An information security preparedness tool to do adversarial simulation.
Switch branches/tags
Nothing to show
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
MITRE Update execution_win_bitsadmin.yml Jun 20, 2018
docs/images Add files via upload Feb 5, 2018
helper_scripts from __future__ import print_function Mar 15, 2018
reporting add the code Nov 2, 2017
vagrant/aws add the code Nov 2, 2017
workers pep8 cleanup May 16, 2018
.gitignore updates Nov 15, 2017
LICENSE Update LICENSE Nov 1, 2017 Update Apr 5, 2018
config.ini kali support May 16, 2018
requirements.txt add the code Nov 2, 2017 pep8 cleanup May 16, 2018 Update Mar 26, 2018 add the code Nov 2, 2017


Metta is an information security preparedness tool.

This project uses Redis/Celery, python, and vagrant with virtualbox to do adversarial simulation. This allows you to test (mostly) your host based instrumentation but may also allow you to test any network based detection and controls depending on how you set up your vagrants.

The project parses yaml files with actions and uses celery to queue these actions up and run them one at a time without interaction.



There is also a wiki

Running actions

The various actions live in the MITRE folder sorted by MITRE ATT&CK phases and also in Adversarial_Simulation

Just run the python and yaml file of your choice

$ python -f MITRE/Discovery/discovery_win_account.yml
YAML FILE: MITRE/Discovery/discovery_account.yaml
OS matched windows...sending to the windows vagrant
Running: cmd.exe /c net group \"Domain Admins\" /domain
Running: cmd.exe /c net user /add
Running: cmd.exe /c net user /domain
Running: cmd.exe /c net localgroup administrators
Running: cmd.exe /c net share
Running: cmd.exe /c net use
Running: cmd.exe /c net accounts
Running: cmd.exe /c net config workstation
Running: cmd.exe /c dsquery server
Running: cmd.exe /c dsquery user -name smith* | dsget user -dn -desc
Running: cmd.exe /c wmic useraccount list /format:list
Running: cmd.exe /c wmic ntdomain
Running: cmd.exe /c wmic group list /format:list
Running: cmd.exe /c wmic sysaccount list /format:list

Making actions

The actions and scenarios live in the MITRE folder sorted by MITRE ATT&CK phases and also in Adversarial_Simulation actions example

The most important parts are the OS field and the purple_actions

os: will tell the tool which vagrant to send the command to, obviously *nix commands on windows wont work out so well

purple_actions: an array of commands to run sequentially

Making scenarios

Scenarios are a list of paths to actions.

The code will be looking for a scenario: True field and scenario_actions list. Example below: scenario example


The tool takes the string from purple_actions and encapsulates it in quotes. Therefore you need to escape any other quotes, ticks, weird shell characters in your command.

Use the output of the vagrant/celery piece to make sure things are working like they should

Why Metta?

Metta (Pali) Loving kindness, gentle friendship; a practice for generating loving kindness said to be first taught by the Buddha as an antidote to fear. It helps cultivate our natural capacity for an open and loving heart and is traditionally offered along with other Brahma-vihara meditations that enrich compassion, joy in the happiness of others and equanimity. These practices lead to the development of concentration, fearlessness, happiness and a greater ability to love.