🚨 Test your defense systems with live, high-fidelity cyberattacks — or build real-world datasets about attack traces! 🚨
Welcome to a repository of emulated cyberattacks generated by Aurora — an automated cyberattack emulation system powered by symbolic planning and large language models (LLMs). Perfect for stress-testing defenses or collecting detailed system traces during simulated intrusions.
- [Updated on 01/06/2025] We added emulated attacks customized based on 250 different CTI reports.
Aurora is a framework that can automatically construct cyberattacks for emulation. Using LLM capabilities, it leverages external attack tools and threat intelligence reports. This repository stores the outputs of Aurora. For more designing details about of Aurora, please refer to this page.
⏰ We are preparing publishing the source code of Aurora.
If you use the cyberattacks in this repo, please cite our paper. Thanks!
@article{wang2024sands,
title={From Sands to Mansions: Towards Automated Cyberattack Emulation with Classical Planning and Large Language Models},
author={Wang, Lingzhi and Li, Zhenyuan and Jiang, Yi and Wang, Zhengkai and Guo, Zonghan and Wang, Jiahui and Wei, Yangyang and Shen, Xiangmin and Ruan, Wei and Chen, Yan},
journal={arXiv preprint arXiv:2407.16928},
year={2024},
archivePrefix={arXiv},
url={https://arxiv.org/abs/2407.16928}
}
The attacks/ folder stores the emulated cyberattacks.
Each folder in attacks/ contains an attach chain, which includes:
readme.md: The human-readable documentation of the emulated attack;attack_chain.yml: The raw data of the emulated attack;attack_chain.py: The Python script to execute the emulated attack.
For more details, please refer to the introduction to attack chains.
We show how to reproduce (execute) the generated attacks in this section. Please clone this repo first:
git clone https://github.com/LexusWang/Aurora-demos.git && cd Aurora-demosViewing the attacks in this repo does not require any dependencies. To reproduce the attacks, however, you will need to install VirtualBox for deploying and managing virtual machines (we use VirtualBox as the default virtualization software; VMware users can manually download and deploy the virtual machines).
Specifically, You need to know the path of the command-line interface (CLI) tool for VirtualBox (e.g. C:\\Program Files\\Oracle\\VirtualBox\\VBoxManage.exe or /usr/bin/VBoxManage).
You first need to deploy the emulation environment, including both the attacker and victim machines.
Each attack plan defines its required environment in the attack_chain.yml file. You can easily deploy it by running a Python script. For example:
# Windows
python pull.py -vm C:\\Program Files\\Oracle\\VirtualBox\\VBoxManage.exe --attack_plan attacks/1_AA23-341A/attack_chain.yml
# Linux
python pull.py -vm /usr/bin/VBoxManage --attack_plan attacks/1_AA23-341A/attack_chain.ymlIf you want to build the emulation environments by yourself, please refer to this page.
We provide an example of the deployed attack emulation environments including two attacker machines and three victim machines here.
Once the emulation environment is deployed, follow the steps below to execute the attacks:
- Move
attack_chain.pyto the attacker machine; - Open the terminal, run
attack_chain.pyon the attacker machine; - Follow the guidance and instructions from the terminal, set the parameters (e.g. IP addresses of the related VMs);
- Some steps may need human intervention, please follow the guidance and instructions from the terminal.
Click the following headings to watch some demos:
EXAMPLE-1_AA23-341A
EXAMPLE-2_AA24-046A
EXAMPLE-3_ALPHVBlackcat
As demonstrated in the paper, Aurora can tailor generated attacks based on CTI reports to mimic specific real-world APT groups. While ensuring the correctness and causality of the attacks, Aurora selects TTPs that closely match those described in the reports. For instance, several actions in this repository simulate TTPs attributed to the Silver Fox threat actor, particularly their methods for defense evasion and persistence on Windows systems. Here are the CTI reports covered by in this repo.
Distributed under the Apache License 2.0 License.
See LICENSE for more information.
The attack chains are for education, research, and testing purpose.
The author does not condone any illegal use.
Use as your own risk.
- Lingzhi Wang - [email protected]
- Yi Jiang - [email protected]
- Zhengkai Wang - [email protected]