50\n| project Timestamp, DeviceName, RemoteUrl"
),
"sigma": (
"title: DNS Tunneling Detection\nstatus: experimental\n"
"logsource:\n product: dns\n category: dns\n"
"detection:\n selection:\n query|re: '.{50,}\\..*'\n"
" condition: selection\nlevel: high"
),
"yara": (
"rule DNS_Tunneling {\n strings:\n"
' $a = "iodine" ascii\n $b = "dnscat" ascii\n'
' $c = "dns2tcp" ascii\n'
" condition:\n any of them\n}"
),
"edr_config": {
"en": "Enable DNS logging, deploy DNS analytics, restrict to internal resolvers, block DoH/DoT to external.",
"fr": "Activer la journalisation DNS, d\u00e9ployer l\u2019analyse DNS, restreindre aux r\u00e9solveurs internes.",
},
},
{
"id": "c2-legitimate",
"category": "Network Evasion",
"name": {"en": "C2 over Legitimate Services", "fr": "C2 via Services L\u00e9gitimes"},
"difficulty": "Hard",
"mitre": "T1102 - Web Service",
"desc": {
"en": "Uses legitimate cloud services (Slack, Teams, OneDrive, GitHub) as C2 channels to blend with normal traffic.",
"fr": "Utilise des services cloud l\u00e9gitimes (Slack, Teams, OneDrive, GitHub) comme canaux C2 pour se fondre dans le trafic normal.",
},
"pseudocode": (
"# Educational pseudocode\n"
"# Using GitHub Gist as C2 channel\n"
"commands = github_api.get_gist(gist_id)\n"
"result = execute(commands)\n"
"github_api.update_gist(gist_id, result)"
),
"detection": {
"en": "Anomalous API usage patterns, unusual data volumes to cloud services, beacon timing analysis.",
"fr": "Sch\u00e9mas d\u2019utilisation API anormaux, volumes de donn\u00e9es inhabituels vers les services cloud.",
},
"countermeasure": {
"en": "Cloud access security broker (CASB), API monitoring, behavioral analytics for cloud service usage.",
"fr": "Courtier de s\u00e9curit\u00e9 d\u2019acc\u00e8s cloud (CASB), surveillance API, analytique comportementale.",
},
"sysmon": "3, 22",
"kql": (
"DeviceNetworkEvents\n| where RemoteUrl has_any ('github.com','slack.com','graph.microsoft.com')\n"
"| summarize count() by DeviceName, RemoteUrl, bin(Timestamp, 1h)\n"
"| where count_ > 100"
),
"sigma": (
"title: C2 over Legitimate Service\nstatus: experimental\n"
"logsource:\n product: proxy\n category: proxy\n"
"detection:\n selection:\n c-uri-host|endswith:\n"
" - 'api.github.com'\n - 'slack.com'\n"
" condition: selection\nlevel: low"
),
"yara": (
"rule C2_Legitimate_Service {\n strings:\n"
' $a = "api.github.com" ascii\n $b = "hooks.slack.com" ascii\n'
' $c = "graph.microsoft.com" ascii\n'
" condition:\n any of them\n}"
),
"edr_config": {
"en": "Deploy CASB, configure API usage monitoring, implement behavioral analytics, restrict service access.",
"fr": "D\u00e9ployer un CASB, configurer la surveillance API, impl\u00e9menter l\u2019analytique comportementale.",
},
},
]
# ---------------------------------------------------------------------------
# Categories & helpers
# ---------------------------------------------------------------------------
CATEGORIES = sorted(set(tech["category"] for tech in TECHNIQUES))
def get_technique_names(lang):
return [tech["name"][lang] for tech in TECHNIQUES]
def get_technique_by_name(name, lang):
for tech in TECHNIQUES:
if tech["name"][lang] == name:
return tech
return None
def filter_techniques(category, difficulty, lang):
results = TECHNIQUES
if category and category != t("all", lang):
