Skip to content

feat: add comprehensive attack strategy system with technique prioritization#231

Merged
l50 merged 16 commits into
mainfrom
chore/improve-test-coverage
Apr 22, 2026
Merged

feat: add comprehensive attack strategy system with technique prioritization#231
l50 merged 16 commits into
mainfrom
chore/improve-test-coverage

Conversation

@l50
Copy link
Copy Markdown
Contributor

@l50 l50 commented Apr 22, 2026

Key Changes:

  • Introduced strategy presets (fast, comprehensive, stealth) to control attack technique prioritization and completion logic
  • Added support for per-technique weight overrides, exclude/include lists, and post-DA exploitation control
  • Refactored all automation modules to respect strategy technique filters and priorities
  • Updated LLM system prompt to render dynamic technique priority tables based on active strategy

Added:

  • Strategy configuration system - Implemented Strategy struct with YAML, JSON, and env var resolution for technique weights, excludes, includes, and continue_after_da logic (ares-cli/src/orchestrator/strategy.rs)
  • Dynamic technique priority table in LLM prompt - System prompt now renders the active strategy's priorities for improved agent reasoning (ares-llm/templates/redteam/agents/system_instructions.md.tera, ares-llm/src/prompt/templates.rs)
  • New automation modules for advanced exploitation techniques:
    • ADCS exploitation automation (ares-cli/src/orchestrator/automation/adcs_exploitation.rs)
    • Shadow credentials automation (ares-cli/src/orchestrator/automation/shadow_credentials.rs)
    • RBCD (resource-based constrained delegation) automation (ares-cli/src/orchestrator/automation/rbcd.rs)
    • GPO abuse automation (ares-cli/src/orchestrator/automation/gpo.rs)
    • LAPS extraction automation (ares-cli/src/orchestrator/automation/laps.rs)
    • MSSQL deep exploitation automation (ares-cli/src/orchestrator/automation/mssql_exploitation.rs)
    • Cross-domain credential reuse automation (ares-cli/src/orchestrator/automation/credential_reuse.rs)
  • Strategy documentation - New docs/strategy.md and detailed GOAD attack surface checklist (docs/goad-checklist.md)
  • Test coverage for all new strategy logic and automation paths

Changed:

  • Automation and exploitation logic now respects is_technique_allowed and uses effective_priority from the active strategy in all dispatches (ares-cli/src/orchestrator/automation/, ares-cli/src/orchestrator/exploitation.rs)
  • Exploitation and credential access modules parallelize more work per cycle in comprehensive mode (higher .take() limits)
  • Orchestrator config loads strategy from YAML, JSON, or env vars and resolves listener IP for coercion/relay tasks (ares-cli/src/orchestrator/config.rs)
  • LLM runner passes technique priority table to the prompt template (ares-cli/src/orchestrator/llm_runner.rs)
  • System prompt and agent instructions updated to dynamically show technique priorities and strategy context (ares-llm/src/prompt/templates.rs)
  • Default automation now launches all new exploitation and credential expansion modules; spawner includes new tasks (ares-cli/src/orchestrator/automation/mod.rs, ares-cli/src/orchestrator/automation_spawner.rs)
  • All modules and test suites refactored to fully exercise new strategy controls and edge cases

Removed:

  • Legacy hardcoded technique priority logic throughout automation and exploitation modules
  • All ares-rust-* template directories from warpgate-templates (superseded by new unified agent templates)
  • Outdated references to static agent naming in documentation and scripts (.taskfiles/ec2/Taskfile.yaml, README.md, etc.)

l50 added 12 commits April 22, 2026 11:09
**Added:**

- Added comprehensive tests for `build_attack_chain`, including single-step, multi-step, cycle guard, missing ID, and domain admin chain scenarios in `operation.rs`
- Added tests for formatting attack chains, covering empty, single-step, and multi-step cases

**Changed:**

- Expanded Kerberos hash extraction tests in `kerberos.rs` to cover multiple TGS entries, empty input, no-match cases, valid AS-REP extraction, and mixed TGS/AS-REP outputs
- Updated existing Kerberos test function names for clarity and improved test organization

