Execute real malware
techniques

A technique emulation framework for blue teams and researchers. Generate telemetry, validate detections and observe tradecraft without hosted infrastructure or weaponised samples.

Request Demo Contact Us
Combat Theater technique emulation interface generating telemetry
Overview

Built for blue teams.
Powered by real malware techniques.

Combat Theater is a malware technique testing framework designed specifically for blue team detection engineers and security researchers.

It bridges the gap between blue teaming and malware development by giving defenders the ability to execute real-world malware techniques in isolation - safely, repeatably, and with full visibility.

No weaponised malware. No lab overhead. No infrastructure. Just accurate technique execution that behaves like the real thing.

For

Detection Engineers

Execute malware techniques, generate telemetry, validate detections effortlessly.

For

Security Researchers

Experiment with advanced and niche tradecraft without hours of tedious development.

Comparison

Built for real technique execution.

Atomic scripts, C2 frameworks and BAS platforms each solve a different job. Combat Theater is for isolating, customizing and observing malware techniques whether you're validating detections, purple teaming, or researching tradecraft.

Combat Theater Atomic Red Team Caldera BAS
Ground-truth API-level execution logging
No-code low-level API / memory customization
Research-grade malware technique fidelity
No hosting or web infrastructure required
Threat playbooks / scenario chaining
Run-safe payloads out of the box
Easy install — up and running in 30 seconds
Scriptable / extensible techniques
Use cases

Where technique execution earns its keep.

One framework for the jobs that need real malware techniques, without C2 overhead or script-only approximations.

01

Validate detections

Execute a technique, generate telemetry, and confirm your rule fires before production traffic is the only test.

02

Evaluate detection products

Independently validate how an EDR or detection stack actually performs against real techniques, before you buy, renew, or expand coverage.

03

Purple team exercises

Emulate real TTPs with clean, observable execution. Useful for joint red/blue work without standing up a full C2 stack.

04

Research & analyst training

Explore niche tradecraft or walk analysts through behaviors that matter, repeatably, safely, and with ground-truth logs.

View case studies
Capabilities

Everything you need for emulation.

A complete ecosystem for malware technique execution and validation.

Extensive malware technique emulation library in Combat Theater

Large Technique Library

Access to one of the largest collections of "ready to execute" malware techniques. From common commodity malware behavior to advanced nation-state tradecraft, our library is constantly updated to reflect the current threat landscape.

Combat Theater execution logging console for blue team validation

Advanced Logging

Detailed execution logs capture every API call, memory allocation, and system interaction. Validate your telemetry sources with ground-truth data generated directly from the execution engine.

Customisable shellcode injection technique configuration interface

Execution Customization

Choosing a technique to run is just the start. Customize which APIs it will use, which page permissions will be set, all in a no-code pick'n'mix style gui.

Blue team detection validation workflow in Combat Theater

Technique Transparency

Every technique includes a detailed breakdown of how it works under the hood, from execution flow to the underlying system interactions. It also provides clear detection opportunities helping guide defenders.

Safety

Run-safe payloads.

Execute continuously with confidence. Combat Theater uses custom built payloads designed to mimic real malware structure without the malicious side effects.

10+ Supported Types

From raw shellcode and DLLs to EXEs and more exotic formats. We provide a wide range of payload types out of the box.

Peace of Mind

Our "run safe" payloads perform no network connections and no destructive actions.

Authentic Architecture

Though benign, payloads are compiled with realistic headers, sections, and entry points to trigger behavioral analysis correctly.

Bring Your Own

Easily import your own real-world samples or custom developed payloads. The framework is agnostic to what you execute.

Playbooks
Playbook automation system for malware technique emulation

Chain techniques into playbooks.

Playbooks let you sequence multiple techniques into a single execution flow. Build your own with our playbook builder or choose from a number of our pre curated ones, all executable in just one click.

APT

Emulate known nation-state tradecraft and advanced persistent threat chains.

Criminal

Reproduce ransomware group activity and commodity malware behaviour.

Espionage

Simulate reconnaissance, credential harvesting, and covert data exfiltration.

Challenge

Curated detection challenges — from easy wins to obscure, hard-to-catch techniques.

Scripting

Implement your own techniques with Lua.

We provide 190+ ready to go technique scripts, however should you want to add your own or customize existing techniques, we expose our custom "ctapi" for you.

Combat Theater uses Lua as a control and orchestration layer, while all technique execution is performed by a native C++ engine.

Lua defines the GUI, configuration and execution flow of a technique but the underlying behavior is handled entirely by C++. This ensures techniques behave like real malware but with the ease of scripting. 

-- CreateRemoteThread Shellcode Injection

local meta    = require "meta"
local gui     = require "gui"
local api     = require "api"

function Init()
	meta.SetRequiredPermissions("user")
	meta.SetSupportedPayloads("shellcode")
	meta.SetReadme(readme)
end

function Configurator()
	gui.SetTarget(ctxTarget, true, true, true, false)
	gui.SetPayload(ctxPayload);
	gui.AllocateMemory(ctxAlloc)
	gui.WriteMemory(ctxWrite)
	gui.ChangePagePermissions(ctxPage)
	gui.CreateThread(ctxThread)
	gui.FreeMemory(ctxFree)
end

function ExecuteTechnique()
	-- Init
	local hTargetProcess, hTargetThread = api.InitializeTarget(ctxTarget)

	-- Payload
	local pPayload, iPayloadSize = api.GetPayload(ctxPayload)

	-- Memory
	local pPayloadAddress = api.AllocateMemory(ctxAlloc, hTargetProcess, iPayloadSize)
	api.WriteMemory(ctxWrite, hTargetProcess, pPayloadAddress, pPayload, iPayloadSize)
	api.ChangePagePermissions(ctxPage, hTargetProcess, pPayloadAddress, iPayloadSize)

	-- Execute
	local hThread = api.CreateThread(ctxThread, hTargetProcess, pPayloadAddress, false)

	-- Cleanup
	api.FreeMemory(ctxFree, hTargetProcess, pPayloadAddress)
	api.FreePayload(pPayload)
	api.CloseHandles(ctxFree, hTargetProcess, hTargetThread, hThread)
end
Requirements

Run where it's convenient.

Combat Theater is designed to run in constrained environments without heavy dependencies or specialized hardware.

Supported operating systems

  • Windows 10 (64-bit)
  • Windows 11 (64-bit)
  • Windows Server 2019 / 2022

Runtime environment

  • No GPU or graphics drivers required
  • Runs in cloud and local virtual machines
  • Suitable for low-spec systems

Deployment flexibility

  • Local analyst workstations
  • Cloud-hosted VMs & Labs
  • Automated testing and pipeline hosts
Demo

See it in action.

Pricing

Licensing options.

Professional
For internal detection & security teams
£2,000 per user
Billed yearly · Minimum 3 licences
  • All techniques
  • Advanced execution logging
  • Event viewer & report generation
  • Internal use within your organisation
  • Standard email support
  • One licence per user
Request demo
Enterprise
For consultancies, MSSPs & mature security teams
Custom pricing
Billed yearly · Minimum 5 licenses
  • Everything in Professional
  • External / client-facing use permitted
  • Headless command-line mode
  • Playbook library, builder & runner
  • Priority support
  • Flexible licensing options
  • Team discounts available
Talk to sales

Not sure which fits? Request a demo and we'll map licensing to your workflow.