TTPForge

TTPForge is a cyber attack simulation platform designed and built by Sam Manzer (@d3sch41n), Alek Straumann (@CrimsonK1ng), and Geoff Pamerleau (@Sy14r), and including subsequent contributions from many good folks in Meta’s Red, Blue, and Purple security teams. Jayson Grace (@l50) migrated the project to GitHub and assisted with preparation for the project’s open source release.

This project promotes a Purple Team approach to cybersecurity with the following goals:

• To help blue teams accurately measure their detection and response capabilities through high-fidelity simulations of real attacker activity.
• To help red teams improve the ROI/actionability of their findings by packaging their attacks as automated, repeatable simulations.

TTPForge allows you to automate attacker tactics, techniques, and procedures (TTPs) using a powerful but easy-to-use YAML format. Check out the links below to learn more!

---

Table of Contents

• Installation
• Documentation
• Getting Started - Developer
• Go Package Documentation

---

Installation

1. Get latest TTPForge release:

   root@kitploit:~

   curl \
   https://raw.githubusercontent.com/facebookincubator/TTPForge/main/dl-rl.sh \
   | bash
   

   At this point, the latest ttpforge release should be in $HOME/.local/bin/ttpforge and subsequently, the $USER's $PATH.

   If running in a stripped down system, you can add TTPForge to your $PATH with the following command:

   root@kitploit:~

   export PATH=$HOME/.local/bin:$PATH
   

2. Initialize TTPForge configuration

   This command will place a configuration file at the default location ~/.ttpforge/config.yaml and configure the examples and forgearmory TTP repositories:

   root@kitploit:~

   ttpforge init
   

3. List available TTP repositories (should show and )