f0_library — Security Testing Framework

A comprehensive security testing framework for evaluating endpoint detection and response (EDR) capabilities against real-world attack techniques mapped to the MITRE ATT&CK framework.

Project naming: f0_library is the framework. F0RT1KA is the parent organization / brand (used in binary signing certificates, the runtime path c:\F0 / /tmp/F0, and elsewhere). The two are not competing names — f0_library is what this software is called.

Overview

f0_library is a professional, open-source security testing framework designed to assess the effectiveness of endpoint detection and response (EDR) solutions. By simulating real-world attack techniques mapped to the MITRE ATT&CK framework, it provides security teams with a standardized approach to validate their defensive capabilities.

Purpose

Security Validation: Test and validate the detection and prevention capabilities of security solutions
MITRE ATT&CK Alignment: All tests are mapped to specific MITRE ATT&CK techniques for standardized threat assessment
Automated Testing: Provide a structured approach to security testing with consistent result codes
Research & Development: Enable security teams to understand gaps in their defensive posture
Compliance Support: DORA/TIBER-EU aligned testing for regulatory compliance

Key Features

51 Security Tests across 3 categories covering attack simulation and configuration validation
Cross-Platform Support: Windows (primary), Linux, and macOS test targets
Agent-Driven Test Generation: Orchestrator + specialized agents for automated test creation from threat intelligence
5 Detection Rule Formats: KQL, YARA, Sigma, Elastic EQL, and LimaCharlie D&R rules generated per test
Defense Guidance: Hardening scripts (Windows/Linux/macOS) and incident response playbooks
Standardized Test Structure: Schema v2.0 logging with Elasticsearch analytics
Realism-First Scoring (Rubric v2.1): Tiered safety/realism/structure scoring that decouples test quality from tenant defense posture (see Test Quality Scoring)
Multi-Organization Support: UUID-based organization tracking for enterprise deployments
LimaCharlie Integration: Infrastructure as Code for detection rules and certificate deployment
Elasticsearch Analytics: Pre-built dashboards and enrichment pipelines
Code Signing Support: Integrated Windows executable signing with dual-signing for ASR bypass
Test Provenance: References tracking with _references.md files linking tests to source intelligence

Test Categories

Category	Tests	Description
intel-driven	33	Threat intelligence-based tests from APT reports, ransomware analysis, and CVE exploits
mitre-top10	10	MITRE Top 10 Ransomware techniques test suite
cyber-hygiene	8	Configuration validation tests for endpoint, identity, and tenant security

Agent Architecture

f0_library uses a decomposed agent architecture to generate complete test packages from threat intelligence. The sectest-builder orchestrator coordinates specialized skills and sub-agents in a 4-phase execution model.

flowchart LR
    TI[Threat Intel<br/>article/report/CVE] --> SB[sectest-builder<br/>orchestrator]
    SB --> P1{Phase 1<br/>sequential}
    P1 --> SA[source-analysis]
    SA --> IM[implementation]
    IM --> BS[build-sign]
    BS --> P2{Phase 2<br/>parallel}
    P2 --> DOC[documentation]
    P2 --> DET[detection-rules]
    P2 --> DEF[defense-guidance]
    P2 --> KC[kill-chain-diagram]
    DOC & DET & DEF & KC --> P3{Phase 3<br/>validation}
    P3 --> VF[file verify]
    VF --> SC[score consistency]
    SC --> ES[ES catalog sync]
    ES --> GC[git commit]
    GC --> P3b{Phase 3b<br/>deployment}
    P3b --> SSH[SSH deploy]
    SSH --> EX[execute on target]
    EX --> CR[capture results]

Execution Phases

Phase 1 — Sequential Skills (shared context): Source analysis → Go implementation → Build & sign
Phase 2 — Parallel Agents (independent): Documentation, detection rules, defense guidance, kill chain diagrams
Phase 3 — Validation (shared context): File verification, score consistency, ES catalog sync, git commit
Phase 3b — Deployment (shared context): SSH deploy to target endpoint, execute, capture results

Agent Selection

Need	Agent
Create test from threat intel	`@sectest-builder` (orchestrates everything)
Validate TIBER-EU phase readiness	`@pentest-readiness-builder`
Visualize attack flow	`@attack-flow-diagram-builder`
Visualize kill chain	`@kill-chain-diagram-builder`
Generate detection rules	`@sectest-detection-rules`
Generate defense guidance	`@sectest-defense-guidance`
Deploy & execute test on endpoint	`@sectest-deploy-test`

For detailed architecture documentation, see docs/SECTEST_BUILDER_ARCHITECTURE.md.