results = [tech for tech in results if tech["category"] == category]
if difficulty and difficulty != t("all", lang):
diff_map = {v: k for k, v in DIFF_FR.items()}
diff_en = diff_map.get(difficulty, difficulty)
results = [tech for tech in results if tech["difficulty"] == diff_en]
names = [tech["name"][lang] for tech in results]
return names
# ---------------------------------------------------------------------------
# EDR Comparison data
# ---------------------------------------------------------------------------
EDR_SOLUTIONS = [
{"name": "CrowdStrike Falcon", "prevention": 9.5, "detection": 9.5, "response": 9, "threat_hunting": 9.5, "mdr": 9},
{"name": "SentinelOne Singularity", "prevention": 9, "detection": 9, "response": 9.5, "threat_hunting": 8.5, "mdr": 8.5},
{"name": "Microsoft Defender XDR", "prevention": 8.5, "detection": 9, "response": 8.5, "threat_hunting": 9, "mdr": 8},
{"name": "Palo Alto Cortex XDR", "prevention": 9, "detection": 9, "response": 8.5, "threat_hunting": 8.5, "mdr": 8},
{"name": "VMware Carbon Black", "prevention": 8, "detection": 8.5, "response": 8, "threat_hunting": 8.5, "mdr": 7.5},
{"name": "Elastic Security", "prevention": 8, "detection": 8.5, "response": 8, "threat_hunting": 9, "mdr": 7},
{"name": "Cybereason", "prevention": 8.5, "detection": 8.5, "response": 8, "threat_hunting": 8, "mdr": 8.5},
{"name": "Sophos Intercept X", "prevention": 8.5, "detection": 8, "response": 7.5, "threat_hunting": 7.5, "mdr": 8.5},
{"name": "Trellix XDR", "prevention": 8, "detection": 8, "response": 7.5, "threat_hunting": 8, "mdr": 7.5},
{"name": "FortiEDR", "prevention": 8, "detection": 7.5, "response": 8, "threat_hunting": 7, "mdr": 7},
{"name": "ESET PROTECT", "prevention": 8, "detection": 7.5, "response": 7, "threat_hunting": 7, "mdr": 7},
{"name": "Kaspersky EDR", "prevention": 8.5, "detection": 8, "response": 7.5, "threat_hunting": 7.5, "mdr": 7.5},
]
CAPABILITIES = ["prevention", "detection", "response", "threat_hunting", "mdr"]
CAP_LABELS = {
"en": {"prevention": "Prevention", "detection": "Detection", "response": "Response", "threat_hunting": "Threat Hunting", "mdr": "MDR"},
"fr": {"prevention": "Pr\u00e9vention", "detection": "D\u00e9tection", "response": "R\u00e9ponse", "threat_hunting": "Chasse aux menaces", "mdr": "MDR"},
}
def build_radar_chart(selected_edrs, lang):
fig = go.Figure()
labels = [CAP_LABELS[lang][c] for c in CAPABILITIES]
for edr in EDR_SOLUTIONS:
if edr["name"] in selected_edrs:
values = [edr[c] for c in CAPABILITIES]
values.append(values[0]) # close the polygon
fig.add_trace(go.Scatterpolar(
r=values,
theta=labels + [labels[0]],
fill="toself",
name=edr["name"],
))
fig.update_layout(
polar=dict(radialaxis=dict(visible=True, range=[0, 10])),
showlegend=True,
title=t("tab_comparison", lang),
template="plotly_dark",
height=550,
)
return fig
# ---------------------------------------------------------------------------
# Attack Simulation Scenarios
# ---------------------------------------------------------------------------
SCENARIOS = {
"Ransomware Deployment": {
"name": {"en": "Ransomware Deployment", "fr": "D\u00e9ploiement de Ransomware"},
"techniques": ["AMSI Bypass", "NTDLL Unhooking", "Shellcode Injection", "Certutil Download"],
"gaps": {
"en": [
"Memory-only payload execution without disk write",
"Credential harvesting before encryption",
"Volume Shadow Copy deletion detection",
"Lateral movement via SMB/WMI",
],
"fr": [
"Ex\u00e9cution de payload en m\u00e9moire sans \u00e9criture disque",
"R\u00e9colte de credentials avant chiffrement",
"D\u00e9tection de suppression de Volume Shadow Copy",
"Mouvement lat\u00e9ral via SMB/WMI",
],
},
"purple_team": {
"en": [
"1. Initial access via phishing with macro-enabled document",
"2. AMSI bypass to run PowerShell loader",
"3. Unhook ntdll to avoid API monitoring",
"4. Inject shellcode into legitimate process",
"5. Enumerate network shares and domain controllers",
"6. Deploy ransomware binary via PsExec/WMI",
"7. Delete shadow copies and encrypt files",
],
"fr": [
"1. Acc\u00e8s initial via hame\u00e7onnage avec document macro",
"2. Contournement AMSI pour charger PowerShell",
"3. D\u00e9crochage ntdll pour \u00e9viter la surveillance API",
"4. Injection de shellcode dans un processus l\u00e9gitime",
"5. \u00c9num\u00e9ration des partages r\u00e9seau et contr\u00f4leurs de domaine",
"6. D\u00e9ploiement du binaire ransomware via PsExec/WMI",
"7. Suppression des clich\u00e9s instantan\u00e9s et chiffrement",
],
},
"alerts": {
"en": [
"AMSI tampering detected",
"Suspicious process injection (Sysmon ID 8/10)",
"Mass file modification detected",
"Shadow copy deletion (vssadmin/wmic)",
"Lateral movement via PsExec",
],
"fr": [
"Falsification AMSI d\u00e9tect\u00e9e",
"Injection de processus suspecte (Sysmon ID 8/10)",
"Modification massive de fichiers d\u00e9tect\u00e9e",
"Suppression de clich\u00e9s instantan\u00e9s (vssadmin/wmic)",
"Mouvement lat\u00e9ral via PsExec",
],
},
},
"Credential Theft": {
"name": {"en": "Credential Theft", "fr": "Vol de Credentials"},
"techniques": ["AMSI Bypass", "SysWhispers", "PPL Bypass", "Module Stomping"],
"gaps": {
"en": [
"LSASS memory access via direct syscalls",
"Credential dumping from SAM/SECURITY hives",
"Kerberoasting detection",
"DCSync attack detection",
],
"fr": [
"Acc\u00e8s m\u00e9moire LSASS via syscalls directs",
"Extraction de credentials depuis SAM/SECURITY",
"D\u00e9tection de Kerberoasting",
"D\u00e9tection d\u2019attaque DCSync",
],
},
"purple_team": {
"en": [
"1. Bypass AMSI for PowerShell execution",
"2. Use SysWhispers to call NtOpenProcess on LSASS",
"3. Bypass PPL protection on LSASS if enabled",
"4. Dump credentials from LSASS memory",
"5. Extract hashes from SAM database",
"6. Perform Kerberoasting for service accounts",
],
"fr": [
"1. Contourner AMSI pour PowerShell",
"2. Utiliser SysWhispers pour NtOpenProcess sur LSASS",
"3. Contourner la protection PPL de LSASS si activ\u00e9e",
"4. Extraire les credentials de la m\u00e9moire LSASS",
"5. Extraire les hachages de la base SAM",
"6. R\u00e9aliser du Kerberoasting pour les comptes de service",
],
},
"alerts": {
"en": [
"LSASS access from non-system process",
"Suspicious Kerberos ticket requests",
"SAM database access detected",
"Direct syscall from non-ntdll region",
],
"fr": [
"Acc\u00e8s LSASS depuis un processus non syst\u00e8me",
"Requ\u00eates Kerberos suspectes",
"Acc\u00e8s \u00e0 la base SAM d\u00e9tect\u00e9",
"Syscall direct depuis une r\u00e9gion non ntdll",
],
},
},
"Lateral Movement": {
"name": {"en": "Lateral Movement", "fr": "Mouvement Lat\u00e9ral"},
"techniques": ["NTDLL Unhooking", "Shellcode Injection", "BITSAdmin Transfer", "ETW Patching"],
"gaps": {
"en": [
"WMI-based lateral movement",
"SMB relay attacks",
"Pass-the-Hash/Ticket detection",
"DCOM-based execution",
],
"fr": [
"Mouvement lat\u00e9ral via WMI",
"Attaques de relais SMB",
"D\u00e9tection Pass-the-Hash/Ticket",
"Ex\u00e9cution via DCOM",
],
},
"purple_team": {
"en": [
"1. Patch ETW to blind telemetry",
"2. Unhook ntdll to bypass API monitoring",
"3. Use stolen credentials for WMI execution",
"4. Deploy payload via BITS transfer",
"5. Inject into remote process for persistence",
"6. Repeat across multiple hosts",
],
"fr": [
"1. Modifier ETW pour aveugler la t\u00e9l\u00e9m\u00e9trie",
"2. D\u00e9crocher ntdll pour contourner la surveillance API",
"3. Utiliser des credentials vol\u00e9s pour WMI",
"4. D\u00e9ployer le payload via transfert BITS",
"5. Injecter dans un processus distant pour la persistance",
"6. R\u00e9p\u00e9ter sur plusieurs h\u00f4tes",
],
},
"alerts": {
"en": [
"WMI remote execution detected",
"Unusual SMB authentication patterns",
"BITS job creation from command line",
"ETW provider modification",
],
"fr": [
"Ex\u00e9cution WMI distante d\u00e9tect\u00e9e",
"Sch\u00e9mas d\u2019authentification SMB inhabituels",
"Cr\u00e9ation de t\u00e2che BITS depuis la ligne de commande",
"Modification du fournisseur ETW",
],
},
},
"Data Exfiltration": {
"name": {"en": "Data Exfiltration", "fr": "Exfiltration de Donn\u00e9es"},
"techniques": ["DNS Tunneling", "Domain Fronting", "C2 over Legitimate Services", "BITSAdmin Transfer"],
"gaps": {
"en": [
"DNS tunneling with low-and-slow exfiltration",
"Data staging in cloud services",
"Encrypted channel detection",
"Steganography-based exfiltration",
],
"fr": [
"Tunnel DNS avec exfiltration lente",
"Stockage temporaire dans les services cloud",
"D\u00e9tection de canaux chiffr\u00e9s",
"Exfiltration par st\u00e9ganographie",
],
},
"purple_team": {
"en": [
"1. Stage data in temp directory",
"2. Compress and encrypt data",
"3. Exfiltrate via DNS tunneling (small payloads)",
"4. Use domain fronting for larger transfers",
"5. Leverage legitimate cloud storage APIs",
"6. Clean up staging artifacts",
],
"fr": [
"1. Stocker les donn\u00e9es dans un r\u00e9pertoire temporaire",
"2. Compresser et chiffrer les donn\u00e9es",
"3. Exfiltrer via tunnel DNS (petits payloads)",
"4. Utiliser le domain fronting pour les gros transferts",
"5. Exploiter les API de stockage cloud l\u00e9gitimes",
"6. Nettoyer les artefacts temporaires",
],
},
"alerts": {
"en": [
"High DNS query volume to single domain",
"Large data transfer to cloud storage",
"TLS SNI/Host header mismatch",
"Unusual data compression activity",
],
"fr": [
"Volume \u00e9lev\u00e9 de requ\u00eates DNS vers un seul domaine",
"Transfert de donn\u00e9es volumineux vers le stockage cloud",
"Incoh\u00e9rence SNI/Host TLS",
"Activit\u00e9 de compression de donn\u00e9es inhabituelle",
],
},
},
"Persistence Establishment": {
"name": {"en": "Persistence Establishment", "fr": "\u00c9tablissement de Persistance"},
"techniques": ["MSBuild Execution", "CMSTP Bypass", "Regsvr32 (Squiblydoo)", "Module Stomping"],
"gaps": {
"en": [
"Registry-based persistence detection",
"Scheduled task abuse",
"WMI event subscription persistence",
"DLL search order hijacking",
