ALIOTH is a Windows-focused offensive security framework designed for authorized red-team operations, enterprise adversary simulation, malware analysis, security-control validation, and post-exploitation research.

⚔️ Operational Documentation

For the complete ALIOTH v3.0 walkthrough including commands, operational usage, and a fictional enterprise APT/red-team scenario demonstrating the framework end-to-end: https://sn0xs-organization.gitbook.io/sn0x-order.org/red-team-notes/alioth-unified-apt-framework-v3.0

Use cases include:

• Authorized enterprise red-team engagements
• Adversary-emulation exercises
• Purple-team operations
• Active Directory security assessments
• Windows endpoint security assessments
• Post-exploitation research
• Malware analysis and reverse engineering
• EDR/XDR validation
• Detection-engineering validation
• Incident-response preparedness exercises
• Internal security research
• Authorized security-control testing

The framework is intended to model real-world adversary behavior in controlled engagements and can therefore interact with production-like enterprise environments when the engagement rules explicitly permit it.

ALIOTH is a unified offensive security framework that combines 13 attack modes into a single standalone binary. No DLL dependencies, no runtime installers one .exe that covers the complete attack chain from initial access to data exfiltration and anti-forensics.

Every mode shares a common evasion engine indirect syscalls, stack spoofing, gadget rotation, ETW patching, HWBP clearing, polymorphic stubs. This is not a toolbox with 13 separate signatures. It is one binary, one evasion layer, protecting everything underneath.

At a high level:

                         ALIOTH
                           │
          ┌────────────────┼────────────────┐
          │                │                │
       Execution       Credential       Enterprise
       & Memory         Research        Operations
          │                │                │
      ┌───┴───┐        ┌───┴───┐       ┌───┴────��
      │ Umbra │        │Wraith │       │ Hermes │
      │Charon │        │Mortis │       │ Helios │
      │Revenant        │Shadow │       │  Nyx   │
      └───────┘        └───────┘       └────────┘
                           │
                 ┌─────────┴─────────┐
                 │                   │
             Persistence         Collection /
             & Evasion           Operations
                 │                   │
           ┌─────┴─────┐       ┌────┴──────┐
           │    Eos    │       │ Lachesis  │
           │  Acheron  │       │           │
           │ Tartarus  │       └───────────┘
           └───────────┘

Where ALIOTH Can Be Used

ALIOTH is intended for authorized operations against environments such as:

Active Directory Environments

┌─────────────────────────────────────────┐
│             AD Environment              │
│                                         │
│  Domain Controller                      │
│       │                                 │
│       ├── Workstations                  │
│       ├── Servers                       │
│       ├── File Servers                  │
│       ├── SQL / Application Servers     │
│       ├── Admin Workstations            │
│       └── Security Infrastructure       │
│                                         │
└─────────────────────────────────────────┘

Typical red-team objectives may include evaluating:

• Credential exposure
• Privilege boundaries
• Kerberos security
• Lateral-movement controls
• Persistence detection
• Endpoint telemetry
• EDR/XDR visibility
• Network monitoring
• C2 detection
• Data-loss controls

Windows Enterprise Environments

ALIOTH can be incorporated into authorized assessments involving:

• Windows endpoints
• Windows servers
• Domain-joined systems
• Enterprise application servers
• Security appliances
• Identity infrastructure
• Administrative workstations
• Internal network segments

Red-Team Infrastructure

Core Capabilities

ALIOTH contains thirteen operational modes:

The complete mode inventory is defined in the supplied project guide.

Detailed mode internals are intentionally documented separately so the main README remains focused on installation, architecture, engagement use, and operator workflow.

Installation

Requirements

ALIOTH is a Windows/x64 project.

Recommended build environment:

Windows 10 / Windows 11 x64
Visual Studio
Desktop development with C++
Windows SDK
MASM
Python 3.x
Git

The source project uses a Windows build script and Microsoft development tooling.

Clone the Repository

git clone <REPOSITORY_URL>
cd ALIOTH

Verify the development environment:

cl
link
python --version
git --version

Open a Visual Studio Developer Command Prompt before building.

Building ALIOTH

From the repository directory:

cd C:\ALIOTH
.\build.bat

The supplied implementation supports configurable build-generation parameters through the build script.

For development environments, recommended repository structure is:

ALIOTH/
├── build/
├── bin/
├── core/
├── modes/
└── tools/

Keep generated binaries separate from source code.

Binary Layout

A normal build produces the primary ALIOTH executable and supporting development artifacts.

ALIOTH/
│
├── ALIOTH.exe
├── build.bat
├── README.md
│
├── core/
│   ├── ALIOTH.h
│   ├── ALIOTH_config.h
│   ├── engine.h
│   ├── engine.c
│   ├── tls_context.h
│   ├── syscalls_base.asm
│   └── ...
│
└── modes/
    ├── umbra/
    ├── charon/
    ├── wraith/
    ├── revenant/
    ├── mortis/
    ├── shadow/
    ├── hermes/
    ├── eos/
    ├── helios/
    ├── nyx/
    ├── acheron/
    ├── lachesis/
    └── tartarus/

The supplied documentation describes this source organization and the shared core/ plus 13 modes/ architecture.

Command-Line Interface

ALIOTH supports both interactive operation and direct mode selection.

Interactive

ALIOTH.exe

Mode Selection

The general CLI structure is:

ALIOTH.exe --mode <MODE>

or, where supported by a release build:

ALIOTH.exe <MODE>

Examples:

ALIOTH.exe 1
ALIOTH.exe 2
ALIOTH.exe 3
...
ALIOTH.exe 13

The project documentation defines these as modes 1 through 13.

