████████╗███████╗███████╗████████╗███████╗██████╗ ██████╗ ██╗   ██╗██████╗
 ╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██╔════╝██╔══██╗██╔══██╗╚██╗ ██╔╝╚════██╗
    ██║   █████╗  ███████╗   ██║   █████╗  ██████╔╝██████╔╝ ╚████╔╝  █████╔╝
    ██║   ██╔══╝  ╚════██║   ██║   ██╔══╝  ██╔══██╗██╔═══╝   ╚██╔╝  ██╔═══╝
    ██║   ███████╗███████║   ██║   ███████╗██║  ██║██║        ██║   ███████╗
    ╚═╝   ╚══════╝╚══════╝   ╚═╝   ╚══════╝╚═╝  ╚═╝╚═╝        ╚═╝   ╚══════╝

T1059.006 EDR/AV Testing Platform

TESTERPy2 is a security testing platform for evaluating EDR and AV detection capabilities against Python-based offensive techniques. It maps exclusively to MITRE ATT&CK T1059.006 (Command and Scripting Interpreter: Python), covering five independent test scenarios that exercise real credential dumping, defense evasion, browser theft, discovery, and shellcode execution primitives.

The platform runs as a Flask dashboard with a lightweight Python agent deployed on the target system. The agent receives test code over HTTP, executes each test in an isolated subprocess, and reports pass/detect/fail results back to the dashboard in real time.

Python is consistently used by sophisticated threat actors because it runs cross-platform without dropping additional binaries, ships with a rich standard library covering ctypes, subprocess, and socket, and is frequently present on systems for legitimate purposes. The same properties that make Python useful for developers make it effective for living-off-the-land attacks.

Groups known to use Python-based tooling

%%{init: {"flowchart": {"nodeSpacing": 30, "rankSpacing": 50}}}%%

graph TD

    Dashboard["TESTERPy2 Dashboard<br/>(Flask :5000)"]

    Win["Windows Agent"]
    Linux["Linux Agent"]
    Mac["macOS Agent"]

    WTests["5 Tests"]
    LTests["5 Tests"]
    MTests["5 Tests"]

    Dashboard -->|HTTP API| Win
    Dashboard -->|HTTP API| Linux
    Dashboard -->|HTTP API| Mac

    Win --> WTests
    Linux --> LTests
    Mac --> MTests

    classDef dashboard fill:#0d161f,color:white,stroke:#0d161f;
    classDef agent fill:#1c2733,color:white,stroke:#1c2733;
    classDef tests fill:#555,color:white,stroke:#555;

    class Dashboard dashboard;
    class Win,Linux,Mac agent;
    class WTests,LTests,MTests tests;

Each agent beacons the server on a configurable interval, receives base64-encoded test code, runs it in a child Python process, and submits the JSON result.

MITRE: T1059.006, T1055.001, T1106
Platform: Windows only

Allocates a RWX memory region via VirtualAlloc, copies a benign NOP-sled payload into it, and creates an execution thread via CreateThread. Tests whether the EDR detects the VirtualAlloc + CreateThread chain from a Python interpreter process.

Detection points:

• Python process calling VirtualAlloc with PAGE_EXECUTE_READWRITE
• CreateThread targeting a non-image memory region
• RWX allocation followed immediately by a thread start

MITRE: T1059.006, T1562.001, T1027
Platform: Windows only

Locates AmsiScanBuffer via GetProcAddress, enumerates the EtwEventWrite address, reads ntdll.dll from disk (unhooking preparation), and sets COMPLUS_ETWEnabled environment variables. Tests whether the EDR detects AMSI or ETW tampering indicators from a Python process.

Detection points:

• GetProcAddress calls targeting amsi.dll exports
• ntdll.dll read from disk by a Python process
• ETW-disabling environment variables

MITRE: T1059.006, T1003.001, T1003.002, T1552.001
Platform: Windows and Linux

Exercises three independent Windows dumping primitives and two Linux credential paths:

1. SAM/SECURITY/SYSTEM hive dump via reg.exe save
2. SAM/SECURITY hive dump via advapi32 RegSaveKeyExW (with SeBackupPrivilege)
3. Full LSASS memory dump via dbghelp MiniDumpWriteDump (with SeDebugPrivilege)
4. Volume Shadow Copy enumeration for offline SAM extraction
5. DPAPI master key directory access
6. Linux /etc/shadow and SSH private key enumeration

All artefacts are written to %TEMP% and deleted immediately. No credentials are retained.

Detection points:

• reg.exe save targeting HKLM\SAM, SECURITY, SYSTEM
• RegOpenKeyExW + RegSaveKeyExW from a Python process
• OpenProcess(PROCESS_VM_READ) on lsass.exe
• MiniDumpWriteDump targeting lsass.exe
• vssadmin list shadows from a non-admin context
• /etc/shadow read from Python

MITRE: T1059.006, T1555.003, T1539, T1552.001
Platform: Windows and Linux

Copies Chrome Login Data, Firefox logins.json, Firefox cookies.sqlite, and Edge Login Data to temporary files for inspection. Counts stored credentials and cookie entries without decrypting any values.

Detection points:

• Access to browser profile directories
• SQLite operations on Login Data or cookies databases
• File copy of browser credential stores

MITRE: T1059.006, T1082, T1083, T1056.001, T1113
Platform: Windows and Linux

Enumerates hostname, OS version, architecture, network interfaces, running processes, home directory contents, and environment variables. On Windows, reads screen resolution via GetSystemMetrics and keyboard state via GetKeyboardState.

Detection points:

• Bulk system enumeration from a Python process
• GetSystemMetrics / GetKeyboardState API calls
• Rapid traversal of home directory and Documents

Requirements: Python 3.8+, Flask, requests

pip install flask requests

python app.py

Dashboard available at http://localhost:5000

Optional environment variables:

# Basic
python agent.py --server http://<dashboard-ip>:5000

# With API key authentication
python agent.py --server http://<dashboard-ip>:5000 --api-key <token>

# With custom beacon interval
python agent.py --server http://<dashboard-ip>:5000 --interval 5

The agent auto-detects platform, registers with the server, and begins beaconing. If the server restarts and loses state, the agent re-registers automatically with exponential backoff.

1. Start app.py on the dashboard host
2. Run agent.py on each target system pointing at the dashboard
3. Select a connected agent from the Agents panel
4. Click Execute on individual tests or Run All Tests
5. Monitor live status in the Results panel

Result statuses

Use TESTERPy2 results to identify gaps and develop detections.

DeviceProcessEvents
| where FileName in~ ("python.exe", "python3.exe", "pythonw.exe")
| where ProcessCommandLine has_any ("ctypes", "VirtualAlloc", "CreateThread",
    "MiniDumpWriteDump", "AmsiScanBuffer", "RegSaveKeyExW")

title: Suspicious Python Credential Access
logsource:
    product: linux
    service: auditd
detection:
    selection:
        exe|endswith: '/python3'
    keywords:
        - '/etc/shadow'
        - 'ctypes'
        - 'subprocess'
    condition: selection and keywords

This tool is for authorized security testing only. Only deploy against systems you own or have explicit written permission to test.

• Run the dashboard and agents in an isolated lab network
• Set API_KEY to prevent unauthorized test execution on exposed instances
• All test artefacts written to disk are deleted immediately after measurement
• No credentials, keys, or sensitive data are transmitted to the dashboard

• MITRE ATT&CK T1059.006
• Atomic Red Team - T1059.006
• APT29 SeaDuke Analysis
• InvisibleFerret Analysis

Built for EDR/AV evaluation and detection engineering. https://breachsimrange.io