DetonatorAgent

A agent for realistically executing redteam artifacts and collect their EDR logs.

This enables you to validate the detection coverage of your offsec tradecraft.

Purpose

DetonatorAgent fulfills two purposes:

• File execution
• EDR log collection

It is mainly used to see if initial access chains are undetected for RedTeam engagements. So if your malware is detected (and if yes, why), or not.

It is closely related to RedEdr, which collects the same telemetry as an EDR does. And can be used with Detonator to more reliably detonate MalDev, as shown in detonator.r00ted.ch. A presentation "Detonator - Repeatable Malware Technique Testing" (given at RTS EMEA 25) will be made publicly available sometimes maybe.

Usage

A web UI is available at http://localhost:8080/ when the agent is running.

Use detonate.ps1 or detonate.py for scripted/automated usage:

> powershell.exe -ep bypass .\detonate.ps1 -file mimikatz.exe -executionmode exec

Executing file...
File Execution status: virus

Wait a bit for EDR to process before getting EDR alerts ...

title                      severity category
-----                      -------- --------
HackTool:Win32/Mimikatz!pz High     Tool    

Functionality

DetonatorAgent only does:

1. Write the exectuable file to disk
2. Executes it
3. Grabs EDR logs (either way if execution successful or not)

DetonatorAgent does not influence (configure, modify, change...) the AV, EDR or Windows in any way.

If the Antivirus component of the EDR detects the file when dropped on disk (as we see above with mimikatz), the file got categorized as virus and removed by the AV. No execution can be performed. The EDR logs will still be grabbed. To be able to execute a statically detected file, either create a whitelisted directory and use drop_path, or patch mimikatz so static analysis doesnt detect it anymore.

Installation

Install:

• .NET 8.0 SDK
• Asp.Net

Command Line Options

> dotnet run -- --help

DetonatorAgent 1.0.0
Copyright (C) 2026 DetonatorAgent

  -p, --port    (Default: 8080) Port number to listen on (1-65535). Default: 8080
  -e, --edr     EDR plugin to use. Use '--edr ?' to list available plugins on this OS.
                Default: platform-specific (defender on Windows, logfile on Linux).
  --help        Display this help text

To list the EDR plugins available on the current OS:

> dotnet run -- --edr ?
Available EDR plugins on this OS: defender, example, fibratus, logfile, none
Default: defender

Examples:

# Start with default settings (port 8080, defender EDR)
dotnet run

# Start with custom port
dotnet run -- --port 9090

# Start with fibratus EDR plugin
dotnet run -- --edr=fibratus

# Start with custom port and EDR plugin
dotnet run -- --port 9090 --edr=fibratus

# Short form
dotnet run -- -p 9090 -e fibratus

The API will be available at:

• http://localhost: (default: 8080)

Start it as user (no high privileges required).

Supported Local EDR

For --edr= or -e. Run dotnet run -- --edr ? to list plugins available on the current OS.

Windows-only:

• defender — Windows Defender (default on Windows)
• fibratus — Windows Fibratus

Cross-platform:

• logfile — reads alerts from a plain text log file (default on Linux)
• example — no-op, for workflow testing
• none — disables EDR log collection entirely (use if you only want the detonation functionality)

Adding a new EDR plugin

The plugin list is discovered at runtime via reflection — there is no hardcoded list. To add a new EDR:

1. Create a new file in EdrPlugins/ implementing IEdrService.
2. Annotate the class with [EdrPlugin("myname", EdrPlatform.Windows|Linux|Cross)]. Optionally set WindowsDefault = true or LinuxDefault = true.
3. Rebuild. The plugin is now selectable via --edr myname.

No other file needs to be edited.

EDR: Defender

Works out of the box.

EDR: Fibratus

Configure event logs to use json instead of pretty:

File %PROGRAMFILES%\Fibratus\Config\fibratus.yml:

alertsenders:
  eventlog:
    format: json

Linux support

Install DotNet:

$ apt install dotnet-sdk-8.0

DetonatorAgent has best-effort Linux support:

• Only the exec execution mode is available (no AutoIt, no clickfix).
• Default drop path is /tmp/.
• Zip/tar extraction is not implemented — pass a plain executable.
• No Linux-native EDR plugin is included. The default logfile plugin lets you bridge your own EDR through a text log file. Alternatives: --edr=example (no-op workflow test) or --edr=none (disable EDR collection entirely).

Build & run:

dotnet build
dotnet run

Feature: File Execution

The /api/execute/exec API will execute the given file. So the EDR (or AV) can do its thing.

Execution Mode: Direct

This will write the given file into the selected directory (drop_path).

If it's a .zip, the content of it will be extracted. If it contains more than one file, the alphabetically first one will used as executable.

Execution is performed with Process.start() with UseShellExecute=true, which means that the file has to have a valid Windows execution handler. For .exe files, it is possible to give arguments.

The exception is for .dll, which is executed with rundll32.exe. The file argument is then used as DLL export which will be called:

rundll32.exe <filepath>,<argument>

Execution Mode: AutoIt

It is intended to simulate a user "clicking" the malware: It will use the Windows integrated default app association to start the file (be it .exe, .lnk, or others).

The containers .zip and .iso will be clicked in explorer to be opened. The alphabetically first file will be double-clicked.

Feature: EDR Log retrieval

The /api/logs/edr will return the alerts of your EDR product, between calling /api/exec/execute and calling /api/exec/kill OR the current time.

Example:

> curl.exe http://localhost:8080/api/logs/edr
{
  "success": true,
  "alerts": [
    {
      "source": "Defender Local",
      "raw": "{\"Product Name\":\"Microsoft Defender Antivirus...}",
      "alertId": "{3F8AE8C6-70BF-4781-BD6C-2E9C0E996F1D}",
      "title": "HackTool:Win32/Mimikatz!pz",
      "severity": "High",
      "category": "Tool",
      "detectionSource": "Real-Time Protection",
      "detectedAt": "2025-12-31T11:24:41.317+01:00",
      "additionalData": {}
    }
  ],
  "isDetected": true
}

Usage: With curl

Curl Execution

curl.exe -X POST http://localhost:8080/api/execute/exec -F "file=@c:\tools\procexp64.exe"

Optional arguments:

• drop_path: Where the file will be stored (default is C:\Users\Public\Downloads)
• excecution_mode: One of the execution modes (exec, autoit)
• executable_args: Parameter to give the exe (e.g. --help) (only for exec mode)

curl.exe -X POST http://localhost:8080/api/execute/exec -F "file=@c:\tools\procexp64.zip" -F "drop_path=C:\temp\" -F "execution_mode=autoit"

curl.exe -X POST http://localhost:8080/api/execute/exec -F "file=@c:\tools\procexp64.exe" -F "drop_path=C:\temp\" -F "executable_args=--help" -F "execution_mode=exec"

Curl EDR Logs

Grab the EDR logs:

curl.exe -s -X POST http://localhost:8080/api/logs/edr

It will return all EDR events between:

• Start of execution with /api/execute/exec
• Stop of execution with /api/execute/kill - OR current time

Curl Cleanup

Cleanup the last execution:

• Attempt to kill the started process
• Remove the temporary .zip files
• Unmount mounted D: from iso

curl.exe -s -X POST http://localhost:8080/api/execute/kill