Project Structure

f0_library/
├── .claude/                      # Claude Code agent and skill definitions
│   ├── agents/                  # 9 specialized agents (orchestrator + sub-agents)
│   └── skills/                  # 6 skills (analysis, implementation, build, validation, deploy)
├── .github/                      # GitHub workflows and templates
│   ├── ISSUE_TEMPLATE/          # Issue templates for bugs and features
│   ├── workflows/               # CI/CD workflows (build, security, Claude review)
│   └── pull_request_template.md
├── docs/                         # Documentation (20 files)
│   ├── ARCHITECTURE.md          # System architecture (multi-binary bundles)
│   ├── CHANGELOG.md             # Version history
│   ├── DEVELOPMENT.md           # Developer setup guide
│   ├── DUAL_SIGNING_STRATEGY.md # Code signing details
│   ├── F0RT1KA_SCORING_METHODOLOGY.md # Test scoring methodology
│   ├── MULTISTAGE_QUICK_REFERENCE.md  # Multi-stage build reference
│   ├── SECTEST_BUILDER_ARCHITECTURE.md # Agent architecture
│   ├── TEST_RESULTS_SCHEMA_GUIDE.md   # Schema v2.0 guide
│   ├── ELASTICSEARCH_EXPORT_QUICKSTART.md # ES export guide
│   └── ...                      # Additional docs
├── limacharlie-iac/              # LimaCharlie Infrastructure as Code
│   ├── elasticsearch/           # Elasticsearch index templates
│   ├── payloads/                # PowerShell scripts and payloads
│   ├── rules/                   # Detection & Response rules
│   ├── scripts/                 # Deployment automation
│   └── README.md                # LimaCharlie deployment guide
├── sample_tests/                 # Reference test implementations
│   └── multistage_template/     # Multi-stage test reference
├── tech-reports/                 # Threat intelligence research documents
├── tests_source/                 # Active test development directory
│   ├── intel-driven/            # Threat intelligence-based tests (28)
│   ├── mitre-top10/             # MITRE Top 10 Ransomware tests (10)
│   └── cyber-hygiene/           # Configuration validation tests (8)
├── utils/                        # Build, signing, and analysis utilities
│   ├── gobuild                  # Cross-platform test builder
│   ├── codesign                 # Code signing utility
│   ├── f0_collector             # Test result collector
│   ├── validate                 # Test validation suite
│   ├── validate_test_results.py # Schema v2.0 validator
│   ├── validate-score-format.sh # Score format checker
│   ├── validate-reference-urls.py # Reference URL validator
│   ├── sync-test-catalog-to-elasticsearch.py
│   ├── analyze_test_results.py  # Test result analyzer
│   ├── combine_test_results.py  # Result combiner
│   ├── get_tests.py             # Test catalog lister
│   ├── create-kibana-dashboard.py # Kibana dashboard generator
│   ├── defender_alert_query.py  # Defender alert querying
│   ├── lc_events_query.py       # LimaCharlie event querying
│   ├── generate-synthetic-test-data.py # Synthetic test data
│   ├── Check-DefenderProtection.ps1
│   ├── Monitor-RegistryChanges.ps1
│   └── README.md                # Utility documentation
├── rules/                        # Development guidelines
├── signing-certs/                # Code signing certificates
├── preludeorg-libraries/         # Prelude testing framework (setup required)
├── CONTRIBUTING.md              # Contribution guidelines
├── CODE_OF_CONDUCT.md           # Community standards
├── SECURITY.md                  # Security policy
├── LICENSE                      # MIT License
└── README.md                    # This file

