ARES AI Platform Automates Red Teaming for Active Directory and Cloud Environments

A new open-core project named ARES is empowering red teams with automated, controlled attack simulations for Active Directory and cloud environments. Developed by an independent entity known only as Mafifrizi and released on GitHub, ARES provides 66 active modules, with a total of 70 cataloged, covering over 60 MITRE ATT&CK techniques. The platform is designed for enterprise red teams, managed security service providers (MSSPs), and security operations centers (SOCs).

ARES is positioned as an open-core project, meaning its foundational code is freely accessible for review and testing, with ongoing development supported through sponsorship. The project aims to address the limitations of traditional penetration tests, which are often costly, infrequent, and provide only a snapshot in time. Unlike vulnerability scanners that list numerous potential weaknesses without demonstrating exploitability, ARES executes real attack steps to identify pathways to critical assets like domain administrator accounts.

A key feature of ARES is its robust scope management to prevent tests from straying into unauthorized areas. Before executing any module, a 'ScopeGuard' function verifies that the target is within the defined scope. Additionally, a 'Scope Firewall and Egress Filter' operates at two levels: utilizing the operating system's firewall (Windows Defender Firewall or Linux Netfilter) when run with elevated privileges, and monitoring network calls directly within Python. This 'fail-closed' design ensures that the tool halts operations rather than sending traffic to unapproved destinations.

The platform also incorporates a 'noise profiling' capability, allowing operators to assess and select quieter actions for stealthier testing, thereby minimizing the risk of disrupting production systems or alerting defensive teams prematurely. This focus on controlled and observable actions aligns with a broader industry trend towards more deliberate and human-guided security testing.

For Active Directory environments, ARES can ingest BloodHound collections or map live domain sessions. Its integrated graph engine then calculates the most efficient routes to Domain Admin privileges, identifies critical chokepoints, and assesses the feasibility of lateral movement. This functionality mirrors the graph-based approach used by tools like BloodHound to visualize complex access paths within an organization.

Operators can define specific objectives, such as achieving 'domain_admin' status, a 'full_compromise,' or conducting a 'cloud_audit.' The platform's planning engine constructs multi-step attack plans based on graph rules. Optionally, ARES can integrate with AI agents like Claude, OpenAI, or local Ollama models, but only with explicit operator consent. This cautious approach to AI integration is notable, as many offensive tools are increasingly relying on large language models for attack planning.

To secure sensitive data collected during engagements, ARES employs several protective measures. Session data is stored in a database, access tokens are kept short-lived in memory, and refresh tokens are rotated. Harvested credentials and evidence are stored in a local vault encrypted with AES-256-GCM and PBKDF2-HMAC-SHA256 at a high iteration count. Upon completion of a test, ARES can generate reports in various formats, including PDF, HTML, Markdown, and JSON, with PDF generation handled by a headless browser.

The developers emphasize that ARES should only be used on systems for which explicit permission has been granted. They recommend initial testing in a lab environment to validate scope rules and code integrity before deployment on live networks. The platform's ability to automate complex attack paths and provide detailed reporting makes it a significant tool for both offensive security professionals and defenders seeking to proactively test their environments.