redcanaryco/AtomicTestHarnesses

Stars
244
Rank 165,885 (Top 4 %)
Language
PowerShell
License
BSD 3-Clause "New...
Created about 4 years ago
Updated 5 months ago

redcanaryco/AtomicTestHarnesses

redcanaryco

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Public Repo for Atomic Test Harness

AtomicTestHarnesses

AtomicTestHarnesses is a library that simulates and validates attack technique execution. It consists of a Powershell module for running attack techniques on Windows and also a Python package for running on macOS and Linux

The details of a technique can vary from attack to attack; AtomicTestHarnesses accounts for this by allowing you to execute many variations of a technique at once. AtomicTestHarnesses also validates the telemetry generated during execution, so you always know whether your simulations were successful.

Get started

To start testing with AtomicTestHarnesses, see the Getting started page of the wiki.

Learn more

The AtomicTestHarnesses documentation is available as a wiki.

For information about the philosophy and development of the atomic family of projects, visit our website at https://atomicredteam.io.

Check the license for information regarding the distribution and modification of AtomicTestHarnesses.

Contribute to AtomicTestHarnesses

AtomicTestHarnesses currently isn't open to public development. However, you can still contribute to the project by finding and fixing bugs.

You can report bugs and other problems by submitting an issue. If you fixed a bug, let us know by committing your code and opening a pull request.

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

mac-monitor

Red Canary Mac Monitor is an advanced, stand-alone system monitoring tool tailor-made for macOS security research. Beginning with Endpoint Security (ES), it collects and enriches system events, displaying them graphically, with an expansive feature set designed to reduce noise.

invoke-atomicredteam

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.

chain-reactor

Chain Reactor is an open source framework for composing executables that simulate adversary behaviors and techniques on Linux endpoints.

surveyor

A cross-platform baselining, threat hunting, and attack surface analysis tool for security teams.

oxidebpf

A Rust library for managing eBPF programs.

redcanary-response-utils

Tools to automate and/or expedite response.

redcanary-ebpf-sensor

Red Canary's eBPF Sensor

ebpfmon

wwhf

Exercises for C# Workshop at Wild West Hackin' Fest 2018 & 2019.

exploit-primitive-playground

vscode-attack

Visual Studio Code extension for MITRE ATT&CK

public-research

Public repository for Red Canary Research

ansible-atomic-red-team

This project is an Ansible Role to execute Atomic Red Team tests against multiple machines by wrapping Invoke-AtomicRedTeam

cbapi2

Red Canary Carbon Black API

cb-response-smb1-utility

A simple utility to check the status of and/or disable SMBv1 on Windows system via Cb Response's Live Response functionality.

cbconnect-2019

openapi

Public API clients for connecting to the Red Canary APIs

rtlshtree

helm-charts

Red Canary's Public Helm Chart Repository