Getting Started

Prerequisites

Go 1.21+: Required for building tests
Python 3.7+: Required for utilities and ES sync scripts
Supported platforms: Windows (primary), Linux, macOS
Prelude Libraries: Must be configured in the preludeorg-libraries/ directory
Administrator Access: Some tests require elevated privileges
osslsigncode (optional): For code signing Windows executables

Quick Start

Clone the repository:

git clone https://github.com/ubercylon8/f0_library.git
cd f0_library

Set up Python virtual environment (for utilities):

python3 -m venv .venv
source .venv/bin/activate
pip install -r utils/requirements.txt  # Core deps; also install elasticsearch for ES sync

Read the documentation:
- Development Guide - Complete setup instructions
- Architecture Overview - System design
- Contributing Guidelines - How to contribute
Set up Prelude libraries (required for test compilation): Place the Prelude OpenSource tree under preludeorg-libraries/ so test go.mod files can resolve github.com/preludeorg/libraries/go/tests/endpoint. See docs/DEVELOPMENT.md for the exact directory layout used by utils/gobuild.
Install dependencies (optional):

# macOS
brew install osslsigncode

# Ubuntu/Debian
sudo apt-get install osslsigncode

# Windows
winget install Microsoft.WindowsSDK

Building Tests

Use the provided gobuild utility for cross-platform compilation:

# Build a specific test (Windows/amd64 by default)
./utils/gobuild build tests_source/intel-driven/<test-uuid>/

# Build all tests in a category
for dir in tests_source/intel-driven/*/; do
    ./utils/gobuild build "$dir"
done

# Build all tests
./utils/gobuild build-all

# List available tests
./utils/gobuild list

Cross-Platform Builds

# Windows (default)
GOOS=windows GOARCH=amd64 go build -o test.exe main.go test_logger.go test_logger_windows.go org_resolver.go

# Linux
GOOS=linux GOARCH=amd64 go build -o test main.go test_logger.go test_logger_linux.go org_resolver.go

# macOS (Apple Silicon)
GOOS=darwin GOARCH=arm64 go build -o test main.go test_logger.go test_logger_darwin.go org_resolver.go

Code Signing

Sign Windows executables using the codesign utility:

# Sign a specific binary
./utils/codesign sign build/<test-uuid>/<test-uuid>.exe

# Dual-sign with organization certificate (for ASR bypass)
./utils/codesign sign-nested build/<test-uuid>/<test-uuid>.exe --org sb

# Sign all binaries in build directory
./utils/codesign sign-all

# Verify signature
./utils/codesign verify build/<test-uuid>/<test-uuid>.exe

Running Tests

Deploy and execute tests on target systems:

# Copy test binary to target
scp build/<test-uuid>/<test-uuid>.exe user@target:c:/F0/

# Execute on target
ssh user@target "c:/F0/<test-uuid>.exe"

# Check results
cat c:/F0/test_execution_log.json

Cross-Platform Support

Tests can target Windows, Linux, or macOS. The platform is determined by the threat being simulated.

Platform	`LOG_DIR`	`ARTIFACT_DIR`	Binary Extension
Windows	`C:\F0`	`c:\Users\fortika-test`	`.exe`
Linux	`/tmp/F0`	`/home/fortika-test`	(none)
macOS	`/tmp/F0`	`/Users/fortika-test`	(none)

Platform-specific logger files (test_logger_windows.go, test_logger_linux.go, test_logger_darwin.go) define these constants. Copy the shared test_logger.go AND the appropriate platform file from sample_tests/multistage_template/ when creating new tests.

Detection & Defense Artifacts

Each test generates detection rules in 5 formats and comprehensive defense guidance:

Detection Rules

Format	File	Target Platform
KQL	`<uuid>_detections.kql`	Microsoft Sentinel / Defender
YARA	`<uuid>_rules.yar`	File-based scanning
Sigma	`<uuid>_sigma_rules.yml`	Vendor-agnostic SIEM
Elastic EQL	`<uuid>_elastic_rules.ndjson`	Elastic SIEM
LimaCharlie D&R	`<uuid>_dr_rules.yaml`	LimaCharlie

