Define multi-stage attack campaigns as code. Simulate full kill chains. Validate your detections actually fire. Mapped to MITRE ATT&CK, ATLAS, and OWASP LLM Top 10. Know exactly where you're blind.
Not another atomic runner. ThreatEcho simulates how adversaries actually operate: multi-stage, chained, with decision logic.
Define adversary campaigns in YAML. Multi-stage operations with dependencies, branching, platform targeting, and variable substitution.
Model complete intrusion operations, from initial access through lateral movement to exfiltration. Not isolated tests, real campaigns.
Every stage declares expected detections. Run the campaign, check if your SIEM caught each step. See exactly where coverage breaks down.
Mapped to MITRE ATT&CK for classical threats, ATLAS for adversarial AI, and OWASP LLM Top 10 for agent security. See your coverage after every run.
No Python dependencies. No Docker required. CLI and optional agent binary, cross-compiled for Linux, Windows, and macOS. Deploy anywhere in seconds.
Test prompt injection, tool-call policy violations, RAG poisoning, and agent hijacking. Mapped to MITRE ATLAS and OWASP LLM Top 10.
Declarative tool-call policies for AI agents. Define what tools an agent can use, under what conditions, with deny/alert/audit effects. 15 built-in policies.
Generate Sigma detection rules directly from campaigns. Map every simulated technique to a detection signature your SIEM can ingest. Close the loop.
Community edition under AGPL-3.0. Full campaign engine, simulation, validation, gap reporting. No feature gates on the core.
Define your campaign. Simulate the attack. Read the gap report.
# Validate the campaign structure $ threatecho validate campaigns/apt29-cozy-bear/ ✓ Campaign "apt29-cozy-bear" is valid (8 stages, 8 techniques, 8/14 tactics) # Simulate the full kill chain $ threatecho simulate campaigns/apt29-cozy-bear/ [1/8] Spearphishing Attachment T1566.001 Initial Access [2/8] HTTPS C2 Beacon T1071.001 Command and Control [3/8] Domain Reconnaissance T1087.002 Discovery [4/8] LSASS Memory Dump T1003.001 Credential Access [5/8] SMB Lateral Movement T1021.002 Lateral Movement [6/8] Data Staging T1074.001 Collection [7/8] Indicator Removal T1070.004 Defense Evasion [8/8] Exfiltration to Cloud T1567.002 Exfiltration # Coverage: 8/14 tactics, 18 detection rules referenced # List available campaigns $ threatecho campaigns list apt29-cozy-bear APT29 critical 8 stages 8 techniques
Campaign orchestration, coverage tracking, and detection analytics in one view.
The community edition is the full simulation engine. The cloud edition adds the intelligence layer.
Free forever. AGPL-3.0
Coming soon. Join the waitlist.