# Threatest | Threatest Is A Go Framework For End-To-End Testing Threat Detection Rules

**URL:** <https://onehack.st/t/threatest-threatest-is-a-go-framework-for-end-to-end-testing-threat-detection-rules/227836>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, networking\
**Created:** [November 2, 2022, 9:25pm UTC](https://onehack.st/t/threatest-threatest-is-a-go-framework-for-end-to-end-testing-threat-detection-rules/227836 "2022-11-02T21:25:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [November 2, 2022, 9:25pm UTC](https://onehack.st/t/threatest-threatest-is-a-go-framework-for-end-to-end-testing-threat-detection-rules/227836/1 "2022-11-02T21:25:36Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/e/a/ea77fc53cce9192f3d99f3ce547ed562f8568bd5.png)

# Threatest

[![unit tests](https://github.com/DataDog/threatest/actions/workflows/test.yml/badge.svg)](https://github.com/DataDog/threatest/actions/workflows/test.yml/badge.svg) [![static analysis](https://github.com/DataDog/threatest/actions/workflows/static-analysis.yml/badge.svg)](https://github.com/DataDog/threatest/actions/workflows/static-analysis.yml/badge.svg)

Threatest is a Go framework for testing threat detection end-to-end.

Threatest allows you to **detonate** an attack technique, and verify that the alert you expect was generated in your favorite security platform.

Read the announcement blog post: [https://securitylabs.datadoghq.com/articles/threatest-end-to-end-testing-threat-detection/](https://securitylabs.datadoghq.com/articles/threatest-end-to-end-testing-threat-detection/)

## Concepts

### Detonators

A **detonator** describes how and where an attack technique is executed.

Supported detonators:

- Local command execution
- SSH command execution
- Stratus Red Team
- AWS detonator

### Alert matchers

An **alert matcher** is a platform-specific integration that can check if an expected alert was triggered.

Supported alert matchers:

- Datadog security signals

### Detonation and alert correlation

Each detonation is assigned a UUID. This UUID is reflected in the detonation and used to ensure that the matched alert corresponds exactly to this detonation.

The way this is done depends on the detonator; for instance, Stratus Red Team and the AWS Detonator inject it in the user-agent; the SSH detonator uses a parent process containing the UUID.

## Sample usage

See [examples](https://github.com/DataDog/threatest/blob/main/examples) for complete usage example.

### Testing Datadog Cloud SIEM signals triggered by Stratus Red Team

threatest := Threatest() threatest.Scenario(“AWS console login”). WhenDetonating(StratusRedTeamTechnique(“aws.initial-access.console-login-without-mfa”)). Expect(DatadogSecuritySignal(“AWS Console login without MFA”).WithSeverity(“medium”)). WithTimeout(15 \* time.Minute) assert.NoError(t, threatest.Run())

### Testing Datadog Cloud Workload Security signals triggered by running commands over SSH

ssh, \_ := NewSSHCommandExecutor(“test-box”, “”, “”) threatest := Threatest() threatest.Scenario(“curl to metadata service”). WhenDetonating(NewCommandDetonator(ssh, “curl [http://169.254.169.254](http://169.254.169.254) --connect-timeout 1”)). Expect(DatadogSecuritySignal(“EC2 Instance Metadata Service Accessed via Network Utility”)) assert.NoError(t, threatest.Run())

## GitHub:

> **[GitHub - DataDog/threatest: Threatest is a CLI and Go framework for end-to-end...](https://github.com/DataDog/threatest)**
>
> Threatest is a CLI and Go framework for end-to-end testing threat detection rules.