mitre/caldera

https://img.shields.io/badge/dynamic/json?color=blue&label=Release&query=tag_name&url=https%3A%2F%2Fapi.github.com%2Frepos%2Fmitre%2Fcaldera%2Freleases%2Flatest](https://github.com/mitre/caldera/releases/latest) https://github.com/mitre/caldera/actions/workflows/testing.yml/badge.svg?branch=master](https://github.com/mitre/caldera/actions/workflows/testing.yml?query=branch%3Amaster) https://github.com/mitre/caldera/actions/workflows/security.yml/badge.svg?branch=master](https://github.com/mitre/caldera/actions/workflows/security.yml?query=branch%3Amaster) ![codecov]([] ![Documentation Status]([]

CALDERA™

Full documentation, training and use-cases can be found here.

CALDERA™ is a cyber security framework designed to easily automate adversary emulation, assist manual red-teams, and automate incident response.

It is built on the MITRE ATT&CK™ framework and is an active research project at MITRE.

The framework consists of two components:

1. The core system. This is the framework code, consisting of what is available in this repository. Included is an asynchronous command-and-control (C2) server with a REST API and a web interface.
2. Plugins. These repositories expand the core framework capabilities and providing additional functionality. Examples include agents, reporting, collections of TTPs and more.

Plugins

:star: Create your own plugin! Plugin generator: https://github.com/mitre/skeleton :star:

Default

• https://github.com/mitre/access (red team initial access tools and techniques)
• https://github.com/mitre/atomic (Atomic Red Team project TTPs)
• https://github.com/mitre/builder (dynamically compile payloads)
• https://github.com/mitre/caltack.git (embedded ATT&CK website)
• https://github.com/mitre/compass (ATT&CK visualizations)
• https://github.com/mitre/debrief (operations insights)
• https://github.com/mitre/emu (CTID emulation plans)
• https://github.com/mitre/fieldmanual (documentation)
• https://github.com/mitre/gameboard (visualize joint red and blue operations)
• https://github.com/mitre/human (create simulated noise on an endpoint)
• https://github.com/mitre/manx (shell functionality and reverse shell payloads)
• https://github.com/mitre/mock (simulate agents in operations)
• https://github.com/mitre/response (incident response)
• https://github.com/mitre/sandcat (default agent)
• https://github.com/mitre/SSL (enable https for caldera)
• https://github.com/mitre/stockpile (technique and profile storehouse)
• https://github.com/mitre/training (certification and training course)

More

These plugins are ready to use but are not included by default:

• https://github.com/center-for-threat-informed-defense/caldera_pathfinder (vulnerability scanning)
• https://github.com/mitre/saml (SAML authentication)

Requirements

These requirements are for the computer running the core framework:

• Any Linux or MacOS
• Python 3.6.1+ (with Pip3)
• Google Chrome is our only supported browser
• Recommended hardware to run on is 8GB+ RAM and 2+ CPUs

Installation

Start by cloning this repository recursively, passing the desired version/release in x.x.x format. This will pull in all available plugins. If you clone master - or any non-release branch - you may experience bugs.

Bash
git clone https://github.com/mitre/caldera.git --recursive --branch 3.1.0

Next, install the PIP requirements:

Bash
pip3 install -r requirements.txt

Super-power your CALDERA server installation! Install GoLang (1.13+)

Finally, start the server.

Bash
python3 server.py --insecure

Collectively this would be:

Bash
git clone https://github.com/mitre/caldera.git --recursive --branch 3.1.0
cd caldera
pip3 install -r requirements.txt
python3 server.py --insecure

Once started, you should log into http://localhost:8888 using the credentials red/admin. Then go into Plugins -> Training and complete the capture-the-flag style training course to learn how to use the framework.

Video tutorial

Watch the following video for a brief run through of how to run your first operation.

Contributing

Refer to our contributor documentation.

Licensing

In addition to CALDERA™'s open source capabilities, MITRE maintains several in-house CALDERA™ plugins that offer more advanced functionality. For more information, or to discuss licensing opportunities, please reach out to *** or directly to MITRE's Technology Transfer Office.