DumpsterFire Toolset - "Security Incidents In A Box!" The DumpsterFire Toolset is a modular, menu-driven, cross-platform too...
DumpsterFire Toolset - "Security Incidents In A Box!"
The DumpsterFire Toolset is a modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor/alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Turn paper tabletop exercises into controlled "live fire" range events. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.The toolset is designed to be dynamically extensible, allowing you to create your own Fires (event modules) to add to the included collection of toolset Fires. Just write your own Fire module and drop it into the FireModules directory. The DumpsterFire toolset will auto-detect your custom Fires at startup and make them available for use.
Author
Joe Gervais (TryCatchHCF)
Tutorial
See my CactusCon 2017 slides (included in the project). The slides are written to stand on their own, providing background, approaches, specific use cases, and more. They'll put everything in context, and also won't put you to sleep. Unless they do put you to sleep, in which case you probably needed some rest anyway, so really we all come out ahead here.
Files & Directories
dumpsterFireFactory.py – Menu-driven tool for creating, configuring, scheduling, and executing DumpsterFires
FireModules/ – Directory that contains subdirectories of Fires, each subdirectory is a specific Category of Fires to keep your Fire modules organized. Fires are added to a DumpsterFire to create a chain of events and actions.
DumpsterFires/ – Directory containing your collection of DumpsterFires
igniteDumpsterFire.py – Headless script, invoked at the command line with the filename of the DumpsterFire you wish to execute. Useful for igniting distributed DumpsterFires.
testFireModule.py – Utility script for unit testing the Class methods of your custom Fire modules, without the hassle of running through the entire DumpsterFire Factory process to debug. Also useful for running a single Fire to check your settings. testFireModule.py will prompt you for configuration settings were applicable.
__init__.py files – Required to make Python treat directories as containing Python packages, allows DumpsterFire toolset to find and load Fire modules.
Requirements
Python 2.7.x [Download Python 2.7.x ##download##]
Run DumpsterFire Factory
[$ ./dumpsterFireFactory.py]
