ARES AI Red Team Platform Automates 66 Attack Modules for Active Directory and Cloud Security Testing

A new open-core project called ARES is giving red teams a way to run planned, controlled attack tests against Active Directory and cloud systems. A developer who goes by Mafifrizi released the tool on GitHub.

It ships with 66 active modules, with 70 cataloged in total, covering more than 60 techniques mapped to MITRE ATT&CK. It is aimed at enterprise red teams, managed security providers (MSSPs), and security operations centers.

Mafifrizi publishes the project as an open-core platform, which means the base tool is free to read and test while a sponsorship page supports ongoing work.

The project page lists the repository under the handle “mafifrizi/ares” and describes it as an autonomous red-team engagement platform with MITRE ATT&CK module orchestration, attack-path solving, and reporting. The README does not give a real name, company, or team behind the code, so readers should treat it as an independent project for now.

The author’s pitch is simple. Traditional penetration tests cost a lot, happen rarely, and only show one moment in time, so new misconfigurations can sit unseen for months.

Vulnerability scanners add to the problem by listing thousands of possible CVEs without proving that any of them can be used. ARES tries to fill that gap by running real test steps and showing which ones lead to the most valuable systems, such as domain admin accounts.

The part of ARES that stands out most is how hard it tries to keep tests inside approved limits. Before a module runs, a check called ScopeGuard confirms the target is in scope.

A second layer, the Scope Firewall and Egress Filter, then blocks traffic at two levels. One level uses the operating system firewall, which is Windows Defender Firewall or Linux Netfilter when the tool runs with elevated rights. The other watches network calls inside Python itself. The goal is a “fail-closed” design, where the tool stops instead of sending traffic to an address nobody approved.

The tool also profiles how noisy each action is, so operators can pick quieter steps when they want to test whether the blue team notices. This matters because a careless test can knock over a production server. For the same reason, security teams are shifting toward tools that put a person in charge of each decision.

Active Directory Attack Paths

For Active Directory, ARES can load BloodHound collections or map live domain sessions. Its built-in graph engine then works out the shortest route to Domain Admin, points out chokepoints, and checks whether a sideways move is possible.

BloodHound uses the same graph idea, where a small group membership can open a path that is many steps long. Cyber Security News has explained how BloodHound Community Edition maps these paths across Active Directory and Azure.

Operators can set a goal such as domain_admin, full_compromise, or cloud_audit. The planning engine then builds a multi-step plan from graph rules. It can also use AI agents such as Claude, OpenAI, or a local Ollama model, but only after the operator gives clear permission.

The same planning engine covers cloud checks, and the cloud_audit goal is one of the built-in options. Letting a language model suggest next steps is now common in offensive tools. Cyber Security News recently reported on Decepticon, an open-source agent with 16 specialist roles. ARES keeps the AI optional, which many teams will prefer.

Defenders have a reason to watch this space. Criminals are using similar tools. Cyber Security News covered how hackers used the ARTEX AI agents to map Windows networks, steal service account passwords, and try to spread inside the network. A platform like ARES lets defenders test the same steps first, on their own terms.

Because ARES stores sensitive material, the author added several protections. Sessions live in the database, access tokens are short-lived and kept in memory, and refresh tokens are rotated. ARES stores harvested hashes and client evidence in a local vault protected with AES-256-GCM and PBKDF2-HMAC-SHA256 at 600,000 rounds.

When a test ends, ARES can produce branded reports in PDF, HTML, Markdown, and JSON. The PDF step runs through a headless browser, so it needs no extra GTK libraries on Windows or Linux. For teams that want a deeper guide to the Active Directory side, the Active Directory attack checklist on Cyber Security News is a useful companion.

Only run ARES on systems you own or have written permission to test. Start in a lab, check that the scope rules block out-of-range addresses, and review the code before using it on real networks. Fix any path the tool finds to a domain admin account, then run it again to confirm the fix.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ARES AI Red Team Platform Automates 66 Attack Modules for Active Directory and Cloud Security Testing appeared first on Cyber Security News.