Payload / .bin Workflow

Several ALIOTH components operate on binary payload artifacts.

The general workflow is:

Payload
   │
   ▼
.bin artifact
   │
   ▼
Mode-specific preparation
   │
   ▼
ALIOTH build
   │
   ▼
Authorized target

For example, Charon uses a binary payload artifact and a dedicated preparation utility before the resulting artifact is incorporated into the build. The supplied documentation identifies charon_builder.py as the relevant preparation component.

A generic workflow looks like:

python <mode-builder> --payload <payload.bin> --output <artifact>

Then rebuild:

.\build.bat

Active Directory Engagement

A common authorized assessment architecture:

                RED TEAM
                   │
                   ▼
          Operator Infrastructure
                   │
             ALIOTH / C2
                   │
       ┌───────────┴────────────┐
       │                        │
       ▼                        ▼
 Domain Controller          Workstations
       │                        │
       ├── Identity             ├── Users
       ├── Kerberos             ├── Admins
       ├── LDAP                 ├── EDR
       └── Group Policy         └── Applications

Engagement Profiles

ALIOTH can be incorporated into several types of authorized engagements.

External Red Team

Focus:

Internet-facing asset
       ↓
Initial access
       ↓
Endpoint compromise
       ↓
Internal access
       ↓
Identity expansion
       ↓
Objective

Internal Red Team

Focus:

Internal foothold
       ↓
AD enumeration
       ↓
Privilege boundaries
       ↓
Credential access
       ↓
Lateral movement
       ↓
High-value asset

Purple Team

Focus on measurable detection:

ALIOTH Technique
       ↓
Telemetry
       ↓
Detection
       ↓
SOC Alert
       ↓
Analyst Response
       ↓
Rule Improvement

Malware Analysis

ALIOTH can also be used as a research subject when studying:

• Memory execution
• Windows internals
• Endpoint telemetry
• Process behavior
• Authentication behavior
• Persistence mechanisms
• Network behavior
• EDR detections

Use an isolated analysis environment and appropriate snapshots.

Environment Preparation

A mature engagement environment should contain:

Operator Host
       │
       ├── Source / Build Environment
       ├── Debugging Tools
       ├── Logging
       └── Engagement Notes
                │
                ▼
        Red-Team Infrastructure
                │
        ┌───────┴────────┐
        │                │
       C2              Proxy
        │
        ▼
    Target Network

For AD assessments, maintain accurate inventory of:

Domain
Domain Controllers
Workstations
Servers
Administrative Accounts
Service Accounts
Security Products
Network Segments
Critical Applications

Safety Controls During Engagement

Recommended operational controls:

Scope Enforcement

Keep an explicit target allowlist.

ALLOW:
  *.authorized-domain.local
  10.10.10.0/24

DENY:
  Everything else

Configuration

Project configuration is centralized through the shared core configuration layer.

Relevant source components include:

core/ALIOTH_config.h
core/tls_context.h
core/engine.h

The supplied project structure documents these components as part of the common execution engine.

Keep engagement-specific configuration outside public source repositories.

Mode Invocation Convention

The framework follows a consistent convention:

ALIOTH.exe --mode <MODE> [OPTIONS]

Common option categories include:

--payload <file>
--target <name>
--output <file>
--pid <pid>
--server <host>
--port <port>
--sleep <seconds>
--jitter <seconds>

Mode-specific options are exposed by the corresponding module.

For security reasons, the public README intentionally avoids providing turnkey command lines for credential extraction, persistence, C2 deployment, unauthorized lateral movement, or security-control bypass.

Detection Engineering Integration

ALIOTH is particularly useful when offensive activity is paired with defensive telemetry.

              ALIOTH
                 │
                 ▼
          Technique Execution
                 │
        ┌────────┼────────┐
        ▼        ▼        ▼
      EDR      Sysmon    SIEM
        │        │        │
        └────────┼────────┘
                 ▼
             Detection
                 │
                 ▼
            SOC Response
                 │
                 ▼
         Detection Tuning

This makes the framework useful for validating whether security controls detect behavior, rather than merely matching known malware hashes.

Source Tree

ALIOTH/
│
├── ALIOTH.exe
├── build.bat
├── README.md
│
├── core/
│   ├── ALIOTH.h
│   ├── ALIOTH_config.h
│   ├── tls_context.h
│   ├── engine.h
│   ├── engine.c
│   ├── syscalls_base.asm
│   ├── generate_stubs.py
│   ├── etw_patch.c
│   ├── hwbp_check.c
│   ├── random_mask.c
│   ├── decoy_threads.c
│   └── utils.c
│
└── modes/
    ├── umbra/
    ├── charon/
    │   └── builder/
    ├── wraith/
    ├── revenant/
    ├── mortis/
    ├── shadow/
    ├── hermes/
    ├── eos/
    ├── helios/
    ├── nyx/
    ├── acheron/
    ├── lachesis/
    └── tartarus/

The project documentation identifies the shared core and all thirteen mode directories.

Version

Project     : ALIOTH
Version     : 3.0
Category    : Offensive Security Framework
Platform    : Windows x64
Author      : sn0x
Purpose     : Authorized Security Testing

The supplied guide identifies the project as ALIOTH v3.0 and labels it for authorized security testing.

Disclaimer

ALIOTH is an offensive security research framework.

Use only where you have explicit authorization and an established scope of work.

The author is not responsible for damage, disruption, data loss, credential exposure, unauthorized access, or any other consequence resulting from misuse or deployment outside an authorized engagement.

ALIOTH exists to reproduce realistic adversarial behavior so security teams can understand where their controls succeed, where they fail, and what needs to be improved.