A Windows Batch script toolset that simulates Advanced Persistent Threat (APT) attack indicators to test security monitoring and detection capabilities.
APTSimulator is a Windows-based tool that simulates Advanced Persistent Threat (APT) attack behaviors to test security monitoring, endpoint detection, and incident response capabilities. It executes a curated set of malicious activities—such as LSASS dumping, web shell deployment, and persistence mechanisms—generating realistic indicators of compromise without requiring complex setup.
Security professionals, SOC analysts, and red teams who need to validate detection rules, assess security tool effectiveness, or prepare forensic training environments on Windows systems.
Unlike heavier adversary simulation platforms, APTSimulator is a lightweight, dependency-free Batch script that delivers realistic APT tradecraft in under a minute, making it ideal for quick proofs-of-concept and detection gap analysis.
A toolset to make a system look as if it was the victim of an APT attack
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Runs as a single Batch script without external servers, databases, or prerequisites, making it instantly usable on any Windows system.
Simulates over 20 MITRE ATT&CK techniques, such as LSASS dumping and web shell deployment, generating authentic indicators of compromise for detection validation.
Uses encrypted archives for tools and includes an AV exclusion module to avoid early detection, mimicking real attacker methods.
Users can add custom test cases by creating new Batch files and integrating tools into the build process, with clear instructions in the README.
Exclusively designed for Windows systems, limiting its utility for testing security controls on other operating systems like Linux or macOS.
Marked as 'Not Maintained' with no updates or bug fixes, potentially leaving it outdated against evolving APT tactics.
Lacks built-in analytics or dashboards; users must manually check detection results from their security tools, adding overhead.