### https://www.youtube.com/watch?v=fx3635hLewg 47 | 48 | ### https://www.youtube.com/watch?v=xjDrWStR68E 49 | 50 | ### https://www.youtube.com/watch?v=iXGF6GHEQps 51 | 52 | ### https://www.youtube.com/watch?v=qy6RqCPLV8Y 53 | 54 | ### https://www.youtube.com/watch?v=3tNrlutqazQ 55 | 56 | ### https://www.youtube.com/watch?v=gOS1c375Hbg 57 | 58 | ### https://www.youtube.com/watch?v=5CRSh5V0s-A 59 | 60 | ### https://www.youtube.com/watch?v=r_PMfojuXLo 61 | 62 | ### https://www.youtube.com/watch?v=d6AueWjUHfA 63 | 64 | ### https://www.youtube.com/watch?v=Fa4GHF_OVVc 65 | 66 | ### https://www.youtube.com/watch?v=YMTlrjkbZHM 67 | 68 | ### https://www.youtube.com/watch?v=isYotlCFxf8 69 | 70 | ### https://www.youtube.com/watch?v=RSMJsyACSm8 71 | 72 | ### https://www.youtube.com/watch?v=igikBwKImWA 73 | 74 | ### https://www.youtube.com/watch?v=7WUDnFleC5Y 75 | 76 | ### https://www.youtube.com/watch?v=bEzxyijPkSI 77 | 78 | ### https://www.youtube.com/watch?v=6elZxGmXxH4 79 | 80 | ### https://www.youtube.com/watch?v=hIGbgm-HlZA 81 | 82 | ### https://www.youtube.com/watch?v=0lE5oHqZV0s 83 | 84 | ### https://blog.reconinfosec.com/adversary-emulation-mapping/ 85 | 86 | ## Jorge Orchilles 87 | 88 | 89 | ### https://medium.com/@jorgeorchilles/purple-team-exercise-tools-a85187ce341 90 | 91 | ### https://twitter.com/jorgeorchilles 92 | 93 | ### https://orchilles.com/ 94 | 95 | ### https://www.youtube.com/jorgeorchilles 96 | 97 | ### https://www.youtube.com/watch?v=BDzw9cGEJos 98 | 99 | ### https://www.youtube.com/watch?v=YkgBNkh_wtw 100 | 101 | ### https://www.youtube.com/watch?v=qPqlz75lzwo 102 | 103 | ### https://www.youtube.com/watch?v=sRaLleKghrE 104 | 105 | ### https://www.youtube.com/watch?v=TelqSCdwi10 106 | 107 | ### https://github.com/jorgeorchilles 108 | 109 | ## Purple Team 110 | 111 | ### https://www.youtube.com/watch?v=iE0CgG0MAH4 112 | 113 | ### https://www.youtube.com/watch?v=rwOh9MC0M7E 114 | 115 | ### https://www.youtube.com/watch?v=WOf2U01RhCk 116 | 117 | ### https://www.youtube.com/watch?v=SA-HeOnOi2A 118 | 119 | ### https://www.youtube.com/watch?v=GRTa7HfJC6w 120 | 121 | ### https://www.youtube.com/watch?v=jvXRAbYYE0U 122 | 123 | ### https://www.youtube.com/watch?v=o3Qb_0clIpg 124 | 125 | ### https://www.youtube.com/watch?v=0CdFK0qBZZc 126 | 127 | ### https://www.youtube.com/watch?v=m3mpnUcSpa4 128 | 129 | ### https://danielmiessler.com/study/red-blue-purple-teams/ 130 | 131 | ### https://www.sans.org/purple-team 132 | 133 | ### https://github.com/praetorian-inc/purple-team-attack-automation 134 | 135 | ### https://www.packetlabs.net/mitre-attack/ 136 | 137 | ### https://academy.attackiq.com/learning-paths/purple-teaming 138 | 139 | ### https://www.pluralsight.com/courses/pentesting-red-blue-purple-teams-exec-briefing?aid=7010a000002BWqBAAW&promo=&utm_source=non_branded&utm_medium=digital_paid_search_google&utm_campaign=NASA_Dynamic&utm_content=&cq_cmp=846117097&gclid=Cj0KCQjwnueFBhChARIsAPu3YkRUH91lmOHgEeWIUVhqApeu9XggRuS0KKLj3qW_s3_CmyA1bg_NaRgaAr4eEALw_wcB 140 | 141 | ### https://resources.infosecinstitute.com/topic/purple-team-cyber-ranges-hands-on-training-for-red-and-blue-teams/ 142 | 143 | ### https://www.blackhillsinfosec.com/training/applied-purple-teaming-training/ 144 | 145 | ### https://academy.picussecurity.com/ 146 | 147 | ### https://cyberwarfare.live/certified-purple-team-analyst 148 | 149 | ## Escalate Privileges 150 | 151 | 152 | ### Domain Escalation 153 | 154 | - PowerView is a PowerShell tool to gain network situational awareness on Windows domains. https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1 155 | - Get-GPPPassword Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences. https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1 156 | - Invoke-ACLpwn is a tool that automates the discovery and pwnage of ACLs in Active Directory that are unsafe configured. https://github.com/fox-it/Invoke-ACLPwn 157 | - BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. https://github.com/BloodHoundAD/BloodHound 158 | - PyKEK (Python Kerberos Exploitation Kit), a python library to manipulate KRB5-related data. https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek 159 | - Grouper a PowerShell script for helping to find vulnerable settings in AD Group Policy. https://github.com/l0ss/Grouper 160 | - ADRecon is a tool which extracts various artifacts (as highlighted below) out of an AD environment in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis. https://github.com/sense-of-security/ADRecon 161 | - ADACLScanner one script for ACL's in Active Directory. https://github.com/canix1/ADACLScanner 162 | - ACLight a useful script for advanced discovery of Domain Privileged Accounts that could be targeted - including Shadow Admins. https://github.com/cyberark/ACLight 163 | - LAPSToolkit a tool to audit and attack LAPS environments. https://github.com/leoloobeek/LAPSToolkit 164 | - PingCastle is a free, Windows-based utility to audit the risk level of your AD infrastructure and check for vulnerable practices. https://www.pingcastle.com/download 165 | - RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs (Service Principal Name). https://github.com/cyberark/RiskySPN 166 | - Mystique is a PowerShell tool to play with Kerberos S4U extensions, this module can assist blue teams to identify risky Kerberos delegation configurations as well as red teams to impersonate arbitrary users by