RTA: Red Team Automation
Red Team Automation (RTA)
RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
RTA is composed of python scripts that generate evidence of over 50 different ATT&CK tactics, as well as a compiled binary application that performs activities such as file timestopping, process injections, and beacon simulation as needed.
Where possible, RTA attempts to perform the actual malicious activity described. In other cases, the RTAs will emulate all or parts of the activity. For example, some lateral movement will be the default target local host (though with parameters typically allow for multi-host testing). In other cases, executables such as cmd.exe or python.exe will be renamed to make it appears as if a Windows binary is doing non-standard activities.
Installation
Requirement: Python 2.7
- Download a copy of the RTA repo: git clone
- Extract the contents of the zip archive into an RTA folder, such as c:\RTA
- For the full experience, download additional files into the bin subdirectory
Windows Defender or other Anti-Virus products may block or otherwise interfere with RTAs while they run. Consider how you configure security products on the test host before running RTAs based on the goals of your tests.
By modifying common.py, you can customize how RTA scripts will work in your environment. You could even write an entirely new function for use in one or more new RTAs.
Running RTAs
To run the powershell_args.py RTA, simply run:
python powershell_args.py
To run an entire directory of RTAs, you can use a loop:
Windows:
for %f in (*.py) do python %f
Linux/Mac:
for i in (*.py); do python $i; done
None of the rules require arguments, but some can optionally take arguments for further customization of the technique.
Endgame’s RTA scripts and supporting files are used to simulate adversary tradecraft.
Copyright (C) 2018 info@endgame.com
Source: https://github.com/endgameinc/