**Removed:**

- Removed redundant and less comprehensive Kerberos extraction tests, consolidating coverage into new and enhanced tests in `kerberos.rs`
…dules

**Added:**

- Added tests for grade boundary values, pass condition logic, investigation status, summary output, and dataset statistics in evaluation results
- Added tests for delegation extraction handling of unknown types, short lines, missing headers, and separator-only input
- Added tests for host extraction with blank lines, duplicate IPs, missing domain fields, and mixed-format lines
- Added tests for secretsdump parsing covering all-empty hashes, malformed RIDs, uppercase hashes, whitespace handling, and krbtgt detection by RID
- Added tests for share extraction with no access, write-only, status marker skipping, and ignoring non-SMB lines
- Added test for parsing constrained delegation type with lowercase input in types module
…and token usage modules

**Added:**

- Added tests for EvaluationResult and DatasetEvaluationResult summary, value, and scoring logic, including edge cases and field coverage - ares-core/src/eval/results.rs
- Added tests for Kerberos hash extraction, including whitespace and status line handling - ares-core/src/parsing/kerberos.rs
- Added tests for NTLM hash extraction, krbtgt detection, hash normalization, and line wrapping - ares-core/src/parsing/ntlm.rs
- Added tests for MITRE technique display and static map loading - ares-core/src/reports/mitre.rs
- Added tests for model cost lookup, operation usage estimation, model field parsing, and key generation - ares-core/src/token_usage.rs
…d cost modules

**Added:**

- Unit tests for GapAnalysisReport markdown output, covering headers, IDs, gaps, recommendations, grouping, techniques, and summary
- Unit tests for technique and vulnerability mapping logic, including requirement checks and default behaviors
- Unit tests for EvaluationGroundTruth filtering and ExpectedTechnique matching logic
- Unit tests for cost estimation logic, including known/unknown models, zero tokens, and mixed scenarios
…token usage modules

**Added:**

- Unit tests for the detection configuration, template lookup, MITRE mappings, and config structure in `detection/mod.rs`
- Extensive serde roundtrip and default value tests for Host, Credential, Hash, Share, User, Target, and TrustInfo structs in `models/core.rs`
- Unit tests for serialization, deserialization, and error handling for `TaskStatusRecord` in `models/task.rs`
- Test for UUID v4 validity in `models/util.rs`
- Unit tests for Redis key constants, key suffixes, and blue team key handling in `state/keys.rs`
- Tests for blue token usage keys, cost estimation, model field parsing, and serialization in `token_usage.rs`
… and patterns

**Added:**

- Unit tests for `AlertCluster` covering alert addition, extraction logic, similarity scoring, and summary generation
- Unit tests for `AlertCorrelator` verifying alert assignment, cluster retrieval, context, and reset behavior
- Unit tests for `LateralGraph` validating connection handling, host investigation state, user collection, and summary
- Unit tests for `LateralPatterns` regex matching and detection logic
…report modules

**Added:**

- Added comprehensive unit tests for `generate_executive_summary` and `RedTeamReportGenerator` in `ares-core/src/reports/redteam.rs` covering various summary scenarios and edge cases
- Added default value and argument validation tests for configuration structs in `ares-llm/src/agent_loop/config.rs`
- Added unit tests for context token estimation, message trimming, tool output truncation, and tool call detection logic in `ares-llm/src/agent_loop/context.rs`
- Added tests for hashing determinism, edge cases, and input variations in `ares-llm/src/agent_loop/retry.rs`
- Added unit tests for argument parsing utility functions in `ares-tools/src/args.rs` including required/optional string, integer, and boolean extraction with error handling
- Added tests for credential string generation and argument formatting functions in `ares-tools/src/credentials.rs`, covering all supported input combinations and edge cases
**Added:**

- Implemented unit tests for detection gap analysis functions, including coverage for IOC and technique gap descriptions, summary generation, and recommendations - `ares-core/src/eval/gap_analysis/analysis.rs`
- Added extensive unit tests for scoring logic, covering IOC detection, technique coverage, pyramid elevation, evidence quality, timeline accuracy, matching functions, and overall scoring - `ares-core/src/eval/scorers/scoring.rs`
…erage

