Detonator - MalDev Testing Service
Detonator executes red team artifacts to validate detection coverage in a reproducible manner.
Realistic and reproducible tests for offensive tooling artifacts and offsec techniques, by running the submitted payloads in a clean VM, and retrieving the detection events.
- Detection results (including all alert details)
- ETW Detection surface via RedEdr
- EDR telemetry and analysis via RedEdr EDR-introspection
Source:
Note:
- submitted files are private
- but the results are public
- sample submission is off
maldev
│
▼
┌───────────┐
│ │
│ Detonator │
│ │
└─────┬─────┘
│
┌───────────────┼──────────────────┐
▼ ▼ ▼
┌──────────┐ ┌─────────┐ ┌────────────────┐
│ │ │ │ │ │
│ Defender │ │ MDE │ │ CrowdStrike │
│ VM │ │ VM │ │ VM │
│ │ │ │ │ │
└────┬─────┘ └────┬────┘ └───────┬────────┘
│ │ │
▼ ▼ ▼
alerts alerts alerts