leveraging KCD with Protocol Transition. https://github.com/machosec/Mystique 167 | - Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project. https://github.com/GhostPack/Rubeus 168 | - kekeo is a little toolbox I have started to manipulate Microsoft Kerberos in C (and for fun). https://github.com/gentilkiwi/kekeo 169 | 170 | ### Local Escalation 171 | 172 | - UACMe is an open source assessment tool that contains many methods for bypassing Windows User Account Control on multiple versions of the operating system. https://github.com/hfiref0x/UACME 173 | - windows-kernel-exploits a collection windows kernel exploit. https://github.com/SecWiki/windows-kernel-exploits 174 | - PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations. https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1 175 | - The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload. https://github.com/rsmudge/ElevateKit 176 | - Sherlock a powerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. https://github.com/rasta-mouse/Sherlock 177 | - Tokenvator a tool to elevate privilege with Windows Tokens. https://github.com/0xbadjuju/Tokenvator 178 | 179 | ## Recon and Planning 180 | 181 | ### OSINT and Doxing 182 | 183 | - https://osintframework.com/ 184 | - https://en.wikipedia.org/wiki/Doxing 185 | - https://github.com/HackingEnVivo/Doxing 186 | - https://www.maltego.com/blog/investigating-ta413-threat-actor-group-using-opencti-in-maltego/ 187 | 188 | ### https://github.com/infosecn1nja/Red-Teaming-Toolkit 189 | 190 | - Active Intelligence Gathering 191 | 192 | - EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible. https://github.com/ChrisTruncer/EyeWitness 193 | - AWSBucketDump is a tool to quickly enumerate AWS S3 buckets to look for loot. https://github.com/jordanpotti/AWSBucketDump 194 | - AQUATONE is a set of tools for performing reconnaissance on domain names. https://github.com/michenriksen/aquatone 195 | - spoofcheck a program that checks if a domain can be spoofed from. The program checks SPF and DMARC records for weak configurations that allow spoofing. https://github.com/BishopFox/spoofcheck 196 | - Nmap is used to discover hosts and services on a computer network, thus building a "map" of the network. https://github.com/nmap/nmap 197 | - dnsrecon a tool DNS Enumeration Script. https://github.com/darkoperator/dnsrecon 198 | - dirsearch is a simple command line tool designed to brute force directories and files in websites. https://github.com/maurosoria/dirsearch 199 | - Sn1per automated pentest recon scanner. https://github.com/1N3/Sn1per 200 | 201 | - Passive Intelligence Gathering 202 | 203 | - Social Mapper OSINT Social Media Mapping Tool, takes a list of names & images (or LinkedIn company name) and performs automated target searching on a huge scale across multiple social media sites. Not restricted by APIs as it instruments a browser using Selenium. Outputs reports to aid in correlating targets across sites. https://github.com/SpiderLabs/social_mapper 204 | - skiptracer OSINT scraping framework, utilizes some basic python webscraping (BeautifulSoup) of PII paywall sites to compile passive information on a target on a ramen noodle budget. https://github.com/xillwillx/skiptracer 205 | - FOCA (Fingerprinting Organizations with Collected Archives) is a tool used mainly to find metadata and hidden information in the documents its scans. https://github.com/ElevenPaths/FOCA 206 | - theHarvester is a tool for gathering subdomain names, e-mail addresses, virtual hosts, open ports/ banners, and employee names from different public sources. https://github.com/laramies/theHarvester 207 | - Metagoofil is a tool for extracting metadata of public documents (pdf,doc,xls,ppt,etc) availables in the target websites. https://github.com/laramies/metagoofil 208 | - SimplyEmail Email recon made fast and easy, with a framework to build on. https://github.com/killswitch-GUI/SimplyEmail 209 | - truffleHog searches through git repositories for secrets, digging deep into commit history and branches. https://github.com/dxa4481/truffleHog 210 | - Just-Metadata is a tool that gathers and analyzes metadata about IP addresses. It attempts to find relationships between systems within a large dataset. https://github.com/ChrisTruncer/Just-Metadata 211 | - typofinder a finder of domain typos showing country of IP address. https://github.com/nccgroup/typofinder 212 | - pwnedOrNot is a python script which checks if the email account has been compromised in a data breach, if the email account is compromised it proceeds to find passwords for the compromised account. https://github.com/thewhiteh4t/pwnedOrNot 213 | - GitHarvester This tool is used for harvesting information from GitHub like google dork. https://github.com/metac0rtex/GitHarvester 214 | - pwndb is a python command-line tool for searching leaked credentials using the Onion service with the same name. https://github.com/davidtavarez/pwndb/ 215 | - LinkedInt LinkedIn Recon Tool. https://github.com/vysecurity/LinkedInt 216 | - CrossLinked LinkedIn enumeration tool to extract valid employee names from an organization through search engine scraping. https://github.com/m8r0wn/CrossLinked 217 | - findomain is a fast domain enumeration tool that uses Certificate Transparency logs and a selection of APIs. https://github.com/Edu4rdSHL/findomain 218 | 219 | - Framework 220 | 221 | - Maltego is a unique