Defense Guidance

Artifact	File	Purpose
Defense Guide	`<uuid>_DEFENSE_GUIDANCE.md`	Consolidated detection + hardening
Windows Hardening	`<uuid>_hardening.ps1`	PowerShell hardening script
Linux Hardening	`<uuid>_hardening_linux.sh`	Bash hardening script
macOS Hardening	`<uuid>_hardening_macos.sh`	macOS hardening script

Test Development

Test Result Codes

Code	Name	Description
101	`Unprotected`	Attack succeeded - system unprotected
105	`FileQuarantinedOnExtraction`	File quarantined by AV/EDR
126	`ExecutionPrevented`	Execution blocked by security solution
999	`UnexpectedTestError`	Test prerequisites not met

Path Conventions

Artifact Type	Path	Reason
Test binaries (.exe)	`c:\F0`	Whitelisted - allows execution
Embedded tools	`c:\F0`	Same as above
Log files	`c:\F0`	Standard location
Simulation artifacts	`c:\Users\fortika-test`	NOT whitelisted - EDR detects

Test Quality Scoring

f0_library tests are scored under Rubric v2.1 (active since 2026-04-25), a tiered realism-first model that separates test-property quality from tenant-defense posture:

Tier	Weight	What it scores
Safety gate	pass/fail	Reversibility, scope containment, no destructive side effects on the target host
Realism	0–7	API fidelity (2.5) + identifier fidelity (1.5) + telemetry signal quality (2.0) + execution-context fidelity (1.0)
Structure	0–3	Schema v2.0 (1.0) + docs (1.0) + logging (0.5) + operational hygiene (0.5)

Realism criterion 2c (telemetry signal quality) is capped at 1.5 without lab evidence — tests must demonstrate all stages reach detonation, or document unreachable stages per the Lab-Bound Observability schema.

Each test's RubricVersion field in TestMetadata indicates which rubric scored it: v2.1 (current), v2 (legacy realism-first), or v1 (legacy co-equal 5-dimension). Existing tests are preserved at their original rubric scores — not retroactively re-scored.

Full proposal: docs/PROPOSED_RUBRIC_V2.1_SIGNAL_QUALITY.md. Methodology overview: docs/F0RT1KA_SCORING_METHODOLOGY.md.

Schema v2.0 Logging

All tests implement Schema v2.0 compliant logging for analytics:

// Required metadata
metadata := TestMetadata{
    Version:    "1.0.0",
    Category:   "defense_evasion",
    Severity:   "high",
    Techniques: []string{"T1562.001"},
    Tactics:    []string{"defense-evasion"},
    Score:      8.5,
}

// Execution context with organization UUID
executionContext := ExecutionContext{
    ExecutionID:  uuid.New().String(),
    Organization: orgInfo.UUID,  // From org_resolver.go
    Environment:  "lab",
}

InitLogger(testID, testName, metadata, executionContext)

Creating a New Test

Generate a UUID for your test (lowercase format)
Choose the appropriate category:
- intel-driven/ - For threat intelligence-based tests
- mitre-top10/ - For MITRE ATT&CK top technique tests
- cyber-hygiene/ - For configuration validation tests
Create the test directory structure:

mkdir tests_source/<category>/<uuid>/

Copy required files from sample_tests/multistage_template/:
- test_logger.go - Schema v2.0 logging
- test_logger_<platform>.go - Platform constants
- org_resolver.go - Organization UUID resolution
Implement the test following the standard pattern
Create documentation:
- README.md - Brief test overview with score
- <uuid>_info.md - Detailed information card
- <uuid>_references.md - Source provenance and references

Or use the automated builder: @sectest-builder <threat intelligence article>

LimaCharlie Integration

f0_library includes Infrastructure as Code for LimaCharlie:

# Deploy certificate installer
./limacharlie-iac/scripts/deploy-cert-installer.sh <org-name>

# Deploy detection rules
limacharlie config push --config limacharlie-iac/f0rtika-org-template.yaml

# Sync test catalog to Elasticsearch
source .venv/bin/activate
python3 utils/sync-test-catalog-to-elasticsearch.py

See limacharlie-iac/README.md for full deployment guide.

