Endgame Red Team Automation (RTA) Framework

Red Team Automation (RTA) provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.

RTA is composed of python scripts that generate evidence of over 50 different ATT&CK tactics, as well as a compiled binary application that performs activities such as file timestopping, process injections, and beacon simulation as needed.

Where possible, RTA attempts to perform the actual malicious activity described. In other cases, the RTAs will emulate all or parts of the activity. For example, some lateral movement will by default target local host (though with parameters typically allow for multi-host testing). In other cases, executables such as cmd.exe or python.exe will be renamed to make it appear as if a Windows binary is doing non-standard activities.

Endgame Red Team Automation (RTA) Framework

Endgame Red Team Automation (RTA) Framework

The framework is targeting windows operating system you can download and unzip the file next add sysinternals and MsXsl suite in the bin folder. If you will have an antivirus or a security software on your system this will prevent execution many of the script and they are going to be identified as malwares. you should evaluate the targeted host protection before running any of the evaluation test.

All scripts include the name of the attack and brief description for what will be expected to run upon execution for example “Description: Creates registry persistence for mock malware in Run and RunOnce keys, Services and debuggers.” It will be important to review each script and check if you will need to test this type of attack.

You can read more and download this framework over here: https://github.com/endgameinc/

Notify of
Inline Feedbacks
View all comments