Add purple team extensions: sysmon, zeek, velociraptor#491
Open
AhmedAlrahbi wants to merge 1 commit into
Open
Conversation
- sysmon: agent-only extension deploying Sysmon64 with olafhartong modular config to all Windows domain machines. No new VM required. - zeek: Ubuntu 22.04 VM (192.168.x.53) running Zeek network security monitor. Passively inspects lab traffic with JSON logs and AD protocol analyzers (SMB, DCE-RPC, Kerberos, RDP, LDAP). - velociraptor: Ubuntu 22.04 VM (192.168.x.54) running Velociraptor DFIR server. Auto-generates server config, repacks Windows agent MSI, and deploys agents to all Windows domain machines. GUI on port 8889. All extensions support vmware, virtualbox, ludus, aws and azure providers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds three new extensions that turn GOAD into a purple team lab — enabling detection and response alongside the existing offensive scenarios.
sysmon— Agent-only (no new VM). Deploys Sysmon64 with olafhartong's modular config to all Windows domain machines. Idempotent: updates the config if Sysmon is already installed.zeek— New Ubuntu 22.04 VM at<ip_range>.53(2 CPU / 2 GB). Passively monitors all lab network traffic with JSON logs. Pre-loads AD-relevant analyzers: SMB, DCE-RPC, Kerberos, RDP, LDAP. Includeszeekctl cronfor log rotation.velociraptor— New Ubuntu 22.04 VM at<ip_range>.54(2 CPU / 4 GB). Installs Velociraptor server, auto-generates server config, repacks the Windows agent MSI with embedded certs, and deploys agents to all Windows domain machines. GUI accessible on port8889.All three extensions follow the existing extension pattern (extension.json, inventory, ansible roles, providers for vmware/virtualbox/ludus/aws/azure).
Purple team value
These pair well with the existing
elkandwazuhextensions for full coverage.Test plan
install_extension sysmonon GOAD lab — confirm Sysmon64 service running on all DCs/workstationsinstall_extension zeek— confirmzeekctl statusshows running, logs appear in/opt/zeek/logs/current/install_extension velociraptor— confirm GUI accessible athttps://<ip>.54:8889, agents check in from all Windows machines🤖 Generated with Claude Code