derf

DeRF, the Detection Replay Framework, emulates offensive techniques in the cloud and produces repeatable detection samples from a UI, targeting AWS and GCP with no install for the person running it.

DeRF, the Detection Replay Framework, is an attacks-as-a-service framework. It allows the emulation of offensive techniques and the generation of repeatable detection samples from a UI, without end users needing to install software. The README is careful to position it as a detection testing tool rather than a general purpose exploit kit.

DeRF is deployed across a targeted AWS account and a GCP project with Terraform. Deployment steps start with completing prerequisites, then system requirements, then cloning the GitHub repository to the local system. A single deployment targets both cloud providers.

Attack execution targeting both AWS and GCP is performed by invoking a Google Cloud Workflow. That workflow can be invoked either on the Google Cloud Console or programmatically with the gcloud command line tool. The console path involves navigating to the workflows page, selecting the matching workflow, and clicking the execute button.

For programmatic execution, the README says to make sure the Google command line tool is installed locally, authenticate to the Google Cloud project where DeRF is deployed, and invoke a particular attack technique's workflow with gcloud. Documentation for the workflows service is referenced for complete instructions. The project documentation is built with mkdocs using the material theme, and can be rendered locally or served through a shortcut. Similar projects are listed: Status Red Team by DataDog, CNAPPGoat by Ermetic, Atomic Red Team by Red Canary, Leonidas by F-Secure, and pacu and CloudGoat by Rhino Security Labs.

• Source 1 · Project repository
• Source 2 · README