platform developed to deliver a clear threat picture to the environment that an organization owns and operates. https://www.paterva.com/web7/downloads.php 222 | - SpiderFoot the open source footprinting and intelligence-gathering tool. https://github.com/smicallef/spiderfoot 223 | - datasploit is an OSINT Framework to perform various recon techniques on Companies, People, Phone Number, Bitcoin Addresses, etc., aggregate all the raw data, and give data in multiple formats. https://github.com/DataSploit/datasploit 224 | - Recon-ng is a full-featured Web Reconnaissance framework written in Python. https://bitbucket.org/LaNMaSteR53/recon-ng 225 | 226 | ## Weaponization 227 | 228 | 229 | ### WinRAR Remote Code Execution Proof of Concept exploit for CVE-2018-20250. https://github.com/WyAtu/CVE-2018-20250 230 | 231 | ### Composite Moniker Proof of Concept exploit for CVE-2017-8570. https://github.com/rxwx/CVE-2017-8570 232 | 233 | ### Exploit toolkit CVE-2017-8759 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft .NET Framework RCE. https://github.com/bhdresh/CVE-2017-8759 234 | 235 | ### CVE-2017-11882 Exploit accepts over 17k bytes long command/code in maximum. https://github.com/unamer/CVE-2017-11882 236 | 237 | ### Adobe Flash Exploit CVE-2018-4878. https://github.com/anbai-inc/CVE-2018-4878 238 | 239 | ### Exploit toolkit CVE-2017-0199 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. https://github.com/bhdresh/CVE-2017-0199 240 | 241 | ### demiguise is a HTA encryption tool for RedTeams. https://github.com/nccgroup/demiguise 242 | 243 | ### Office-DDE-Payloads collection of scripts and templates to generate Office documents embedded with the DDE, macro-less command execution technique. https://github.com/0xdeadbeefJERKY/Office-DDE-Payloads 244 | 245 | ### CACTUSTORCH Payload Generation for Adversary Simulations. https://github.com/mdsecactivebreach/CACTUSTORCH 246 | 247 | ### SharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code. https://github.com/mdsecactivebreach/SharpShooter 248 | 249 | ### Don't kill my cat is a tool that generates obfuscated shellcode that is stored inside of polyglot images. The image is 100% valid and also 100% valid shellcode. https://github.com/Mr-Un1k0d3r/DKMC 250 | 251 | ### Malicious Macro Generator Utility Simple utility design to generate obfuscated macro that also include a AV / Sandboxes escape mechanism. https://github.com/Mr-Un1k0d3r/MaliciousMacroGenerator 252 | 253 | ### SCT Obfuscator Cobalt Strike SCT payload obfuscator. https://github.com/Mr-Un1k0d3r/SCT-obfuscator 254 | 255 | ### Invoke-Obfuscation PowerShell Obfuscator. https://github.com/danielbohannon/Invoke-Obfuscation 256 | 257 | ### Invoke-CradleCrafter PowerShell remote download cradle generator and obfuscator. https://github.com/danielbohannon/Invoke-CradleCrafter 258 | 259 | ### Invoke-DOSfuscation cmd.exe Command Obfuscation Generator & Detection Test Harness. https://github.com/danielbohannon/Invoke-DOSfuscation 260 | 261 | ### morphHTA Morphing Cobalt Strike's evil.HTA. https://github.com/vysec/morphHTA 262 | 263 | ### Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. https://github.com/trustedsec/unicorn 264 | 265 | ### Shellter is a dynamic shellcode injection tool, and the first truly dynamic PE infector ever created. https://www.shellterproject.com/ 266 | 267 | ### EmbedInHTML Embed and hide any file in an HTML file. https://github.com/Arno0x/EmbedInHTML 268 | 269 | ### SigThief Stealing Signatures and Making One Invalid Signature at a Time. https://github.com/secretsquirrel/SigThief 270 | 271 | ### Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. https://github.com/Veil-Framework/Veil 272 | 273 | ### CheckPlease Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust. https://github.com/Arvanaghi/CheckPlease 274 | 275 | ### Invoke-PSImage is a tool to embeded a PowerShell script in the pixels of a PNG file and generates a oneliner to execute. https://github.com/peewpw/Invoke-PSImage 276 | 277 | ### LuckyStrike a PowerShell based utility for the creation of malicious Office macro documents. To be used for pentesting or educational purposes only. https://github.com/curi0usJack/luckystrike 278 | 279 | ### ClickOnceGenerator Quick Malicious ClickOnceGenerator for Red Team. The default application a simple WebBrowser widget that point to a website of your choice. https://github.com/Mr-Un1k0d3r/ClickOnceGenerator 280 | 281 | ### macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of MS Office documents, VB scripts, and other formats for pentest, demo, and social engineering assessments. https://github.com/sevagas/macro_pack 282 | 283 | ### StarFighters a JavaScript and VBScript Based Empire Launcher. https://github.com/Cn33liz/StarFighters 284 | 285 | ### nps_payload this script will generate payloads for basic intrusion detection avoidance. It utilizes publicly demonstrated techniques from several different sources. https://github.com/trustedsec/nps_payload 286 | 287 | ### SocialEngineeringPayloads a collection of social engineering tricks and payloads being used for credential theft and spear phishing attacks. https://github.com/bhdresh/SocialEngineeringPayloads 288 | 289 | ### The Social-Engineer Toolkit is an open-source penetration testing framework designed for social engineering. https://github.com/trustedsec/social-engineer-toolkit 290 | 291 | ### Phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication. https://github.com/ryhanson/phishery 292 | 293 | ### PowerShdll run PowerShell with rundll32. Bypass software restrictions. https://github.com/p3nt4/PowerShdll 294 | 295 | ### Ultimate AppLocker ByPass List The goal of this repository is to document the most common techniques to bypass AppLocker. https://github.com/api0cradle/UltimateAppLockerByPassList 296 | 297 | ### Ruler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol. https://github.com/sensepost/ruler 298 | 299 | ### Generate-Macro is a standalone PowerShell script that will generate a malicious Microsoft Office document with a specified payload and persistence method. https://github.com/enigma0x3/Generate-Macro 300 | 301 | ### Malicious Macro MSBuild Generator Generates Malicious Macro and Execute Powershell or Shellcode via MSBuild Application Whitelisting Bypass. https://github.com/infosecn1nja/MaliciousMacroMSBuild 302 | 303 | ### Meta Twin is designed as a file resource cloner. Metadata, including digital signature, is extracted from one file and injected into another. https://github.com/threatexpress/metatwin 304 | 305 | ### WePWNise generates architecture independent VBA code to be used in Office documents or templates and automates bypassing application control and exploit mitigation software. https://github.com/mwrlabs/wePWNise 306 | 307 | ### DotNetToJScript a tool to create a JScript file which loads a .NET v2 assembly from memory. https://github.com/tyranid/DotNetToJScript 308 | 309 | ### PSAmsi is a tool for auditing and defeating AMSI signatures. https://github.com/cobbr/PSAmsi 310 | 311 | ### Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process. https://github.com/stephenfewer/ReflectiveDLLInjection 312 | 313 | ### ps1encode use to generate and encode a powershell based metasploit payloads. https://github.com/CroweCybersecurity/ps1encode 314 | 315 | ### Worse PDF turn a normal PDF file into malicious. Use to steal Net-NTLM Hashes from windows machines. https://github.com/3gstudent/Worse-PDF 316 | 317 | ### SpookFlare has a different perspective to bypass security measures and it gives you the opportunity to bypass the endpoint countermeasures at the client-side detection and network-side detection. https://github.com/hlldz/SpookFlare 318 | 319 | ### GreatSCT is an open source project to generate application white list bypasses. This tool is intended for BOTH red and blue team. https://github.com/GreatSCT/GreatSCT 320 | 321 | ### nps running powershell without powershell. https://github.com/Ben0xA/nps 322 | 323 | ### Meterpreter_Paranoid_Mode.sh allows users to secure your staged/stageless connection for Meterpreter by having it check the certificate of the handler it is connecting to. https://github.com/r00t-3xp10it/Meterpreter_Paranoid_Mode-SSL 324 | 325 | ### The Backdoor Factory (BDF) is to patch executable binaries with user desired shellcode and continue normal execution of the prepatched state. https://github.com/secretsquirrel/the-backdoor-factory 326 | 327 | ### MacroShop a collection of scripts to aid in delivering payloads via Office Macros. https://github.com/khr0x40sh/MacroShop 328 | 329 | ### UnmanagedPowerShell Executes PowerShell from an unmanaged process. https://github.com/leechristensen/UnmanagedPowerShell 330 | 331 | ### evil-ssdp Spoof SSDP replies to phish for NTLM hashes on a network. Creates a fake UPNP device, tricking users into visiting a malicious phishing page. https://gitlab.com/initstring/evil-ssdp 332 | 333 | ### Ebowla Framework for Making Environmental Keyed Payloads. https://github.com/Genetic-Malware/Ebowla 334 | 335 | ### make-pdf-embedded a tool to create a PDF document with an embedded file. https://github.com/DidierStevens/DidierStevensSuite/blob/master/make-pdf-embedded.py 336 | 337 | ### avet (AntiVirusEvasionTool) is targeting windows machines with executable files using different evasion techniques. https://github.com/govolution/avet 338 | 339 | ### EvilClippy A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows. https://github.com/outflanknl/EvilClippy 340 | 341 | ### CallObfuscator Obfuscate windows apis from static analysis tools and debuggers. https://github.com/d35ha/CallObfuscator 342 | 343 | ### Donut is a shellcode generation tool that creates position-independant shellcode payloads from .NET Assemblies. This shellcode may be used to inject the Assembly into arbitrary Windows processes. https://github.com/TheWover/donut 344 | 345 | ## Delivery 346 | 347 | 348 | ### Phishing 349 | 350 | - King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. https://github.com/securestate/king-phisher 351 | - FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more. https://github.com/Raikia/FiercePhish 352 | - ReelPhish is a Real-Time Two-Factor Phishing Tool. https://github.com/fireeye/ReelPhish/ 353 | - Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training. https://github.com/gophish/gophish 354 | - CredSniper is a phishing framework written with the Python micro-framework Flask and Jinja2 templating which supports capturing 2FA tokens. https://github.com/ustayready/CredSniper 355 | - PwnAuth a web application framework for launching and managing OAuth abuse campaigns. https://github.com/fireeye/PwnAuth 356 | - Phishing Frenzy Ruby on Rails Phishing Framework. https://github.com/pentestgeek/phishing-frenzy 357 | - Phishing Pretexts a library of