NextronSystems/APTSimulator

Health v2 · maintenance only

Adoption not part of the score

2764 stars · 452 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

APT Simulator is a Windows Batch script toolset that makes a system look as if it was the victim of an APT attack, using tools and output files to simulate adversary activity without malware. It requires no web server, database, or agents—just extract the release archive and run the batch file as Administrator.

Use cases

• test endpoint detection agent or EDR detection capabilities
• run a POC for compromise assessment tools
• test SOC response to a realistic threat instead of EICAR or a port scan
• prepare an environment for digital forensics training classes
• simulate adversary activity on a Windows demo system
• validate security monitoring detections

When to choose

• you need a simple, fast adversary simulation on Windows with no infrastructure like servers, databases, or VM agents
• you want to test EDR, SIEM, or SOC detection and response against realistic APT artifacts
• you need a demo system seeded with attacker toolmarks for forensics training
• you prefer a tool that is easy to read, modify, and extend

When to avoid

• you need to simulate actual malware behavior rather than adversary activity
• you require multi-host attack chains, C2 infrastructure, or advanced adversary emulation frameworks
• you are on a non-Windows platform
• you need an actively developed tool with ongoing updates

Facets

cli-tool · maturity maintenance

security penetration-testing developer-tools cli security penetration-testing developer-tools windows cli apt-simulation adversary-simulation edr-testing soc-testing detection-testing batch-script compromise-assessment digital-forensics-training

Member repositories

For agents

markdown · JSON · MCP: product_card(name="NextronSystems/APTSimulator")