**Added:**

- Added public test-only wrapper for `calculate_technique_coverage` to facilitate unit testing in `engine.rs`
- Introduced extensive tests for key matching, recommendation, gap reasons, match quality, and correlation scenarios in `tests.rs`
- Added new module with unit tests for activity and detection keys, match quality, and `CorrelationReport::to_value` in `types.rs`
**Added:**

- Added unit tests for `looks_like_hostname` and `LateralMovementAnalyzer` methods, covering hostname validation, graph creation, host extraction, attack path, and pivot suggestions in `analyzer.rs`
- Added comprehensive unit tests for `generate_report_markdown` in `report.rs`, including metrics, assessment levels, section presence, recommendations, and edge cases
**Changed:**

- Renamed test functions across multiple modules to concise, descriptive names that reflect their behavior rather than using the `test_` prefix, improving test discoverability and consistency with Rust idioms
- Removed redundant or explanatory comments within test bodies that restated obvious behavior or implementation details, resulting in cleaner and more maintainable test code
- Grouped assertions and related checks in some tests to reduce repetition and streamline code, especially where multiple `Default` checks were previously split into separate tests
- Ensured all test functions use lowercase with underscores as per Rust conventions for improved readability
**Changed:**

- Renamed all test functions to remove the "test_" prefix for consistency and brevity across the codebase
- Updated function calls and references accordingly in test modules
- Improved code readability by standardizing test function naming conventions
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 22, 2026

Codecov Report

❌ Patch coverage is 99.97794% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 58.91%. Comparing base (edf0076) to head (566d9a5).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
ares-core/src/detection/mod.rs 98.90% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #231      +/-   ##
==========================================
+ Coverage   56.69%   58.91%   +2.21%     
==========================================
  Files         382      383       +1     
  Lines       65001    67884    +2883     
==========================================
+ Hits        36850    39991    +3141     
+ Misses      28151    27893     -258     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

l50 added 4 commits April 22, 2026 11:41
…rror handling

**Added:**

- Add test to verify that templates_for_connection_type returns entries for "smb" connection type

**Changed:**

- Simplify error handling in find_template tests by replacing unwrap_or_else with expect for clearer intent and improved readability
**Changed:**

- Removed decorative separator comments (lines of dashes or similar) from test modules in multiple files to improve readability and reduce noise
- Replaced multi-line unwrap/assert chains in tests with explicit expect messages for clarity in ares-core/src/token_usage.rs, ares-core/src/correlation/alert/correlator.rs, ares-cli/src/orchestrator/automation/shadow_credentials.rs, and ares-cli/src/orchestrator/automation/unconstrained.rs

**Removed:**

- Removed comment blocks delineating test case groups in test modules across the following files:
    - ares-cli/src/ops/loot/format/display.rs
    - ares-cli/src/orchestrator/automation/adcs_exploitation.rs
    - ares-cli/src/orchestrator/automation/gmsa.rs
    - ares-cli/src/orchestrator/automation/laps.rs
    - ares-cli/src/orchestrator/automation/s4u.rs
    - ares-cli/src/orchestrator/automation/shadow_credentials.rs
    - ares-cli/src/orchestrator/automation/unconstrained.rs
    - ares-cli/src/orchestrator/deferred.rs
    - ares-core/src/persistent_store/store.rs
    - ares-tools/src/credentials.rs
**Removed:**

- Removed commented section banners delineating test areas in test files to improve readability and reduce noise in `ares-cli/src/dedup/tests.rs`, `ares-cli/src/orchestrator/result_processing/tests.rs`, and `ares-tools/src/privesc/delegation.rs`
**Changed:**

- Renamed all test functions to remove the `test_` prefix, making test names idiomatic and concise across all modules and files
- Ensured all test function names now use the pattern `fn <descriptive_name>()` for improved readability and consistency
@l50 l50 merged commit 19dde80 into main Apr 22, 2026
11 checks passed
@l50 l50 deleted the chore/improve-test-coverage branch April 22, 2026 18:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant