项目说明
Awesome APT![Awesome]()
A curated list of Ad Persistent Threat (APT) frameworks, tools, resources, software, and tutorials. This list aims to help security researchers, threat hunters, and defenders find e related to APT attacks and defense in one place.
Contributing
Please take a quick look at the contribution first.
If you know a tool that isn't present here, feel free to open a pull request.
Why?
It takes time to build up a collection of tools used in APT research and remember them all. This repo helps to keep all these scattered tools in one place.
Contents
Awesome APT - Attack Simulation
- Initial Access
- Persistence
- Lateral Mo
- Command & Control
- Data Exfiltration
- Defense & Detection
- Threat Hunting
- Beha Analysis
- Network Analysis
- Memory Forensics
- Malware Analysis
- Endpoint Detection & Response
- Threat Intelligence Platforms
Resources - Operating Systems
- Starter Packs
- Tutorials & Courses
- Lab En
- Websites & Blogs
- Wikis & Knowledge Bases
- Analysis Reports
- Ad & Unique Resources
---
Attack Simulation
Frameworks & Platforms
MITRE ATT&CK Na – and plan ATT&CK matrices.CALDERA – Automated ad emulation system by MITRE.Atomic Red Team – ATT&CK-based test cases.Cobalt Strike – Commercial ad emulation platform.Sliver – Open-source red team C2 and implants.Metasploit Framework – Exploit and post-exploitation framework.Red Team Toolkit – Collection of red team tools.Red Hunt Labs APT Simulator – Windows APT activity simulator.AttackIQ – Commercial ad emulation platform.SafeBreach – Continuous breach platform.Picus Security – Threat-based security .ThreatQ – Threat intelligence integrated simulation platform.---
Initial Access
Gophish – Open-source phishing toolkit.King Phisher – Phishing campaign tool.Social-Engineer Toolkit – Social engineering attack framework.ReelPhish – Real-time two-factor phishing tool.E – Reverse proxy phishing framework.MailSniper – Email reconnaissance and phishing tool.Phishery – Simple phishing credential har.Modlishka – Ad reverse proxy phishing tool.---
Persistence
Impacket – Network protocol toolkit often used for credential access and persistence.PowerSploit – PowerShell post-exploitation modules.SharPersist – Windows persistence toolkit.WMIExec – WMI-based execution and persistence.DLL Hijacking – DLL search order hijacking reference.Startup Folder Persistence – Startup folder persistence technique.Scheduled Tasks – Scheduled task persistence reference.Service Registry Persistence – Windows service persistence.---
Lateral Mo
CrackMapExec – Swiss army knife for Windows network en.BloodHound – Acti relationship and attack path analysis.Mimikatz – Credential extraction and pri escalation tool.PsExec – Execute processes on remote Windows systems.Impacket SMBExec – Remote command execution over SMB.Responder – LLMNR/NBT-NS poisoning and credential capture.PowerView – Acti reconnaissance framework.SharpHound – Data collector for BloodHound.Rubeus – Kerberos abuse and ticket manipulation.Kerbrute – Kerberos brute force and enumeration tool.---
Command & Control
Co – .NET based C2 framework.Havoc – Modern and modular post-exploitation framework.Merlin – HTTP/2 based cross-platform C2.PoshC2 – PowerShell and Python command and control framework.Mythic – Collaborative red teaming platform.DeimosC2 – Modular cross-platform C2.TrevorC2 – Legitimate website based C2 channel.QuasarRAT – Remote administration and C2 tool.AsyncRAT – Open-source remote access tool.Sliver – Cross-platform implant and C2 framework.---
Data Exfiltration
DNSExfiltrator – Data exfiltration over DNS queries.DET – Data exfiltration toolkit.Cloakify – Transform data into harmless looking text.Egress-Assess – Test outbound data paths.Iodine – IP over DNS tunneling.DNScat2 – Encrypted DNS command and control tunnel.Ptunnel – ICMP tunneling tool.Rclone – Cloud storage synchronization and transfer.Exfil – File exfiltration o channels.Dropzone – Covert file transfer utility.---
Defense & Detection
Threat Hunting
MISP – Open threat intelligence sharing platform.OpenCTI – Cyber threat intelligence management.YARA – Pattern matching for malware detection.Sigma – Generic signature format for SIEM systems.Cortex – Observable analysis and response engine.TheHive – Security incident response platform.ThreatHunter Playbook – Threat hunting methodology and analytics.Maltego CE – Link analysis and OSINT platform.Security Onion – Threat hunting and network monitoring distro.GRR Rapid Response – Remote li framework.---
Beha Analysis
Sysmon – System activity monitoring for Windows.Osquery – SQL-powered operating system instrumentation. – Ad digital forensics and incident response.GRR Rapid Response – Remote li platform.Elastic Endpoint – Endpoint detection and pre.Wazuh – Open-source security monitoring and EDR.OSSEC – Host-based intrusion detection system.Falco – Runtime security for containers and cloud.Sysdig Secure – Container runtime security monitoring.Redline – Endpoint memory and beha analysis tool.---
Network Analysis
Zeek – Network security monitoring platform.Suricata – High-performance IDS/IPS engine.Wireshark – Network protocol analyzer.Snort – Open-source intrusion detection system.Arkime – Large-scale packet capture and search.ntopng – Network traffic analysis and monitoring.NetworkMiner – Network forensic analysis tool.Brim – Desktop network traffic analysis.tcpdump – Command-line packet analyzer.Corelight – Enterprise Zeek-based network detection.---
Memory Forensics
– Ad memory forensics framework. – Modern memory analysis platform.Rekall – Memory forensic framework.WinPmem – Windows memory acquisition.LiME – Linux memory extractor.Redline – Memory analysis and threat detection.Memoryze – Malware memory analysis.DumpIt – Memory acquisition utility.Belkasoft RAM Capturer – Live RAM capture tool.Magnet RAM Capture – Free memory capture utility.---
Malware Analysis
Ghidra – Software reverse engineering suite.IDA Free – Interacti and debugger.Cutter – GUI reverse engineering platform.Radare2 – Reverse engineering framework.Cuckoo Sandbox – Automated malware analysis.CAPE Sandbox – Malware configuration extraction.Any.Run – Interacti malware sandbox.Hybrid Analysis – Online malware analysis platform.PE-sieve – Detect injected malware in processes.x64dbg – Open-source Windows debugger.---
Endpoint Detection & Response
Wazuh – Open-source SIEM and EDR platform.Elastic Security – Open-source endpoint and SIEM.OSQuery Fleet – Device fleet monitoring and endpoint .CrowdStrike Falcon – Cloud-nati protection.Microsoft Defender for Endpoint – Enterprise endpoint security.SentinelOne – Autonomous AI endpoint protection.Sophos Intercept X – Ad endpoint defense.Bitdefender Gra – Endpoint protection platform.Trend Micro Apex One – Endpoint detection and response.Kaspersky Endpoint Security – Enterprise endpoint protection.---
Threat Intelligence Platforms
MISP – Open threat intelligence sharing platform.OpenCTI – Cyber threat intelligence management.ThreatConnect – Threat intelligence operations platform.Anomali – Threat intelligence and analytics.Recorded Future – Real-time threat intelligence.IBM X-Force Exchange – Threat intelligence sharing.AlienVault OTX – Open threat intelligence community. Intelligence – Malware intelligence and analysis.GreyNoise – Internet background noise intelligence.MalwareBazaar – Malware sample sharing platform.---
Resources
Operating Systems
Kali Linux – Penetration testing and security auditing distribution.Parrot Security OS – Security-focused GNU/Linux distribution.BlackArch – Arch Linux based penetration testing distro.REMnux – Linux toolkit for reverse engineering and malware analysis.Flare VM – Windows malware analysis en.SIFT Workstation – Digital forensics and incident response distro.Tsurugi Linux – DFIR and OSINT focused Linux distribution.CAINE – Computer Aided In En.BackBox – Ubuntu-based security distribution.Security Onion – Network security monitoring OS.---
Starter Packs
APT Simulator – Windows batch script simulating APT acti.Red Team Automation – Scripts to simulate attacker techniques.PurpleSharp – C# ad simulation tool.Atomic Red Team – Portable atomic security tests.In – PowerShell runner for Atomic tests.DetectionLab – Prebuilt blue team lab en.Threat Hunter Playbook Labs – Hunting lab scenarios.Security Blue Team Toolkit – Defensi tool collection.Red Team Field Manual – Red team reference toolkit.Blue Team Handbook Tools – Blue team tool references.---
Tutorials & Courses
MITRE ATT&CK Training – Official ATT&CK learning resources.Cybrary – Security training platform.SANS SEC565 – Red team ad emulation course.SANS SEC504 – Incident handling course.Coursera Cybersecurity – Uni security courses.edX Cybersecurity – Academic cybersecurity programs.OpenSecurityTraining – Free low-le training.PentesterLab – Hands-on penetration testing labs.Hack The Box Academy – Structured security training.TryHackMe – Beginner-friendly security learning platform.---
Lab En
DetectionLab – based security lab.Security Onion Lab – Blue team monitoring lab.AD Security Lab – Acti attack/defense lab.Modern Windows Attacks Lab – Windows attack scenarios.Purple Team Lab – Attack and detection lab.Malware Traffic Analysis Lab – Packet analysis exercises.Red Team Toolkit Lab – Offensive lab tools.Blue Team Labs Online – DFIR and detection practice.RangeForce Community Edition – Security training simulator.CyberDefenders – Blue team challenge labs.---
Websites & Blogs
MITRE ATT&CK – Ad tactics and techniques knowledge base.Mandiant Threat Intelligence – APT reports and research.CrowdStrike Blog – Threat intelligence articles.Kaspersky Securelist – Malware and APT analysis.The DFIR Report – Incident response case studies.Red Canary Blog – Threat detection research.FireEye Blog – Ad threat research.Unit 42 – Palo Alto threat intelligence.Talos Intelligence – Cisco threat research.BleepingComputer – Security news and incident co.---
Wikis & Knowledge Bases
APT Notes – Collection of public APT reports.Malpedia – Malware encyclopedia.Threat Actor Encyclopedia – Ad group database. – Malware scanning and intelligence.Hybrid Analysis – Malware behavior database.Exploit Database – Public exploit archive.C – database.NVD – National database.OWASP – Web security knowledge base.Security Wiki – General security knowledge.---
Analysis Reports
#### Annual / Global Threat Reports
Mandiant M-Trends – Annual global cyber threat and incident response report.CrowdStrike Global Threat Report – Yearly ad and intrusion trends analysis.Microsoft Digital Defense Report – Global cybercrime and nation-state threat o.Cisco Talos Annual Threat Report – Enterprise threat intelligence insights.IBM X-Force Threat Intelligence Index – Global attack statistics and threat patterns.Kaspersky Security Bulletin – Malware and APT yearly analysis.Palo Alto Unit 42 Threat Reports – Nation-state and targeted attack studies.ESET Threat Report – Quarterly and annual malware/APT trends.Trend Micro Annual Cybersecurity Report – Global enterprise threat landscape.Sophos Threat Report – Enterprise defense and attack e analysis.#### Targeted & Thematic APT Reports
FireEye Mandiant Threat Intelligence Reports – In-depth targeted attack and APT group analysis reports.Kaspersky Threat Intelligence Reports – APT campaigns, malware trends, and strategic threat analysis.Symantec (Broadcom) Threat Intelligence – Global threat activity and APT research publications.Recorded Future Threat Intelligence Reports – Nation-state actor tracking and campaign analysis.Google Threat Analysis Group (TAG) – Ad persistent threat in and security disclosures.CERT/CC Notes & Reports – Coordinated disclosures and incident reports.CISA / US-CERT Ad – Critical infrastructure alerts and APT-related ad.Dragonfly (Energetic Bear) Case Study – Unit42 – Detailed analysis of the Dragonfly APT group operations.APT29 (Cozy Bear) Analysis – Securelist – Beha and operational analysis of APT29 campaigns.Operation Aurora Technical Analysis – Google – Historical deep dive into the Operation Aurora intrusion campaign.#### & Red Team Case Studies
BlackBerry Cylance Threat Research – Threat research, malware behavior studies, and ad techniques.Palo Alto Networks Unit 42 Blog – Ad threat intelligence and malware re reports.Cisco Talos Intelligence Blog – Attack trend monitoring and technical breakdowns.Kaspersky Securelist Technical Reports – Malware deep dives and APT campaign in.SANS Internet Storm Center – Daily security event analysis and emerging threat monitoring.Red Canary Threat Detection Reports – Detection strategies and real-world incident case studies.#### Academic & Research Papers
IEEE Xplore – Cybersecurity Papers – Large collection of peer-re cybersecurity and threat research papers.ACM Digital Library – Security & Privacy – Academic publications on computer security and privacy.USENIX Security Symposium Papers – Top-tier security research conference papers.NDSS Symposium Papers – Network and Distributed System Security research.arXiv – Cryptography and Security – Open access preprints on security research.Google Scholar – APT Research – Academic search engine for threat and APT studies.ResearchGate – Cybersecurity – Research sharing platform for academic papers.Springer – Computer Security – Books and journals on information security.Elsevier – Computers & Security Journal – Peer-re journal on cybersecurity.IACR ePrint Archive – Cryptography and applied security research archive.#### Go & CERT Reports