pretexts to use on offensive phishing engagements. https://github.com/L4bF0x/PhishingPretexts 358 | - Modlishka is a flexible and powerful reverse proxy, that will take your ethical phishing campaigns to the next level. https://github.com/drk1wi/Modlishka 359 | - Evilginx2 is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. https://github.com/kgretzky/evilginx2 360 | 361 | ### Watering Hole Attack 362 | 363 | - BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser. https://github.com/beefproject/beef 364 | 365 | ### Command and Control 366 | 367 | - Remote Access Tools 368 | - Cobalt Strike is software for Adversary Simulations and Red Team Operations. https://cobaltstrike.com/ 369 | - Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent, and a pure Python 2.6/2.7 Linux/OS X agent. https://github.com/EmpireProject/Empire 370 | - Metasploit Framework is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. https://github.com/rapid7/metasploit-framework 371 | - SILENTTRINITY A post-exploitation agent powered by Python, IronPython, C#/.NET. https://github.com/byt3bl33d3r/SILENTTRINITY 372 | - Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python. https://github.com/n1nj4sec/pupy 373 | - Koadic or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. https://github.com/zerosum0x0/koadic 374 | - PoshC2 is a proxy aware C2 framework written completely in PowerShell to aid penetration testers with red teaming, post-exploitation and lateral movement. https://github.com/nettitude/PoshC2_Python 375 | - Gcat a stealthy Python based backdoor that uses Gmail as a command and control server. https://github.com/byt3bl33d3r/gcat 376 | - TrevorC2 is a legitimate website (browsable) that tunnels client/server communications for covert command execution. https://github.com/trustedsec/trevorc2 377 | - Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang. https://github.com/Ne0nd0g/merlin 378 | - Quasar is a fast and light-weight remote administration tool coded in C#. Providing high stability and an easy-to-use user interface, Quasar is the perfect remote administration solution for you. https://github.com/quasar/QuasarRAT 379 | - Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. https://github.com/cobbr/Covenant 380 | - FactionC2 is a C2 framework which use websockets based API that allows for interacting with agents and transports. https://github.com/FactionC2/ 381 | - DNScat2 is a tool is designed to create an encrypted command-and-control (C&C) channel over the DNS protocol. https://github.com/iagox86/dnscat2 382 | - Sliver is a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS. https://github.com/BishopFox/sliver 383 | - EvilOSX An evil RAT (Remote Administration Tool) for macOS / OS X. https://github.com/Marten4n6/EvilOSX 384 | - EggShell is a post exploitation surveillance tool written in Python. It gives you a command line session with extra functionality between you and a target machine. https://github.com/neoneggplant/EggShell 385 | - https://github.com/CyberSecurityUP/Trevorfuscation 386 | 387 | ### Staging 388 | 389 | - Rapid Attack Infrastructure (RAI) Red Team Infrastructure... Quick... Fast... Simplified One of the most tedious phases of a Red Team Operation is usually the infrastructure setup. This usually entails a teamserver or controller, domains, redirectors, and a Phishing server. https://github.com/obscuritylabs/RAI 390 | - Red Baron is a set of modules and custom/third-party providers for Terraform which tries to automate creating resilient, disposable, secure and agile infrastructure for Red Teams. https://github.com/byt3bl33d3r/Red-Baron 391 | - EvilURL generate unicode evil domains for IDN Homograph Attack and detect them. https://github.com/UndeadSec/EvilURL 392 | - Domain Hunter checks expired domains, bluecoat categorization, and Archive.org history to determine good candidates for phishing and C2 domain names. https://github.com/threatexpress/domainhunter 393 | - PowerDNS is a simple proof of concept to demonstrate the execution of PowerShell script using DNS only. https://github.com/mdsecactivebreach/PowerDNS 394 | - Chameleon a tool for evading Proxy categorisation. https://github.com/mdsecactivebreach/Chameleon 395 | - CatMyFish Search for categorized domain that can be used during red teaming engagement. Perfect to setup whitelisted domain for your Cobalt Strike beacon C&C. https://github.com/Mr-Un1k0d3r/CatMyFish 396 | - Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. https://github.com/rsmudge/Malleable-C2-Profiles 397 | - Malleable-C2-Randomizer This script randomizes Cobalt Strike Malleable C2 profiles through the use of a metalanguage, hopefully reducing the chances of flagging signature-based detection controls. https://github.com/bluscreenofjeff/Malleable-C2-Randomizer 398 | - FindFrontableDomains search for potential frontable domains. https://github.com/rvrsh3ll/FindFrontableDomains 399 | - Postfix-Server-Setup Setting up a phishing server is a very long and tedious process. It can take hours to setup, and can be compromised in minutes. https://github.com/n0pe-sled/Postfix-Server-Setup 400 | - DomainFrontingLists a list of Domain Frontable Domains by CDN. https://github.com/vysec/DomainFrontingLists 401 | - Apache2-Mod-Rewrite-Setup Quickly Implement Mod-Rewrite in your infastructure. https://github.com/n0pe-sled/Apache2-Mod-Rewrite-Setup 402 | - mod_rewrite rule