Kibrit - MITRE ATT&CK Simulator

An open-source educational platform for safely learning and demonstrating MITRE ATT&CK techniques through interactive simulations.

Overview

Kibrit is a comprehensive simulator designed to help cybersecurity professionals, students, and researchers understand attack techniques from the MITRE ATT&CK framework in a safe, controlled environment. The platform provides interactive demonstrations of various attack techniques while emphasizing defensive strategies and detection methods.

Showcase

Elastic Demonstration

Key Features

• Safe Learning Environment - All demonstrations are for simulation purposes
• MITRE ATT&CK Integration - Direct mapping to official MITRE ATT&CK techniques and tactics
• Dual Development Approach - Contribute via C++ header implementations or Lua scripting
• Real-time Monitoring - Live progress tracking, logging, and statistics
• Session Management - Save, load, and export simulation sessions
• Comprehensive Reporting - Detailed logs and analytics for learning assessment

Quick Start

Prerequisites

• Windows 10/11
• Visual Studio 2022
• VULKAN SDK
• LuaJIT
• Git

Installation

1. Clone the repository

   git clone https://github.com/vxintelligence/kibrit.git
   cd kibrit

2. Initialize submodules

   git submodule update --init --recursive

3. Build the project

   # Using Visual Studio# Open Kibrit.sln and build in Release mode# Or using command line
   msbuild Kibrit.sln /p:Configuration=Release
   Or execute Setup.bat from scripts folder.

4. Run the application

   ./bin/Release/Kibrit.exe

Usage

Getting Started

1. Launch Kibrit and explore the main interface
2. Select a technique from the available list
3. Initialize the technique to prepare the simulation
4. Execute the demonstration to see the technique in action
5. Review logs and statistics to understand the technique's behavior

Interface Overview

• Techniques Panel - Browse and select available MITRE ATT&CK techniques
• Control Panel - Initialize, execute, and stop simulations
• Statistics Window - Real-time progress and performance metrics
• Logs Window - Detailed execution logs and educational information
• Details Panel - In-depth technique information, mitigations, and detection methods

Contributing

We welcome contributions from the cybersecurity community! There are two main ways to contribute:

Method 1: C++ Header Implementation

For developers comfortable with C++, you can implement techniques directly:

1. Create a new technique header in /Techniques/
2. Implement the ITechnique interface:

   classTechniqueT1234 : publicITechnique {
   public:
   std::string GetID() constoverride { return"T1234"; }
   std::string GetName() constoverride { return"Your Technique"; }
   std::string GetTactic() constoverride { return"Your Tactic"; }
   // ... implement other interface methods
   };

3. Add your technique to the main application
4. Submit a pull request with comprehensive documentation

Method 2: Lua Scripting

The Lua scripting system allows for rapid development and easier contribution. Each Lua technique script must return a table that implements the required interface.

Basic Script Structure

Create a Lua file in the /scripts/ directory with the following structure:

-- Define the technique tablelocaltechnique= {
-- Required metadatainfo= {
id="T1234", -- MITRE ATT&CK IDname="Your Technique Name", -- Human-readable nametactic="Your Tactic", -- MITRE ATT&CK tacticdescription="Educational description of the technique",
author="Your Name" -- Script author
},
-- Technique state managementstate= {
running=false, -- Is technique currently executingprogress=0.0, -- Progress from 0.0 to 1.0logs= {}, -- Array of log messagesinitialized=false-- Has technique been initialized
}
}

Required Functions

Every technique must implement these core functions:

-- Initialize the technique (called once)functiontechnique:initialize()
self.state.initialized=truekibrit.log("Initializing " ..self.info.name)
-- Add your initialization logic here-- Return true on success, false on failurereturntrueend-- Execute the technique demonstrationfunctiontechnique:execute()
ifnotself.state.initializedthenkibrit.log("ERROR: Technique not initialized")
returnfalseendself.state.running=trueself.state.progress=0.0-- Your simulation logic herefori=1, 10dokibrit.log("Step " ..i.." of technique execution")
self.state.progress=i/10.0kibrit.sleep(100) -- Simulate work (100ms delay)endself.state.running=falseself.state.progress=1.0kibrit.log("Technique execution completed")
returntrueend-- Stop the running techniquefunctiontechnique:stop()
self.state.running=falsekibrit.log("Technique execution stopped")
end-- Render custom UI for this techniquefunctiontechnique:render_ui()
ifkibrit.ui.collapsing_header(self.info.name.." (" ..self.info.id..")") then-- Status informationlocalstatus=self.state.runningand"Running" or (self.state.progress>=1.0and"Complete" or"Ready")
kibrit.ui.text("Status: " ..status)
kibrit.ui.text("Progress: " ..string.format("%.1f%%", self.state.progress*100))
-- Progress barifself.state.progress>0.0thenkibrit.ui.progress_bar(self.state.progress)
end-- Control buttonsifnotself.state.runningthenifkibrit.ui.button("Execute Demo") thenself:execute()
endelseifkibrit.ui.button("Stop") thenself:stop()
endend-- Educational content sectionsifkibrit.ui.collapsing_header("Sub-Techniques") thenkibrit.ui.text("• List your sub-techniques here")
kibrit.ui.text("• Each as a separate bullet point")
endifkibrit.ui.collapsing_header("Mitigations") thenkibrit.ui.text("• Describe defensive measures")
kibrit.ui.text("• Include specific controls and policies")
endifkibrit.ui.collapsing_header("Detection Methods") thenkibrit.ui.text("• Explain how to detect this technique")
kibrit.ui.text("• Include log sources and indicators")
end-- Execution logsifkibrit.ui.collapsing_header("Execution Logs") thenfor_, loginipairs(self.state.logs) dokibrit.ui.text("[LOG] " ..log)
endendendend-- Return the technique tablereturntechnique

Available Kibrit API Functions

The Lua scripts have access to the following API:

Logging Functions:

kibrit.log(message) -- Add message to global logs

Utility Functions:

kibrit.sleep(milliseconds) -- Pause executionkibrit.get_time() -- Get current time

UI Functions:

kibrit.ui.text(text) -- Display textkibrit.ui.button(label) -- Create button (returns true if clicked)kibrit.ui.progress_bar(progress) -- Show progress bar (0.0 to 1.0)kibrit.ui.collapsing_header(label) -- Create collapsible section

LuaJIT FFI Integration

For advanced technique implementations that require system-level operations, Kibrit supports LuaJIT FFI (Foreign Function Interface). This allows direct access to Windows API functions while maintaining the safety and educational focus of the platform.

Basic FFI Setup:

localffi=require("ffi")
-- Define C structures and functionsffi.cdef[[// Windows API definitionstypedefvoid* HANDLE;
typedefunsignedlongDWORD;
typedefintBOOL;
// Process managementHANDLEGetCurrentProcess();
DWORDGetCurrentProcessId();
BOOLCloseHandle(HANDLEhObject);
// Memory managementvoid* VirtualAlloc(void*lpAddress, size_tdwSize, DWORDflAllocationType, DWORDflProtect);
BOOLVirtualFree(void*lpAddress, size_tdwSize, DWORDdwFreeType);
]]-- Load Windows kernel32.dlllocalkernel32=ffi.load("kernel32")

Safe System Interaction Examples:

-- Example: Process enumeration for educational demonstrationlocaltechnique_with_ffi= {
info= {
id="T1057",
name="Process Discovery",
tactic="Discovery",
description="Educational demonstration of process enumeration techniques"
}
}
functiontechnique_with_ffi:demonstrate_process_discovery()
localffi=require("ffi")
-- Define necessary structuresffi.cdef[[typedefstruct {
DWORDdwSize;
DWORDcntUsage;
DWORDth32ProcessID;
DWORDth32DefaultHeapID;
DWORDth32ModuleID;
DWORDcntThreads;
DWORDth32ParentProcessID;
longpcPriClassBase;
DWORDdwFlags;
charszExeFile[260];
} PROCESSENTRY32;
HANDLECreateToolhelp32Snapshot(DWORDdwFlags, DWORDth32ProcessID);
BOOLProcess32First(HANDLEhSnapshot, PROCESSENTRY32*lppe);
BOOLProcess32Next(HANDLEhSnapshot, PROCESSENTRY32*lppe);
```
local kernel32 = ffi.load("kernel32")
local TH32CS_SNAPPROCESS = 0x00000002
-- Create process snapshot
local snapshot = kernel32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
if snapshot ~= ffi.C.INVALID_HANDLE_VALUE then
local pe32 = ffi.new("PROCESSENTRY32")
pe32.dwSize = ffi.sizeof("PROCESSENTRY32")
-- Educational demonstration only - log process discovery
if kernel32.Process32First(snapshot, pe32) then
repeat
local process_name = ffi.string(pe32.szExeFile)
kibrit.log("Discovered process: " .. process_name .. " (PID: " .. pe32.th32ProcessID .. ")")
self.state.progress = self.state.progress + 0.1
until not kernel32.Process32Next(snapshot, pe32)
end
kernel32.CloseHandle(snapshot)
end
end

Registry Operations for Educational Purposes:

-- Example: Registry persistence demonstrationffi.cdef[[typedefvoid* HKEY;
typedefconstchar* LPCSTR;
typedefDWORD* LPDWORD;
longRegOpenKeyExA(HKEYhKey, LPCSTRlpSubKey, DWORDulOptions, DWORDsamDesired, HKEY*phkResult);
longRegQueryValueExA(HKEYhKey, LPCSTRlpValueName, DWORD*lpReserved, DWORD*lpType, void*lpData, DWORD*lpcbData);
longRegCloseKey(HKEYhKey);
]]localadvapi32=ffi.load("advapi32")
functiontechnique:demonstrate_registry_discovery()
localHKEY_LOCAL_MACHINE=ffi.cast("HKEY", 0x80000002)
localKEY_READ=0x20019localhKey=ffi.new("HKEY[1]")
localresult=advapi32.RegOpenKeyExA(
HKEY_LOCAL_MACHINE,
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
0,
KEY_READ,
hKey
)
ifresult==0thenkibrit.log("Successfully accessed Run registry key for educational demonstration")
-- Additional educational logging hereadvapi32.RegCloseKey(hKey[0])
elsekibrit.log("Registry access demonstration completed with result: " ..result)
endend

Network Simulation with FFI:

-- Example: Network communication simulationffi.cdef[[typedefstruct {
unsignedshortsa_family;
charsa_data[14];
} SOCKADDR;
typedefstruct {
shortsin_family;
unsignedshortsin_port;
unsignedlongsin_addr;
charsin_zero[8];
} SOCKADDR_IN;
intWSAStartup(unsignedshortwVersionRequested, void*lpWSAData);
intWSACleanup();
unsignedlonginet_addr(constchar*cp);
unsignedshorthtons(unsignedshorthostshort);
]]localws2_32=ffi.load("ws2_32")
functiontechnique:simulate_network_connection()
localwsaData=ffi.new("char[?]", 400) -- WSADATA structure-- Initialize Winsock for demonstrationlocalresult=ws2_32.WSAStartup(0x0202, wsaData)
ifresult==0thenkibrit.log("Network subsystem initialized for educational demonstration")
-- Simulate connection parameters (no actual connection made)localtarget_ip="127.0.0.1" -- Localhost only for safetylocaltarget_port=80kibrit.log("Simulating connection to " ..target_ip..":" ..target_port)
kibrit.log("Educational note: No actual network connection is established")
ws2_32.WSACleanup()
elsekibrit.log("Network simulation setup failed with error: " ..result)
endend

FFI Safety Guidelines:

1. Educational Focus Only - All FFI operations must be for demonstration purposes
2. No Destructive Operations - Never perform actions that could harm the system
3. Safe Defaults - Use localhost, temporary files, and non-critical registry paths
4. Comprehensive Logging - Log all actions for educational review
5. Error Handling - Always include proper error checking and cleanup
6. Documentation - Explain the purpose and safety measures of each FFI operation

FFI Development Best Practices:

-- Always wrap FFI operations in protective functionsfunctiontechnique:safe_ffi_operation()
localsuccess, result=pcall(function()
-- Your FFI code herereturntrueend)
ifsuccessthenkibrit.log("FFI operation completed successfully")
returnresultelsekibrit.log("FFI operation failed safely: " ..tostring(result))
returnfalseendend-- Clean up resources automaticallyfunctiontechnique:cleanup_resources()
-- Close handles, free memory, etc.ifself.allocated_memorythenffi.C.VirtualFree(self.allocated_memory, 0, 0x8000) -- MEM_RELEASEself.allocated_memory=nilendend

Advanced Lua Scripting Examples

State Management:

-- Custom state variablestechnique.state.custom_data= {
target_process=nil,
injection_method="CreateRemoteThread",
payload_size=0
}
