I'm building Cyllex, an adversary-emulation and purple-team framework, and I want to document the journey openly. This is the opening post of a series: a tour from the outside in. Cyllex is still pre-release and in active development — what you'll read here is the shape of the framework as it stands today, on the road to v1.0.
What Cyllex Is
In one sentence: Cyllex executes real attacker techniques and then checks whether your defenses actually saw them. It's the full purple-team loop in a single tool — run the technique (red), correlate it against your SIEM (blue), and get a per-technique verdict of detected, partially detected, or missed.
Most tooling lives on one side of that line. You have offensive frameworks that detonate techniques, and detection content that lives separately in your SIEM. Cyllex closes the gap between them: every technique it ships carries the telemetry it should produce, so after execution it can go ask your SIEM "did you log this?" and turn the answer into a detection-gap report.
The Motivation
As a red teamer I've always enjoyed building and refining attacks. As a purple teamer, I've lived the other side too — and that's where the frustration came from. I've burned countless hours adapting TTPs from existing frameworks and atomic tests to make them work in a specific environment: fixing broken scripts, adjusting paths, patching techniques written for a different OS version. Time that should have gone into improving detections instead went into babysitting flaky tooling.
A second frustration was cloud. Modern attacks don't stop at the endpoint — they move through Entra ID, IAM, Key Vaults and storage. But validating cloud detections end-to-end (run the cloud technique → confirm the SIEM caught it) was painful and fragmented. I wanted one place where endpoint and cloud are first-class citizens and the detection loop closes the same way for both.
So the goal of Cyllex is simple: make purple teaming reliable and reproducible. Battle-tested techniques that run the same in your lab and in a client's tenant. No mystery failures mid-engagement. And results that point straight at what to fix.
What It Does
A large, MITRE-mapped technique library
Cyllex ships 600+ techniques across seven platforms — Windows, Linux, AWS, Azure, GCP, Kubernetes and Docker — each mapped to MITRE ATT&CK. Techniques are organized into packs (think content modules you can enable, add to, or author yourself), so the library grows without touching the engine.
Flexible execution
Different engagements need different footprints. Cyllex runs techniques via a lightweight agent (Windows/Linux), agentless over WinRM or SSH when you want minimal footprint, and runs cloud techniques directly against AWS, Azure and GCP. Campaigns can be sequential, phased or parallel, and scheduled to run on their own.
Detection validation across five engines
This is the heart of the tool. After a campaign, Cyllex correlates what it executed against your SIEM or EDR — Splunk, Microsoft Sentinel, AWS Security Hub, GCP Cloud Logging, or Microsoft Defender for Endpoint — and reports which techniques were detected, partially detected, or missed. For the gaps, it can draft Sigma rules, and it rolls the verdicts up into a per-tactic coverage report.
Threat intelligence built in
Instead of jumping between threat reports and your testing tool, Cyllex includes an APT knowledge base: profiles for major threat groups across Russia, China, North Korea, Iran and cybercriminal crews, mapped to the techniques they're known for. Pick a group, load their playbook, emulate a realistic intrusion — and report findings in terms of real adversaries, not just technique IDs.
Reporting and matrices
Interactive MITRE ATT&CK matrices (Enterprise, Cloud, Containers) show your coverage at a glance. HTML reports, CSV export and ATT&CK Navigator layers turn an engagement into something you can hand to stakeholders.
The Technology (High Level)
Cyllex is written in Rust, chosen for performance, safety and the ability to ship a single self-contained binary with no runtime to install. A few of the choices worth highlighting — future posts will go deeper:
- One binary, batteries included. The server (built on the Axum web framework) embeds the web dashboard and the agent templates directly into the executable. You copy one file to a host and run it — no toolchain, no dependencies.
- Instant agent generation. Configured agents are produced by binary patching in under a second — no compiler needed on the deployment host. You set the C2 URL, sleep and jitter, and download a ready-to-run agent.
- Native remote execution. Agentless WinRM and SSH are handled natively in Rust — no external helpers to install.
- Cloud via the provider APIs. Cloud techniques run against the AWS/Azure/GCP control and identity planes, and SIEM correlation talks to each platform's query API directly.
- Security hygiene for an offensive tool. Role-based access control, hashed credentials, JWT sessions, and AES-256-GCM encryption for secrets stored at rest.
- Pack-based content. Techniques and their detection metadata live in versioned packs, decoupled from the engine, so the library evolves independently.
The throughline: keep the engine lean and portable, and put the value in the content — techniques that work, paired with the detection signals they produce.
The Series Ahead
This was the 10,000-foot view. Upcoming posts will zoom in on the parts that matter:
- The detection-validation loop in depth — how a technique becomes a "detected vs missed" verdict.
- Cloud purple teaming — closing the loop in Azure, AWS and GCP.
- The agent and execution model.
- Authoring your own techniques and packs.
If any of this resonates with the time you've lost wrestling flaky TTPs or chasing cloud detections, you're exactly who I'm building this for.
Following along?
Cyllex is in active development. Track progress on the Framework Updates page — Part 2 of the series is on the way.