to evade vendor sandboxes. https://gist.github.com/curi0usJack/971385e8334e189d93a6cb4671238b10 403 | - external_c2 framework a python framework for usage with Cobalt Strike's External C2. https://github.com/Und3rf10w/external_c2_framework 404 | - Malleable-C2-Profiles A collection of profiles used in different projects using Cobalt Strike https://www.cobaltstrike.com/. https://github.com/xx0hcd/Malleable-C2-Profiles 405 | - ExternalC2 a library for integrating communication channels with the Cobalt Strike External C2 server. https://github.com/ryhanson/ExternalC2 406 | - cs2modrewrite a tools for convert Cobalt Strike profiles to modrewrite scripts. https://github.com/threatexpress/cs2modrewrite 407 | - e2modrewrite a tools for convert Empire profiles to Apache modrewrite scripts. https://github.com/infosecn1nja/e2modrewrite 408 | - redi automated script for setting up CobaltStrike redirectors (nginx reverse proxy, letsencrypt). https://github.com/taherio/redi 409 | - cat-sites Library of sites for categorization. https://github.com/audrummer15/cat-sites 410 | - ycsm is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular Post-Ex Tools (Cobalt Strike, Empire, Metasploit, PoshC2). https://github.com/infosecn1nja/ycsm 411 | - Domain Fronting Google App Engine. https://github.com/redteam-cyberark/Google-Domain-fronting 412 | - DomainFrontDiscover Scripts and results for finding domain frontable CloudFront domains. https://github.com/peewpw/DomainFrontDiscover 413 | - Automated Empire Infrastructure https://github.com/bneg/RedTeam-Automation 414 | - Serving Random Payloads with NGINX. https://gist.github.com/jivoi/a33ace2e25515a31aa2ffbae246d98c9 415 | - meek is a blocking-resistant pluggable transport for Tor. It encodes a data stream as a sequence of HTTPS requests and responses. https://github.com/arlolra/meek 416 | - CobaltStrike-ToolKit Some useful scripts for CobaltStrike. https://github.com/killswitch-GUI/CobaltStrike-ToolKit 417 | - mkhtaccess_red Auto-generate an HTaccess for payload delivery -- automatically pulls ips/nets/etc from known sandbox companies/sources that have been seen before, and redirects them to a benign payload. https://github.com/violentlydave/mkhtaccess_red 418 | - RedFile a flask wsgi application that serves files with intelligence, good for serving conditional RedTeam payloads. https://github.com/outflanknl/RedFile 419 | - keyserver Easily serve HTTP and DNS keys for proper payload protection. https://github.com/leoloobeek/keyserver 420 | - DoHC2 allows the ExternalC2 library from Ryan Hanson (https://github.com/ryhanson/ExternalC2) to be leveraged for command and control (C2) via DNS over HTTPS (DoH). This is built for the popular Adversary Simulation and Red Team Operations Software Cobalt Strike (https://www.cobaltstrike.com). https://github.com/SpiderLabs/DoHC2 421 | - HTran is a connection bouncer, a kind of proxy server. A “listener” program is hacked stealthily onto an unsuspecting host anywhere on the Internet. https://github.com/HiwinCN/HTran 422 | 423 | ## Lateral Movement 424 | 425 | 426 | ### CrackMapExec is a swiss army knife for pentesting networks. https://github.com/byt3bl33d3r/CrackMapExec 427 | 428 | ### PowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe. https://github.com/Mr-Un1k0d3r/PowerLessShell 429 | 430 | ### GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application. https://github.com/GoFetchAD/GoFetch 431 | 432 | ### ANGRYPUPPY a bloodhound attack path automation in CobaltStrike. https://github.com/vysec/ANGRYPUPPY 433 | 434 | ### DeathStar is a Python script that uses Empire's RESTful API to automate gaining Domain Admin rights in Active Directory environments using a variety of techinques. https://github.com/byt3bl33d3r/DeathStar 435 | 436 | ### SharpHound C# Rewrite of the BloodHound Ingestor. https://github.com/BloodHoundAD/SharpHound 437 | 438 | ### BloodHound.py is a Python based ingestor for BloodHound, based on Impacket. https://github.com/fox-it/BloodHound.py 439 | 440 | ### Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. https://github.com/SpiderLabs/Responder 441 | 442 | ### SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally. https://github.com/fireeye/SessionGopher 443 | 444 | ### PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. https://github.com/PowerShellMafia/PowerSploit 445 | 446 | ### Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. https://github.com/samratashok/nishang 447 | 448 | ### Inveigh is a Windows PowerShell LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool. https://github.com/Kevin-Robertson/Inveigh 449 | 450 | ### PowerUpSQL a PowerShell Toolkit for Attacking SQL Server. https://github.com/NetSPI/PowerUpSQL 451 | 452 | ### MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). https://github.com/dafthack/MailSniper 453 | 454 | ### DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. https://github.com/dafthack/DomainPasswordSpray 455 | 456 | ### WMIOps is a powershell script that uses WMI to perform a variety of actions on hosts, local or remote, within a Windows environment. It's designed primarily for use on penetration tests or red team engagements. https://github.com/ChrisTruncer/WMIOps 457 | 458 | ### Mimikatz is an open-source utility that enables the viewing of credential information from the Windows lsass. https://github.com/gentilkiwi/mimikatz 459 | 460 | ### LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. https://github.com/AlessandroZ/LaZagne 461 | 462 | ### mimipenguin a tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz. https://github.com/huntergregal/mimipenguin 463 | 464 | ### PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. https://docs.microsoft.com/en-us/sysinternals/downloads/psexec 465 | 466 | ### KeeThief allows for the extraction of KeePass 2.X key material from memory, as well as the backdooring and enumeration of the KeePass trigger system. https://github.com/HarmJ0y/KeeThief 467 | 468 | ### PSAttack combines some of the best projects in the infosec powershell community into a self contained custom PowerShell console. https://github.com/jaredhaight/PSAttack 469 | 470 | ### Internal Monologue Attack Retrieving NTLM Hashes without Touching LSASS. https://github.com/eladshamir/Internal-Monologue 471 | 472 | ### Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (for instance NMB, SMB1-3 and MS-DCERPC) the protocol implementation itself. https://github.com/CoreSecurity/impacket 473 | 474 | ### icebreaker gets plaintext Active Directory credentials if you're on the internal network but outside the AD environment. https://github.com/DanMcInerney/icebreaker 475 | 476 | ### Living Off The Land Binaries and Scripts (and now also Libraries) The goal of these lists are to document every binary, script and library that can be used for other purposes than they are designed to. https://github.com/api0cradle/LOLBAS 477 | 478 | ### WSUSpendu for compromised WSUS server to extend the compromise to clients. https://github.com/AlsidOfficial/WSUSpendu 479 | 480 | ### Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates. https://github.com/infobyte/evilgrade 481 | 482 | ### NetRipper is a post exploitation tool targeting Windows systems which uses API hooking in order to intercept network traffic and encryption related functions from a low privileged user, being able to capture both plain-text traffic and encrypted traffic before encryption/after decryption. https://github.com/NytroRST/NetRipper 483 | 484 | ### LethalHTA Lateral Movement technique using DCOM and HTA. https://github.com/codewhitesec/LethalHTA 485 | 486 | ### Invoke-PowerThIEf an Internet Explorer Post Exploitation library. https://github.com/nettitude/Invoke-PowerThIEf 487 | 488 | ### RedSnarf is a pen-testing / red-teaming tool for Windows environments. https://github.com/nccgroup/redsnarf 489 | 490 | ### HoneypotBuster Microsoft PowerShell module designed for red teams that can be used to find honeypots and honeytokens in the network or at the host. https://github.com/JavelinNetworks/HoneypotBuster 491 | 492 | ### PAExec lets you launch Windows programs on remote Windows computers without needing to install software on the remote computer first. https://www.poweradmin.com/paexec/ 493 | 494 | ## LinkedIn 495 | 496 | ### https://www.linkedin.com/in/joas-antonio-dos-santos 497 | 498 | ## Establish Foothold 499 | 500 | 501 | ### Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled environments. https://github.com/SECFORCE/Tunna 502 | 503 | ### reGeorg the successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn. https://github.com/sensepost/reGeorg 504 | 505 | ### Blade is a webshell connection tool based on console, currently under development and aims to be a choice of replacement of Chooper. https://github.com/wonderqs/Blade 506 | 507 | ### TinyShell Web Shell Framework. https://github.com/threatexpress/tinyshell 508 | 509 | ### PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. https://github.com/Sw4mpf0x/PowerLurk 510 | 511 | ### DAMP The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification. https://github.com/HarmJ0y/DAMP 512 | 513 | ## Data Exfiltration 514 | 515 | 516 | ### CloakifyFactory & the Cloakify Toolset - Data Exfiltration & Infiltration In Plain Sight; Evade DLP/MLS Devices; Social Engineering of Analysts; Defeat Data Whitelisting Controls; Evade AV Detection. https://github.com/TryCatchHCF/Cloakify 517 | 518 | ### DET (is provided AS IS), is a proof of concept to perform Data Exfiltration using either single or multiple channel(s) at the same time. https://github.com/sensepost/DET 519 | 520 | ### DNSExfiltrator allows for transfering (exfiltrate) a file over a DNS request covert channel. This is basically a data leak testing tool allowing to exfiltrate data over a covert channel. https://github.com/Arno0x/DNSExfiltrator 521 | 522 | ### PyExfil a Python Package for Data Exfiltration. https://github.com/ytisf/PyExfil 523 | 524 | ### Egress-Assess is a tool used to test egress data detection capabilities. https://github.com/ChrisTruncer/Egress-Assess 525 | 526 | ### Powershell RAT python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment. https://github.com/Viralmaniar/Powershell-RAT 527 | 528 | ## Adversary Emulation 529 | 530 | ### https://mk0obscuritylab70ma7.kinstacdn.com/wp-content/uploads/2020/12/Adversarial-Attack-Lifecycle-Mapping.png 531 | 532 | ### Capabilities 533 | 534 | - PERSISTENT RED TEAM OPERATIONS™ 535 | - Our team has the capabilities and experience to run long-term persistent style Red Team engagements spanning up to 6 months in length. This capability is rarely found in our industry and pushes some companies boundaries to produce actual threat and adversary replication. 