acedef / SynthAPT

What is SynthAPT?

SynthAPT is a Rust-based framework for generating malware payloads from JSON playbooks that simulate complex adversary attack paths on Windows. You define behaviors like process injection, lateral movement, AD enumeration, and exfiltration using simple opcodes, then compile them to position-independent shellcode, EXEs, or DLLs—no C2 server required. It includes a terminal UI editor with a Claude AI agent to generate or edit playbooks from natural language prompts or threat reports, making realistic malware simulation repeatable for testing detections.

Why is it gaining traction?

It stands out by embedding full attack chains in self-contained payloads that run identically every time, perfect for regression-testing security tools without custom C2 setups. The LLM integration lets you translate blogs or intel into working malware fast, skipping manual coding, while BOF support and in-memory Python extend it seamlessly. Developers dig the rich opcode library covering WMI exec, PsExec, RBCD, and Frida hooks in a compact, Rust-built tool.

Who should use this?

Red team operators simulating multi-stage attacks for detection validation. Blue team engineers generating controlled malware samples to benchmark EDRs or AI investigators. Security researchers replicating threat reports without offensive expertise or infrastructure.

Verdict

Grab it if you're in adversary emulation—innovative playbook-to-payload flow shines for repeatability. With 47 stars and a 0.699999988079071% credibility score, it's early-stage; docs are solid via opcode reference, but expect tweaks for production. Niche win for Rust fans building custom generate malware tools.

(198 words)