-- State persistence across executionsfunctiontechnique:save_state()
-- Save important state informationlocalstate_data= {
last_execution=os.time(),
execution_count=self.state.execution_countor0
}
returnstate_dataend

Interactive Parameters:

-- Add configurable parameterstechnique.config= {
target_ip="127.0.0.1",
target_port=4444,
delay_ms=1000
}
-- Render configuration UIfunctiontechnique:render_config_ui()
ifkibrit.ui.collapsing_header("Configuration") then-- Note: Input fields would need additional API supportkibrit.ui.text("Target IP: " ..self.config.target_ip)
kibrit.ui.text("Target Port: " ..self.config.target_port)
endend

Script Development Guidelines

1. Educational Focus: Always prioritize learning value over technical complexity
2. Safety First: Never implement actual attacks, only educational demonstrations
3. Documentation: Include comprehensive comments explaining each step
4. Error Handling: Implement proper error checking and user feedback
5. MITRE Accuracy: Ensure accurate mapping to MITRE ATT&CK framework
6. User Experience: Create intuitive and informative UI elements

Testing Your Scripts

Before submitting, test your scripts thoroughly:

1. Place your .lua file in the /scripts/ directory
2. Restart Kibrit to load the new script
3. Verify all functions work correctly
4. Test edge cases and error conditions
5. Ensure UI renders properly
6. Validate educational content accuracy

Contribution Guidelines

• Safety First - All contributions must be educational and safe
• Documentation - Include comprehensive documentation and educational content
• Testing - Test your implementations thoroughly
• Code Style - Follow the existing code style and conventions
• MITRE Mapping - Ensure accurate mapping to MITRE ATT&CK framework

Currently Implemented Techniques

Technique ID	Name	Tactic	Implementation
T1055	Process Injection	Defense Evasion	C++ Header
T1134	Access Token Manipulation	Defense Evasion, Privilege Escalation	C++ Header
T1547.001	Registry Run Keys / Startup Folder	Persistence	C++ Header
T1059.003	Windows Command Shell	Execution	C++ Header
T1197	BITS download functionality	Defense Evasion, Persistence, Command and Control	LUA Script

View Full MITRE ATT&CK Matrix Coverage (5 of 200+ techniques implemented)

Legend: Bold = Implemented in Kibrit

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access
Content Injection	Command and Scripting Interpreter	Account Manipulation	Abuse Elevation Control Mechanism	Abuse Elevation Control Mechanism	Adversary-in-the-Middle
Drive-by Compromise	Exploitation for Client Execution	BITS Jobs	Access Token Manipulation	Access Token Manipulation	Brute Force
Exploit Public-Facing Application	Input Injection	Boot or Logon Autostart Execution	Account Manipulation	BITS Jobs	Credentials from Password Stores
External Remote Services	Inter-Process Communication	Boot or Logon Initialization Scripts	Boot or Logon Autostart Execution	Debugger Evasion	Exploitation for Credential Access
Hardware Additions	Native API	Compromise Host Software Binary	Boot or Logon Initialization Scripts	Deobfuscate/Decode Files or Information	Forced Authentication
Phishing	Scheduled Task/Job	Create Account	Create or Modify System Process	Direct Volume Access	Forge Web Credentials
Replication Through Removable Media	Shared Modules	Create or Modify System Process	Domain or Tenant Policy Modification	Domain or Tenant Policy Modification	Input Capture
Supply Chain Compromise	Software Deployment Tools	Event Triggered Execution	Escape to Host	Email Spoofing	Modify Authentication Process
Trusted Relationship	System Services	Exclusive Control	Event Triggered Execution	Execution Guardrails	Multi-Factor Authentication Interception
Valid Accounts	User Execution	External Remote Services	Exploitation for Privilege Escalation	Exploitation for Defense Evasion	Multi-Factor Authentication Request Generation
Wi-Fi Networks	Windows Management Instrumentation	Hijack Execution Flow	Hijack Execution Flow	File and Directory Permissions Modification	Network Sniffing
		Modify Authentication Process	Process Injection	Hide Artifacts	OS Credential Dumping
		Modify Registry	Scheduled Task/Job	Hijack Execution Flow	Steal or Forge Authentication Certificates
		Office Application Startup	Valid Accounts	Impair Defenses	Steal or Forge Kerberos Tickets
		Power Settings		Impersonation	Steal Web Session Cookie
		Pre-OS Boot		Indicator Removal	Unsecured Credentials
		Scheduled Task/Job		Indirect Command Execution
		Server Software Component		Masquerading
		Software Extensions		Modify Authentication Process
		Traffic Signaling		Modify Registry
		Valid Accounts		Obfuscated Files or Information
				Pre-OS Boot
				Process Injection
				Reflective Code Loading
				Rogue Domain Controller
				Rootkit
				Subvert Trust Controls
				System Binary Proxy Execution
				System Script Proxy Execution
