Emulate user activity randomly opening apps through Explorer to generate "legit noise" for EDR and any other log-type collection technology.
The goal is to be solid, feature-rich and a more "natural"* alternative to Sheepl, Invoke-UserSimulator and others.
* meaning it uses Explorer navigation instead of launchers and/or powershell.
It probably still need some adjustments to avoid weird parent-child process events.
This is a working in progress. Please check README and Release Notes.
Randomly opens explorer and navigate into a binary directory, then hit enters to open it (child process of explorer.exe, as natural as possible). Then, it waits a random window of time and run another program (or kill one of the previously opened processes).
Also, each interaction has a 10% chance of finishing the program altogether.
Current software included (Expand to see a Demo and TODO):
1) MS Edge
2) MS Office365 (Outlook, Word, Excel)
3) Notepad
4) Calc
5) Snipping Tool
• OS: Win10
• Win10: Power & Sleep settings: Never/Never
• MS Edge: Page Layout: Custom: Disable both checkboxes. Background: Disabled; Content: Disabled.
• MS Office365's Outlook: E-mail pre-configured. Otherwise read and send e-mails will fail.
• MS Office365's Excel, MS Office365's Word: Nothing specific. It must open without any warnings or prompts and able to edit files (obviously don't use with read-only MS Office version)
• Notepad, Calc, SnippingTool: Native
Download compiled version from here or download AutoIT v3, do your changes and compile yourself into a binary file.
Just run the compiled app. It will randomly close after a while (Exit Status = 0).
If you want to force closing it, you can:
- (Recommended) : Hit the UI close button (Exit Status = 1)
- (Experimental) : Hit SHIFT+ESC hotkey (Exit Status = 2)
The hotkey is NOT reliable since this project does a LOT of typing emulation and it can fail triggering the hotkey function.
• Outlook sending random e-mail to itself and/or to a disposable e-mail (e.g. temp-mail.org, 10minutemail.com)
• Outlook opening random e-mail and attachments
• Edge downloading random files
• Redo the gifs with better resolution
• Test pointing the apps to a folder with .lnk files