MITRE Caldera™

MITRE Caldera™ is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response.

It is built on the MITRE ATT&CK™ framework and is an active research project at MITRE.

The framework consists of two components:

1) The core system. This is the framework code, consisting of what is available in this repository. Included is an asynchronous command-and-control (C2) server with a REST API and a web interface. 2) Plugins. These repositories expand the core framework capabilities and providing additional functionality. Examples include agents, reporting, collections of TTPs and more.

Resources and Socials

• 📜 Documentation, training, and use-cases
• ✍️ Caldera's blog
• 🌐 Homepage

Plugins

:star: Create your own plugin! Plugin generator: Skeleton :star:

Default

These plugins are supported and maintained by the Caldera team. - Access (red team initial access tools and techniques) - Atomic (Atomic Red Team project TTPs) - Builder (dynamically compile payloads) - Caldera for OT (ICS/OT capabilities for Caldera) - Compass (ATT&CK visualizations) - Debrief (operations insights) - Emu (CTID emulation plans) - Fieldmanual (documentation) - GameBoard (visualize joint red and blue operations) - Human (create simulated noise on an endpoint) - Manx (shell functionality and reverse shell payloads) - Response (incident response) - Sandcat (default agent) - SSL (enable https for caldera) - Stockpile (technique and profile storehouse) - Training (certification and training course)

More

These plugins are ready to use but are not included by default and are not maintained by the Caldera team. - Arsenal (MITRE ATLAS techniques and profiles) - CalTack (embedded ATT&CK website) - Pathfinder (vulnerability scanning) - SAML (SAML authentication)

Requirements

These requirements are for the computer running the core framework:

• Any Linux or MacOS
• Python 3.8+ (with Pip3)
• Recommended hardware to run on is 8GB+ RAM and 2+ CPUs
• Recommended: GoLang 1.17+ to dynamically compile GoLang-based agents.

Installation

Concise installation steps: Bash git clone https://github.com/mitre/caldera.git --recursive cd caldera pip3 install -r requirements.txt python3 server.py --insecure

Full steps: Start by cloning this repository recursively, passing the desired version/release in x.x.x format. This will pull in all available plugins. Bash git clone https://github.com/mitre/caldera.git --recursive --branch x.x.x

Next, install the PIP requirements: Bash pip3 install -r requirements.txt Super-power your Caldera server installation! Install GoLang (1.17+)

Finally, start the server. Bash python3 server.py --insecure

Once started, log into http://localhost:8888 using the default credentials red/admin. Then go into Plugins -> Training and complete the capture-the-flag style training course to learn how to use Caldera.

Docker Deployment

To build a Caldera docker image, ensure you have docker installed and perform the following actions: ```Bash

Recursively clone the Caldera repository if you have not done so

git clone https://github.com/mitre/caldera.git --recursive

Build the docker image. Change image tagging as desired.

WIN_BUILD is set to true to allow Caldera installation to compile windows-based agents.

Alternatively, you can use the docker compose YML file via "docker-compose build"

cd caldera docker build . --build-arg WIN_BUILD=true -t caldera:latest

Run the image. Change port forwarding configuration as desired.

docker run -p 8888:8888 caldera:latest ```

To gracefully terminate your docker container, do the following: ```Bash

Find the container ID for your docker container running Caldera

docker ps

Send interrupt signal, e.g. "docker kill --signal=SIGINT 5b9220dd9c0f"

docker kill --signal=SIGINT [container ID] ```

Contributing

Refer to our contributor documentation.

Vulnerability Disclosures

Refer to our vulnerability discolosure documentation for submitting bugs.

Licensing

To discuss licensing opportunities, please reach out to caldera@mitre.org or directly to MITRE's Technology Transfer Office.

Caldera Benefactor Program

If you are interested in partnering to support, sustain, and evolve Caldera™'s open source capabilities, please contact us at caldera@mitre.org.