Threatest is a Go framework for testing threat detection end-to-end. Threatest allows you to detonate an attack technique, and verify that the alert you expect was generated in your favorite security platform.
A detonator describes how and where an attack technique is executed.
Supported detonators:
An alert matcher is a platform-specific integration that can check if an expected alert was triggered.
Supported alert matchers:
Each detonation is assigned a UUID. This UUID is reflected in the detonation and used to ensure that the matched alert corresponds exactly to this detonation.
The way this is done depends on the detonator; for instance, Stratus Red Team and the AWS Detonator inject it in the user-agent; the SSH detonator uses a parent process containing the UUID.
See examples for complete usage example.
threatest := Threatest() threatest.Scenario("AWS console login"). WhenDetonating(StratusRedTeamTechnique("aws.initial-access.console-login-without-mfa")). Expect(DatadogSecuritySignal("AWS Console login without MFA").WithSeverity("medium")). WithTimeout(15 * time.Minute) assert.NoError(t, threatest.Run())
ssh, _ := NewSSHCommandExecutor("test-box", "", "") threatest := Threatest() threatest.Scenario("curl to metadata service"). WhenDetonating(NewCommandDetonator(ssh, "curl http://169.254.169.254 --connect-timeout 1")). Expect(DatadogSecuritySignal("EC2 Instance Metadata Service Accessed via Network Utility")) assert.NoError(t, threatest.Run())
Nmap (Network Mapper) is a free tool that helps you find devices on a network,…
Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…
While file extensions in Linux are optional and often misleading, the file command helps decode what a…
The touch command is one of the quickest ways to create new empty files or update timestamps…
Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…
Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…