				Template Injection
				Traffic Signaling
				Trusted Developer Utilities Proxy Execution
				Use Alternate Authentication Material
				Valid Accounts
				Virtualization/Sandbox Evasion
				XSL Script Processing

Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Account Discovery	Exploitation of Remote Services	Adversary-in-the-Middle	Application Layer Protocol	Automated Exfiltration	Account Access Removal
Application Window Discovery	Internal Spearphishing	Archive Collected Data	BITS Jobs	Data Transfer Size Limits	Data Destruction
Browser Information Discovery	Lateral Tool Transfer	Audio Capture	Content Injection	Exfiltration Over Alternative Protocol	Data Encrypted for Impact
Debugger Evasion	Remote Service Session Hijacking	Automated Collection	Data Encoding	Exfiltration Over C2 Channel	Data Manipulation
Device Driver Discovery	Remote Services	Browser Session Hijacking	Data Obfuscation	Exfiltration Over Other Network Medium	Defacement
Domain Trust Discovery	Replication Through Removable Media	Clipboard Data	Dynamic Resolution	Exfiltration Over Physical Medium	Disk Wipe
File and Directory Discovery	Software Deployment Tools	Data from Information Repositories	Encrypted Channel	Exfiltration Over Web Service	Email Bombing
Group Policy Discovery	Taint Shared Content	Data from Local System	Fallback Channels	Scheduled Transfer	Endpoint Denial of Service
Log Enumeration	Use Alternate Authentication Material	Data from Network Shared Drive	Hide Infrastructure		Financial Theft
Network Service Discovery		Data from Removable Media	Ingress Tool Transfer		Firmware Corruption
Network Share Discovery		Data Staged	Multi-Stage Channels		Inhibit System Recovery
Network Sniffing		Email Collection	Non-Application Layer Protocol		Network Denial of Service
Password Policy Discovery		Input Capture	Non-Standard Port		Resource Hijacking
Peripheral Device Discovery		Screen Capture	Protocol Tunneling		Service Stop
Permission Groups Discovery		Video Capture	Proxy		System Shutdown/Reboot
Process Discovery			Remote Access Tools
Query Registry			Traffic Signaling
Remote System Discovery			Web Service
Software Discovery
System Information Discovery
System Location Discovery
System Network Configuration Discovery
System Network Connections Discovery
System Owner/User Discovery
System Service Discovery
System Time Discovery
Virtual Machine Discovery
Virtualization/Sandbox Evasion

Architecture

Core Components

• ITechnique Interface - Base interface for all attack technique implementations
• CyberSimLayer - Main application layer handling UI and technique management
• LuaBridge - Integration layer for Lua scripting support
• Technique Adapters - Wrapper classes for consistent interface implementation

Features in Detail

Educational Focus

• Mitigation Strategies - Learn how to defend against each technique
• Detection Methods - Understand how to identify these techniques in real environments
• Sub-technique Coverage - Comprehensive coverage of technique variations
• Real-world Context - Understand when and how these techniques are used

Session Management

• Save/Load Sessions - Preserve your learning progress
• Export Capabilities - Generate reports for educational assessment
• Statistics Tracking - Monitor learning progress and technique coverage

Community

Getting Help

• Issues - Report bugs or request features via GitHub Issues
• Discussions - Join community discussions in GitHub Discussions
• Contact - Reach out to the maintainers for collaboration opportunities

Recognition

We maintain a Contributors Hall of Fame to recognize community members who help improve Kibrit.

Legal and Ethics

Important Disclaimers

• Educational Purpose Only - This tool is designed solely for educational purposes
• No Actual Attacks - All demonstrations are simulations and perform no real attacks
• Responsible Use - Users are responsible for using this tool ethically and legally
• Not for Malicious Use - Any malicious use of knowledge gained is strictly prohibited

Security Considerations

• All simulations run in isolated environments
• No actual system modifications are performed
• Network communications are simulated, not real
• Comprehensive logging for educational review

License

This project is licensed under the Kibrit Non-Commercial Educational License - see the LICENSE file for details.

Note: This software is for educational and research purposes only. Commercial use is prohibited.

Acknowledgments

• MITRE Corporation - For the comprehensive ATT&CK framework
• Community Contributors - For their valuable techniques and improvements

Additional Resources

• MITRE ATT&CK Framework
• Cybersecurity Education Best Practices

---

Made with care by the cybersecurity community for educational advancement

Remember: We try hard to make it vulnerable and secure it again <3