redteam

Documentation

Overview

Package redteam provides scenario definitions and runnable prevention tests for ShiftLock security controls.

Index

• type Result
  • func Run(id ScenarioID) (Result, error)
  • func RunAll() ([]Result, error)
• type Scenario
  • func Catalog() []Scenario
• type ScenarioID

Types

type Result

type Result struct {
	ID      ScenarioID `json:"id"`
	Passed  bool       `json:"passed"`
	Denied  bool       `json:"denied"`
	Message string     `json:"message"`
}

Result is the outcome of running a scenario.

func Run

func Run(id ScenarioID) (Result, error)

Run executes a scenario by ID.

func RunAll

func RunAll() ([]Result, error)

RunAll executes every runnable catalog scenario.

type Scenario

type Scenario struct {
	ID                    ScenarioID `json:"id"`
	Title                 string     `json:"title"`
	Threat                string     `json:"threat"`
	Description           string     `json:"description"`
	Preconditions         []string   `json:"preconditions,omitempty"`
	AttackSequence        []string   `json:"attack_sequence,omitempty"`
	ExpectedDetection     string     `json:"expected_detection,omitempty"`
	ExpectedPrevention    string     `json:"expected_prevention,omitempty"`
	ExpectedAuditEvidence string     `json:"expected_audit_evidence,omitempty"`
	ExpectedLockdown      string     `json:"expected_lockdown,omitempty"`
	RequiredRecovery      string     `json:"required_recovery,omitempty"`
	ExpectDeny            bool       `json:"expect_deny"`
	Runnable              bool       `json:"runnable"`
}

Scenario describes an attack simulation with expected controls.

func Catalog

func Catalog() []Scenario

Catalog returns known scenarios (runnable and documented).

type ScenarioID

type ScenarioID string

ScenarioID identifies a red-team scenario.

const (
	ScenarioForgedGeneration          ScenarioID = "forged-generation"
	ScenarioStolenCapability          ScenarioID = "stolen-capability"
	ScenarioReplayedCommand           ScenarioID = "replayed-command"
	ScenarioStaleOwner                ScenarioID = "stale-owner"
	ScenarioMaliciousCandidate        ScenarioID = "malicious-candidate"
	ScenarioAuditTampering            ScenarioID = "audit-tampering"
	ScenarioConfigurationSubstitution ScenarioID = "configuration-substitution"
	ScenarioProtocolDowngrade         ScenarioID = "protocol-downgrade"
	ScenarioQuorumCollusion           ScenarioID = "quorum-collusion"
	ScenarioCandidateFlood            ScenarioID = "candidate-flood"
	ScenarioLockdownBypass            ScenarioID = "lockdown-bypass"
	ScenarioSecretExfiltration        ScenarioID = "secret-exfiltration-attempt"
)