],
"fr": [
"D\u00e9tection de persistance par registre",
"Abus de t\u00e2ches planifi\u00e9es",
"Persistance par abonnement d\u2019\u00e9v\u00e9nements WMI",
"D\u00e9tournement de l\u2019ordre de recherche DLL",
],
},
"purple_team": {
"en": [
"1. Use MSBuild to compile and execute initial payload",
"2. Establish WMI event subscription for persistence",
"3. Create scheduled task with obfuscated command",
"4. Use CMSTP for UAC bypass if needed",
"5. Stomp legitimate module for stealth",
"6. Verify persistence across reboots",
],
"fr": [
"1. Utiliser MSBuild pour compiler et ex\u00e9cuter le payload initial",
"2. \u00c9tablir un abonnement WMI pour la persistance",
"3. Cr\u00e9er une t\u00e2che planifi\u00e9e avec commande obscurcie",
"4. Utiliser CMSTP pour contourner l\u2019UAC si n\u00e9cessaire",
"5. \u00c9craser un module l\u00e9gitime pour la furtivit\u00e9",
"6. V\u00e9rifier la persistance apr\u00e8s red\u00e9marrage",
],
},
"alerts": {
"en": [
"MSBuild execution outside development context",
"WMI event subscription creation",
"Suspicious scheduled task registration",
"CMSTP execution with INF file",
],
"fr": [
"Ex\u00e9cution MSBuild hors contexte de d\u00e9veloppement",
"Cr\u00e9ation d\u2019abonnement WMI",
"Enregistrement de t\u00e2che planifi\u00e9e suspecte",
"Ex\u00e9cution CMSTP avec fichier INF",
],
},
},
}
SCENARIO_KEYS = list(SCENARIOS.keys())
# ---------------------------------------------------------------------------
# UI builder functions
# ---------------------------------------------------------------------------
def build_technique_detail(name, lang):
"""Return formatted markdown for a technique."""
tech = get_technique_by_name(name, lang)
if not tech:
return "Select a technique."
badge = diff_badge(tech["difficulty"], lang)
desc = tech["desc"][lang]
mitre = tech["mitre"]
pseudo = tech["pseudocode"]
detect = tech["detection"][lang]
counter = tech["countermeasure"][lang]
cat = tech["category"]
desc_label = t("description", lang)
mitre_label = t("mitre", lang)
pseudo_label = t("pseudocode", lang)
detect_label = t("detection", lang)
counter_label = t("countermeasure", lang)
cat_label = t("category", lang)
md = f"## {tech['name'][lang]} {badge}\n\n"
md += f"**{cat_label}:** {cat}\n\n"
md += f"**{mitre_label}:** `{mitre}`\n\n"
md += f"### {desc_label}\n{desc}\n\n"
md += f"### {pseudo_label}\n```\n{pseudo}\n```\n\n"
md += f"### {detect_label}\n{detect}\n\n"
md += f"### {counter_label}\n{counter}\n"
return md
def build_detection_detail(name, lang):
"""Return formatted markdown for detection engineering."""
tech = get_technique_by_name(name, lang)
if not tech:
return "Select a technique."
sysmon_label = t("sysmon_ids", lang)
kql_label = t("kql_query", lang)
sigma_label = t("sigma_rule", lang)
yara_label = t("yara_rule", lang)
edr_label = t("edr_config", lang)
md = f"## {tech['name'][lang]} - {t('tab_detection', lang)}\n\n"
md += f"### {sysmon_label}\n`{tech['sysmon']}`\n\n"
md += f"### {kql_label}\n```kql\n{tech['kql']}\n```\n\n"
md += f"### {sigma_label}\n```yaml\n{tech['sigma']}\n```\n\n"
md += f"### {yara_label}\n```yara\n{tech['yara']}\n```\n\n"
md += f"### {edr_label}\n{tech['edr_config'][lang]}\n"
return md
def build_scenario_detail(scenario_key, lang):
"""Return formatted markdown for an attack scenario."""