CISA Cybersecurity Ad – Official U.S. go and threat ad.NCSC UK Reports – UK National Cyber Security Centre threat and incident reports.ENISA Threat Landscape – European Union cybersecurity threat landscape analysis.CERT-EU Security Ad – EU institutional incident and ad.JPCERT/CC Reports – Japanese incident response and threat analysis publications.ANSSI Publications – French national cybersecurity agency reports.Australian Cyber Security Centre (ACSC) – National cyber threat and incident reports.NIST Computer Security Publications – U.S. standards, frameworks, and security guidelines.Canadian Centre for Cyber Security – National alerts, ad, and research.Singapore CSA Reports – National cybersecurity ad and annual reviews.#### Datasets & Threat Feeds
Public Datasets – Malware samples, hashes, and beha intelligence.MalwareBazaar – Public malware sample sharing platform.Abuse.ch Threat Feeds – IOC feeds including URLhaus, SSLBL, and Feodo Tracker.AlienVault OTX Pulses – Community-dri intelligence pulses and indicators.GreyNoise Intelligence – Internet background noise and scanner activity data.Shodan – Internet-connected device intelligence and exposure data.Censys – Internet-wide scanning datasets and certificates.The Zoo Malware Repository – Open malware sample repository for research.Open Threat Exchange API – Programmatic access to threat indicators.CIRCL Passive DNS – Passive DNS historical datasets.#### Ad & Unique Resources
Original Security Research Papers – In-depth analysis, exploit chains, and defensi authored by the repository owner.Automation Toolkits – Custom penetration testing scripts, scanners, and workflow automation utilities.Red / Blue Team Playbooks – Tactical guides for attack simulation and defense response.CTF Practice Labs – Self-built en with walkthroughs and solution write-ups.Code Audit Checklists – Practical auditing standards, secure coding references, and real-world case studies.Security Framework Templates – Policy, compliance, and go document templates for organizations.AI-Assisted Security Tools – Experimental ML / AI models for anomaly detection, log analysis, and threat prediction.Plugin & Extension Ecosystem – Community-dri and integrations expanding core tools.API & SDK Access – Programmable interfaces for automation, data retrieval, and third-party integrations.Private Research Notes – Exclusi notes, exploit PoCs, and methodology breakdowns.#### Professional & Commercial Extensions
Enterprise Training Programs – Structured corporate cybersecurity courses and customized learning paths.Certification Paths – Skill systems and internal certification standards.Consulting & Technical Support – Direct expert assistance and long-term ad services.Private Knowledge Base – Members-only ad materials, toolkits, and premium guides.Security Tool Licensing – Commercial licensing for proprietary scanners and frameworks.Bug Bounty Collaboration Hub – Organized research and coordinated disclosure channels.Research Sponsorship Opportunities – Funded research topics and partnership initiatives.Contribution Reward System – Incenti for acti and maintainers.#### Community & Growth Layer
Monthly Security Reports – Trend summaries, statistics, and threat landscape analysis.Discussion Forum / Discord / – Centralized communication platforms for collaboration.Contributor Leaderboard – Public recognition and ranking of top contributors.Events & Workshops – Online webinars, offline meetups, and technical workshops.Newsletter Subscription – Periodic curated updates, announcements, and featured research.Community Challenges – Regular technical challenges and mini-CTF events.Open Go Board – Transparent decision-making structure for community direction.Mentorship Program – Guidance channels connecting beginners with experienced researchers.LICENSE
CC0
项目信息
开发语言：未知
Star 数：9
技术要点
该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of APT tools, frameworks, intelligence platforms, and defensive resources. Designed for researchers and security professionals to explore adversary simulation, malware analysis, threat hunting, and defense strategies in one place.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。