CI/CD & Automation

Continuous Integration

Build Workflow: Tests utilities on Ubuntu and macOS, validates Go compilation
Security Workflow: Gitleaks + TruffleHog secret scanning, ShellCheck, PSScriptAnalyzer
Claude Code Review: Automated PR reviews with domain-specific security test knowledge
Claude Code Action: Interactive issue/PR assistance via @claude mentions

Security Scanning

Gitleaks: Detects secrets and credentials in git history
TruffleHog: Verified secret detection with reduced false positives
ShellCheck: Static analysis for shell scripts
PSScriptAnalyzer: PowerShell script security analysis
Weekly Scans: Automated security checks every Monday

Security Considerations

WARNING: This framework contains and executes real attack techniques. Use only in isolated, controlled environments with appropriate authorization.

Authorization Required: Only use on systems you own or have explicit permission to test
Isolated Environments: Never run on production systems or networks
Monitoring: All test executions should be logged and monitored
Responsible Use: Follow ethical hacking principles and local laws

For more details, see our Security Policy.

Contributing

We welcome contributions from the security community! Please read our Contributing Guidelines and Code of Conduct before getting started.

Quick Contribution Checklist

Read CONTRIBUTING.md for detailed guidelines
Follow the established test structure patterns
Map all tests to MITRE ATT&CK techniques
Include comprehensive documentation with test scores
Test thoroughly in isolated environments
Submit pull requests using our PR template

Documentation

Architecture Overview - System design and multi-binary bundles
Agent Architecture - Orchestrator and agent design
Development Guide - Complete setup and development
Schema v2.0 Guide - Test results schema
Multi-stage Reference - Multi-stage build patterns
Dual Signing Strategy - Code signing details
Scoring Methodology - Test scoring criteria
ES Export Quickstart - Elasticsearch export setup
Windows SSH Setup - SSH deployment to Windows targets
Security Policy - Vulnerability disclosure and best practices
Contributing Guide - How to contribute effectively
Changelog - Version history and changes
LimaCharlie IaC - Detection infrastructure deployment

License

This project is licensed under the Apache License, Version 2.0 — see the LICENSE and NOTICE files for the full text and contributor information.

f0_library was relicensed from MIT to Apache 2.0 on 2026-04-25 to align with the upstream ProjectAchilles ecosystem. Contributions accepted prior to that date remain available under MIT terms; all contributions thereafter are Apache 2.0. See NOTICE for the full transition statement.

Additional Notice: This software is designed for security testing and evaluation purposes only. Users are responsible for ensuring they have proper authorization before conducting any security tests.

Support & Community

Bug Reports: Use our issue templates
Feature Requests: Submit via GitHub issues
Security Issues: Follow our disclosure policy
Questions: Use GitHub Discussions for general questions

Ethical Use Notice: This framework is intended for authorized security testing only. Always ensure you have explicit permission before testing any systems.

Name		Name	Last commit message	Last commit date
Latest commit History 402 Commits
.github		.github
docs		docs
limacharlie-iac		limacharlie-iac
preludeorg-libraries		preludeorg-libraries
sample_tests		sample_tests
tech-reports		tech-reports
temp_resources		temp_resources
tests_source		tests_source
utils		utils
.gitignore		.gitignore
.mcp.json		.mcp.json
CLAUDE.md		CLAUDE.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
NOTICE		NOTICE
README.md		README.md
SECURITY.md		SECURITY.md
test-results-schema-v2.0.json		test-results-schema-v2.0.json

Folders and files

Latest commit

History

Repository files navigation

f0_library — Security Testing Framework

Overview

Purpose

Key Features

Test Categories

Agent Architecture

Execution Phases

Agent Selection

Project Structure

Getting Started

Prerequisites

Quick Start

Building Tests

Cross-Platform Builds

Code Signing

Running Tests

Cross-Platform Support

Detection & Defense Artifacts

Detection Rules

Defense Guidance

Test Development

Test Result Codes

Path Conventions

Test Quality Scoring

Schema v2.0 Logging

Creating a New Test

LimaCharlie Integration

CI/CD & Automation

Continuous Integration

Security Scanning

Security Considerations

Contributing

Quick Contribution Checklist

Documentation

License

Support & Community

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages