A utility to safely generate malicious network traffic patterns and evaluate controls.
A utility to safely generate malicious network traffic patterns and evaluate controls.
flightsim is a lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility. The tool performs tests to simulate DNS tunneling, DGA traffic, requests to known active C2 destinations, and other suspicious traffic patterns.
Download the latest flightsim binary for your OS from the GitHub Releases page. Alternatively, the utility can be built using Golang in any environment (e.g. Linux, MacOS, Windows), as follows:
go install github.com/alphasoc/flightsim/v2@latest
Upon installation, test flightsim as follows:
…
The utility runs individual modules to generate malicious traffic. To perform all available tests, simply use flightsim run which will generate traffic using the first available non-loopback network interface. Note: when running many modules, flightsim will gather destination addresses from the AlphaSOC API, so requires egress Internet access.
To list the available modules, use flightsim run --help. To execute a particular test, use flightsim run <module>, as below.
…
The utility also has a get command which can be used to query information that can later be used with the simulation modules. At present, a list of C2 families can be obtained to be used with the C2 module. To see how to use the get command, run flightsim get -h as below.
$ flightsim get -h
AlphaSOC Network Flight Simulator™ (https://github.com/alphasoc/flightsim)
The current time is 26-Oct-21 17:42:23
usage: flightsim get [flags] element:category
Available elements:
families
Available categories:
c2
Available flags:
To get a list of C2 families, run:
…
The modules packaged with the utility are listed in the table below.
| Module | Description |
|---|---|
c2 |
Generates both DNS and IP traffic to a random list of known C2 destinations |
cleartext |
Generates random cleartext traffic to an Internet service operated by AlphaSOC |
dga |
Simulates DGA traffic using random labels and top-level domains |
imposter |
Generates DNS traffic to a list of imposter domains |
irc |
Connects to a random list of public IRC servers |
miner |
Generates Stratum mining protocol traffic to known cryptomining pools |
oast |
Simulates out-of-band application security testing (OAST) traffic |
scan |
Performs a port scan of random RFC 5737 addresses using common TCP ports |
sink |
Connects to known sinkholed destinations run by security researchers |
spambot |
Resolves and connects to random Internet SMTP servers to simulate a spam bot |
ssh-exfil |
Simulates an SSH file transfer to a service running on a non-standard SSH port |
ssh-transfer |
Simulates an SSH file transfer to a service running on an SSH port |
telegram-bot |
Generates Telegram Bot API traffic using a random or provided token |
tunnel-dns |
Generates DNS tunneling requests to *.sandbox.alphasoc.xyz |
tunnel-icmp |
Generates ICMP tunneling traffic to an Internet service operated by AlphaSOC |
No open issues yet, or sync has not completed.