RedEye
adversary_emulation_library
| RedEye | adversary_emulation_library | |
|---|---|---|
| 7 | 8 | |
| 2,531 | 1,555 | |
| - | 2.2% | |
| 10.0 | 9.5 | |
| 7 months ago | 4 months ago | |
| TypeScript | C | |
| BSD 3-clause "New" or "Revised" License | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
RedEye
-
Can someone please help me install CISA's RedEye tool?
I want to assume that you downloaded the Linux version from this link: https://github.com/cisagov/RedEye/releases/download/v0.8.3/linux.zip
- Cisagov/RedEye: Red Team C2 Log Visualization
- New blue team
- Red Team C2 Log Visualization
- USG CISA - RedEye is a visual analytic tool supporting Red & Blue Team operations
- RedEye - a visual analytic tool supporting Red & Blue Team operations
adversary_emulation_library
-
What adversary emulation options are there nowadays to test SIEMs and IDSs?
Unfortunately I don't have the background and knowledge of cybersecurity needed to plan a pentest of my own. Also, it would be more interesting to emulate the attacks of actual APTs known in the wild. So far, I've tested Caldera, Invoke-AtomicRedTeam and manual tests from CTID's adversary emulation library: https://github.com/center-for-threat-informed-defense/adversary_emulation_library
- adversary_emulation_library: An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
-
New blue team
This is a great callout! To help get started, check out the adversary emulation library, https://github.com/center-for-threat-informed-defense/adversary_emulation_library. There are also micro-emulation plans, described here: https://ctid.mitre-engenuity.org/our-work/micro-emulation-plans/.
- micro_emulation_plans: This collection expands the impact of the Adversary Emulation Library by developing easy-to-execute adversary emulation content that targets specific behaviors and challenges facing defenders
-
Advice on purple teaming
I don't know how we know what CS would do if that command was part of a chain of attack, I'm assuming it would just detect on the more malicious activities. Once we get a bit more mature in our use of Atomic Red team I was looking at this framework for simulating an actual attack chain.
- THT: When hunt APT look for emulation ...
- Adversary Emulation Library
- menuPass Adversary Emulation
What are some alternatives?
velociraptor - Digging Deeper....
tram - TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE ATT&CK®.
auditd - Best Practice Auditd Configuration
sysmon-modular - A repository of sysmon configuration modules
Shuffle - Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
attack-flow - Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.
robodroid-library - Curated list of Frida scripts for RoboDroid to run pre-defined behaviors.
attack-control-framework-mappings - 🚨ATTENTION🚨 The NIST 800-53 mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
AtomicPurpleTeam - Atomic Purple Team Framework and Lifecycle
stix2.1-coa-playbook-extension - A STIX 2.1 Extension Definition for the Course of Action (COA) object type. The nested property extension allows a COA to share machine-readable security playbooks such as CACAO Security Playbooks
auditd-attack - A Linux Auditd rule set mapped to MITRE's Attack Framework