536 | - STRATEGIC ENGAGEMENT PLANNING 537 | - Whether you want a Black Box or Purple Team style engagement, our seasoned Red Team Operators and Management team can help you design and deliver your organization the ideal test. At Obscurity Labs, we understand that it’s about more than just breaking defensives. It’s about helping identify security control and operational gaps that will prevent you from the next breach. 538 | - WHITE CELL COLLABORATION 539 | - Communication is critical to the success of Red Team operations. We take this real-time communication aspect very seriously and provide direct access to Obscurity Labs resources for deconfliction and strategic and tactical decision processes. Our goal is to ensure our customer has the proper channels for escalation and clear guidelines in place. 540 | - ENVIRONMENT STRENGTH OBSERVATIONS 541 | - During the assessment, the Red Ream often encounters security controls that prevent or forces the team to adapt to the environment. These strengths should be noted and lauded. An organization that understands its strengths will have a more significant impact on the overall security of the network. Our team always captures these for future reporting so your security team has the best data on which tools and processes had a high rate of success. 542 | - GAP & RISK ANALYSIS 543 | - During Red Team operations, our team will become extremely familiar with your environment, key cyber terrain, and business unit operations. Our team does this to ensure we can provide unbiased risk and gap based analysis of our findings. We provide key finding details and detection recommendations as part of our deliverables. 544 | - EXECUTIVE OUT-BRIEF SUPPORT 545 | - One of the overlooked components of offensive engagements is providing executive leadership and stakeholders vulnerabilities, metrics, and outcomes during the reporting stage. Obscurity Labs provides on-site or virtual out-briefs to executive leadership tailored to the business unit’s requirements. We use this time to ensure the narrative of the test outcomes are properly received and understood. 546 | - CUSTOM ROE 547 | - Our service adapts to most of today’s threats and can successfully provide you with real-world emulation of those threats. With that comes extensive paper-work! We make it easy by filling out a form to which we provide a custom ROE based on the on-boarding and scoping process, which ensures we protect you from unnecessary actions that can cause impact to your business’s operations. We provide descriptions and expert guidance when planning your next Red Team! 548 | - DOCUMENTATION & REPORTING 549 | - We provide custom-tailored reporting in the format you prefer. 550 | - ON-TAP SECURITY CONSULTING™ 551 | - When you enroll in an Adversary Emulation Engagement™ with our team you gain exclusive access to our On-tap Security Consulting team™. This lets you know we stick with you the entire year, summarize, perform a quick analysis of duplicates. Ask our team about any security concerns, implementation, or ways to improve. We are here to help you! We are more than a pentest company! 552 | 553 | ### Tools Adversary Emulation 554 | 555 | - MITRE CALDERA - An automated adversary emulation system that performs post-compromise adversarial behavior within Windows Enterprise networks. https://github.com/mitre/caldera 556 | - APTSimulator - A Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised. https://github.com/NextronSystems/APTSimulator 557 | - Atomic Red Team - Small and highly portable detection tests mapped to the Mitre ATT&CK Framework. https://github.com/redcanaryco/atomic-red-team 558 | - Network Flight Simulator - flightsim is a lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility. https://github.com/alphasoc/flightsim 559 | - Metta - A security preparedness tool to do adversarial simulation. https://github.com/uber-common/metta 560 | - Red Team Automation (RTA) - RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK. https://github.com/endgameinc/RTA 561 | 562 | ### Thec2matrix - C2 and C3 563 | 564 | - https://www.thec2matrix.com/matrix 565 | 566 | - Ares 567 | - AsyncRAT-C# 568 | - BabyShark 569 | - BlackMamba 570 | - Brute Ratel 571 | - C3 572 | - CALDERA 573 | - Callidus 574 | - CHAOS 575 | - Cobalt Strike 576 | - Covenant 577 | - Dali 578 | - DarkFinger 579 | - DBC2 580 | - DeimosC2 581 | - Eggshell 582 | - Empire 583 | - EvilOSX 584 | - Faction C2 585 | - FlyingAFalseFlag 586 | - FudgeC2 587 | - godoh 588 | - GRAT2 589 | - HARS 590 | - HTTP-RevShell 591 | - ibombshell 592 | - INNUENDO 593 | - Koadic C3 594 | - MacC2 595 | - MacShellSwift 596 | - Merlin 597 | - Metasploit 598 | - Meterpeter 599 | - MicroBackdoor 600 | - MikeC2 601 | - Mistica 602 | - Mythic 603 | - Ninja 604 | - NorthStarC2 605 | - Nuages 606 | - Octopus 607 | - Oyabun C2 608 | - PetaQ 609 | - PoshC2 610 | - PowerHub 611 | - Prelude 612 | - Prismatica 613 | - Proton 614 | - Pupy 615 | - QuasarRAT 616 | - RATel 617 | - Red Team Toolkit 618 | - redViper 619 | - ReverseTCPShell 620 | - sak1to-shell 621 | - SCYTHE 622 | - Serpentine 623 | - Shad0w 624 | - Shadow Workers 625 | - SharpC2 626 | - SilentTrinity 627 | - SK8PARK/RAT 628 | - Slack-C2Bot 629 | - Slackor 630 | - Sliver 631 | - Throwback 632 | - ThunderShell 633 | - Trevor C2 634 | - Void-RAT 635 | - Voodoo 636 | - WEASEL 637 | 638 | *XMind - Evaluation Version* 639 | --------------------------------------------------------------------------------