{"id":13670228,"url":"https://github.com/d3vzer0/reternal-quickstart","last_synced_at":"2025-04-27T09:32:11.562Z","repository":{"id":53533960,"uuid":"164096409","full_name":"d3vzer0/reternal-quickstart","owner":"d3vzer0","description":"Repo containing docker-compose files and setup scripts without having to clone the individual reternal components","archived":true,"fork":false,"pushed_at":"2021-03-25T22:22:57.000Z","size":1680,"stargazers_count":108,"open_issues_count":9,"forks_count":24,"subscribers_count":12,"default_branch":"development","last_synced_at":"2024-08-03T09:07:12.701Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/d3vzer0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-01-04T10:57:22.000Z","updated_at":"2023-12-01T03:22:32.000Z","dependencies_parsed_at":"2022-08-20T12:20:26.449Z","dependency_job_id":null,"html_url":"https://github.com/d3vzer0/reternal-quickstart","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3vzer0%2Freternal-quickstart","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3vzer0%2Freternal-quickstart/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3vzer0%2Freternal-quickstart/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3vzer0%2Freternal-quickstart/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/d3vzer0","download_url":"https://codeload.github.com/d3vzer0/reternal-quickstart/tar.gz/refs/heads/development","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224067054,"owners_count":17250103,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T09:00:36.547Z","updated_at":"2024-11-11T07:31:19.506Z","avatar_url":"https://github.com/d3vzer0.png","language":"Python","funding_links":[],"categories":["Red and Purple Team"],"sub_categories":["Tools"],"readme":"#  RE:TERNAL\n-------------\n\n\u003cimg src=\"https://i.postimg.cc/7hwhx4Dp/reternal.png\" alt=\"Drawing\" style=\"width: 300px;\"/\u003e\n\n![version](https://img.shields.io/badge/Version-Alpha_0.0.1-orange.svg)\n\n\n\n---------------------\n\n#### Note: Still under development, only use for testing and do not expose interfaces! Current compose doesn't work yet, only try when you know what you're doing #####\n\nRE:TERNAL is a centralised purple team orchestration service to manage third-party C2 frameworks. Agents are installed on endpoints to  to execute various known\nred-teaming techniques in order to test blue-teaming capabilities. The simulations are mapped to the MITRE ATT\u0026CK framework. This repo contains\nthe compose file in order to set up the reternal platform via docker. \n\nThere is a public preview available running the latest version @ https://reternal.d3vzer0.com (Github login required). Executing/saving campaigns and interacting with the C2 modules is disabled (for obvious reasons ;)).\n\n\n\n## Reternal components\n| Component        | Description | Code           | Build  |\n| ------------- |:-------------- |:--------------| :------| \n| [API](https://github.com/d3vzer0/reternal-backend)      | Administrative API to schedule tasks | ![Python](https://img.shields.io/badge/Python-3.8-green.svg) | [![Build Status](https://dev.azure.com/joeydreijer/Reternal/_apis/build/status/d3vzer0.reternal-ui?branchName=development)](https://dev.azure.com/joeydreijer/Reternal/_build/latest?definitionId=1\u0026branchName=development) |\n| [UI](https://github.com/d3vzer0/reternal-ui)     | VueJS-based UI buildscript and NGinx webserver |![VueJS](https://img.shields.io/badge/VueJS-2-green.svg) | [![Build Status](https://dev.azure.com/joeydreijer/Reternal/_apis/build/status/d3vzer0.reternal-ui?branchName=development)](https://dev.azure.com/joeydreijer/Reternal/_build/latest?definitionId=1\u0026branchName=development) |\n| [C2](https://github.com/d3vzer0/reternal-c2) | Distributed tasks to interact with external C2 frameworks | ![Python](https://img.shields.io/badge/Python-3.8-green.svg) | [![Build Status](https://dev.azure.com/joeydreijer/Reternal/_apis/build/status/d3vzer0.reternal-c2?branchName=development)](https://dev.azure.com/joeydreijer/Reternal/_build/latest?definitionId=3\u0026branchName=development) |\n| [Search](https://github.com/d3vzer0/reternal-search)     | Distributed tasks to execute search queries (ie. Splunk/Elasticsearch) for ATT\u0026CK coverage rating | ![Python](https://img.shields.io/badge/Python-3.8-green.svg) | [![Build Status](https://dev.azure.com/joeydreijer/Reternal/_apis/build/status/d3vzer0.reternal-search?branchName=development)](https://dev.azure.com/joeydreijer/Reternal/_build/latest?definitionId=4\u0026branchName=development) |\n| [Mitre](https://github.com/d3vzer0/reternal-mitre)     | Repository containing already existing mapped techniques for reternal |\n\n\n| Component        | Description | Build  |\n| ------------- |:-------------- | :------| \n| Total Stack | Build verifying entire stack via docker-compose in this repository | TODO |\n\n\n## Install and Configuration\nThis repository contains Ansible deployment playbooks to automate the local or remote installation and configuration for Reternal. The guide can be found on the repo's Wiki @ https://github.com/d3vzer0/reternal-quickstart/wiki.  \n\n\n## Developers and Contact\n\nJoey Dreijer \u003c joeydreijer@gmail.com \u003e  \nYaleesa Borgman \u003c yaleesa@gmail.com \u003e\n\n## Whats up with the name?\n\nThis project has been re-developed so many times, it will probably never really finish. Hence RE (Redo) and Ternal (Eternal).\n\n#### Special Thanks\n  - Rabobank DeTTECT - Framework for mapping your log coverage against MITRE ATT\u0026CK. Used the fundementals for the internal coverage rating and scenario suggestions: https://github.com/rabobank-cdc/DeTTECT\n  - MITRE ATT\u0026CK - Framework used for mapping simulations: https://attack.mitre.org/wiki/Main_Page\n  - Uber Metta -  Using Metta's templates for MITRE techniques with small (optional) adjustments to the purple_action format: https://github.com/uber-common/metta\n  - https://github.com/olafhartong/sysmon-modular - Splunk app with out-of-the-box queries to hunt for malicious events based on Sysmon\n  - https://www.splunksecurityessentials.com/ - Must have Splunk app to extend your current detection capabilities. The app analyses the available sourcetypes and provices suitable tips/tricks to improve the overal use of Splunk for Hunting and Detection.\n\n## Examples and screenshots\nAll of the features will be documented on the Welcome page of the Wiki @ https://github.com/d3vzer0/reternal-quickstart/wiki. Below are a few examples of the main components.\n\n### Actor / Technique mapping\nReternal automatically maps available commands and techniques to actors. You can directly add all the techniques commonly used by actors to your set of tasks.\n\u003cimg width=\"1226\" alt=\"actor_mapping\" src=\"screenshots/actor_mapping.png\"\u003e\n\n### Recipe / Graph builder\nScheduling tasks to be run on an agent is called a graph. You can add manual commands to a graph or select one of the existing mapped techniques or actor TTPs. You can drag/drop to change the order of the tasks in your graph.\n\n\u003cimg width=\"1180\" alt=\"campaign\" src=\"screenshots/graph_builder.png\"\u003e\n\n### C2 interaction\nReternal acts as a piece of middleware and interacts with external C2 frameworks. An example is shown below how Reternal manages external listeners and generates stagers.\n\u003cimg width=\"1226\" alt=\"actor_mapping\" src=\"screenshots/listener_mgt.png\"\u003e\n\n\u003cimg width=\"1226\" alt=\"actor_mapping\" src=\"screenshots/stager_builder.png\"\u003e\n\n### Coverage rating (based on Rabo DeTTECT)\nAutomatically synchronise the available datasources with your Splunk environment or add logsources manually. Reternal will suggest specific campaigns to execute based on your coverage rating.\n\n\u003cimg width=\"1226\" alt=\"actor_mapping\" src=\"screenshots/dettect2.png\"\u003e\n\nWith an overview of your coverage compared to all the ATT\u0026CK techniques:\n\u003cimg width=\"1226\" alt=\"attck_archive\" src=\"screenshots/attck_archive.png\"\u003e\n\n\n### Integrated Hunts\nAdditionally a list of Splunk queries are included to automatically validate simulations. Soon (tm) the scheduled campaign will automatically run relevant queries and present a detailed report containing the findings (ie. time when attack was performed vs. time of detection etc)\n\n\u003cimg width=\"1226\" alt=\"attck_archive\" src=\"screenshots/huntsquery.png\"\u003e\n\n\n### Campaign state and dashboard\nThe main dashboard displays the state of your running campaigns and displays the expected coverage of your datasources vs techniques\n\n\n\u003cimg width=\"1226\" alt=\"attck_archive\" src=\"screenshots/campaign_state.png\"\u003e\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd3vzer0%2Freternal-quickstart","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fd3vzer0%2Freternal-quickstart","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd3vzer0%2Freternal-quickstart/lists"}