Attack techniques for Threat Emulation in VMware environments
Browse them live at https://virtualattack.reversec.com
A comprehensive collection of 80+ individual atacker actions that can be simulated against VCF environments in Purple Team exercises. Grounded in threat intelligence and accompanied by log sources for defenders.
Detection capability in VMware/VCF/vSphere estates remains low or inexistent
Despite the criticality of the virtualisation environment, organisations do not proactively invest in the resilience against threats...
🟣VMware Threat Emulations
To empower security teams to build detections and hunt threats, this repo provides reproducible attack test cases mapped to the MITRE ATT&CK framework. These can be used in adversary emulation drills, to ultimately drive:
- assessment of preventative controls
- discovery of blind spots
- development of detections
- identification of any design or architectural issues
By cloning this repo and maintaining internally for their own environment, purple teams can continuously stress the defences of their own VMware/VCF defences.
Test cases can be found in src/content, organised per VCF component. Each test case is a separate .md file in src/content/test-cases/[component]/, with only one technique allowed in every .md file.
📦 What Is Covered & What Not
-
Beyond vSphere - This collection includes not only the usual vCenter and ESXi attacks, but covers also VMware components of security significance in the VCF ecosystem such as the SDDC Manager, as well as crucial integrations like Active Directory.
-
Real World techniques - The majority of test cases have been extracted from threat intelligence reports detailing real-world vSphere incidents. Additionally, a few test cases have been included that are not yet documented, but can be executed practively to assess controls and tailor detections.
-
Reproducible - For the offensive practitioner, each technique comes with detailed insructions and links to origin sources to ensure each test case can be carried out reproducibly.
-
Defender-friendly - For the blue teamer, each test case also comes with the Log Sources where evidence is expected to be recorded, aiding the triage process.
A design decision was made during compilation of the collection to leave out:
-
CVE exploits - Various CVEs are actively discovered in VMware products across the different versions. Even where publicly available PoCs exist, these do not represent attack techniques in the Adversary Emulation sense, and can simply be addressed by patching.
-
Known-malware samples - For safety purposes, purpose-built malware recovered from past incidents such as BEEFLUSH and VIRTUALPITA are also not included in this library. Instead of focusing on static artifacts that can be trivially signatured, this project focuses on building resilience at higher levels of the Pyramid of Pain.
💻 Browse The Collection
Visit virtualattack.reversec.com for an HTML UI powered by Astro, featuring dynamic test case/VMware component filtering, a responsive design, and even a dark theme!
🤝Contributing
As the VCF threat landscape evolves, contributions by the community are welcome and encouraged.
To add new test cases, simply:
-
Fork the repo
-
(Optional) Check out the
/add-test-caseagent skill to streamline authoring of standard .md test cases from e.g. a threat intellifgence link -
Add new
.mdfiles following thetemplate.md -
Make sure it looks as expected with
npm install && npm run dev -
(Optional) Set up the pre-commit hook that runs the
generate-badge.pyscript to auto-update Technique & Component badges
cp .hooks/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
- Open a Merge Request
This project is inspired by:
- Atomic Red Team - The de facto threat emulation framework
- Leonidas - Cloud Attack Simulation framework, complete with attack definitions
- Detection in the Cloud - Rendered Leonidas attack definitions
- Kubenomicon - A similar resource for Kubernetes
- Wiz Cloud Threat Landscape - Browsable UI tracking cloud incidents