sc = SCENARIOS.get(scenario_key)
if not sc:
return "Select a scenario."
name = sc["name"][lang]
techniques_str = ", ".join(sc["techniques"])
gaps = "\n".join(f"- {g}" for g in sc["gaps"][lang])
steps = "\n".join(sc["purple_team"][lang])
alerts = "\n".join(f"- {a}" for a in sc["alerts"][lang])
ev_label = t("evasion_needed", lang)
gap_label = t("detection_gaps", lang)
pt_label = t("purple_team", lang)
alert_label = t("expected_alerts", lang)
md = f"## {name}\n\n"
md += f"### {ev_label}\n{techniques_str}\n\n"
md += f"### {gap_label}\n{gaps}\n\n"
md += f"### {pt_label}\n{steps}\n\n"
md += f"### {alert_label}\n{alerts}\n"
return md
def build_resources_md(lang):
if lang == "fr":
return """## Ressources
### Articles AYI-NEDJIMI Consultants
- [Guide complet : \u00c9vasion EDR/XDR](https://ayinedjimi-consultants.fr/articles/techniques-hacking/evasion-edr-xdr.html)
Analyse approfondie des techniques d\u2019\u00e9vasion et des contre-mesures.
- [Top 10 Solutions EDR/XDR 2025](https://ayinedjimi-consultants.fr/articles/top-10-solutions-edr-xdr-2025.html)
Comparatif d\u00e9taill\u00e9 des meilleures solutions de protection endpoint.
- [Site principal AYI-NEDJIMI Consultants](https://ayinedjimi-consultants.fr)
Cabinet de conseil en cybers\u00e9curit\u00e9 sp\u00e9cialis\u00e9 en tests d\u2019intrusion et Red Team.
### R\u00e9f\u00e9rences externes
- [MITRE ATT&CK Framework](https://attack.mitre.org/) - Base de connaissances des tactiques et techniques adverses
- [Sigma Rules Repository](https://github.com/SigmaHQ/sigma) - R\u00e8gles de d\u00e9tection g\u00e9n\u00e9riques
- [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) - Tests atomiques pour chaque technique ATT&CK
- [LOLBAS Project](https://lolbas-project.github.io/) - Binaires Living off the Land
- [Elastic Detection Rules](https://github.com/elastic/detection-rules) - R\u00e8gles de d\u00e9tection Elastic
- [KQL Reference](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/) - Documentation KQL Microsoft
### Avertissement
Ce contenu est strictement \u00e9ducatif. Toute utilisation de ces techniques sans autorisation explicite est ill\u00e9gale.
Consultez toujours le cadre l\u00e9gal applicable avant tout test de s\u00e9curit\u00e9.
"""
else:
return """## Resources
### AYI-NEDJIMI Consultants Articles
- [Complete Guide: EDR/XDR Evasion](https://ayinedjimi-consultants.fr/articles/techniques-hacking/evasion-edr-xdr.html)
In-depth analysis of evasion techniques and countermeasures.
- [Top 10 EDR/XDR Solutions 2025](https://ayinedjimi-consultants.fr/articles/top-10-solutions-edr-xdr-2025.html)
Detailed comparison of the best endpoint protection solutions.
- [AYI-NEDJIMI Consultants Main Site](https://ayinedjimi-consultants.fr)
Cybersecurity consulting firm specializing in penetration testing and Red Team operations.
### External References
- [MITRE ATT&CK Framework](https://attack.mitre.org/) - Knowledge base of adversary tactics and techniques
- [Sigma Rules Repository](https://github.com/SigmaHQ/sigma) - Generic detection rules
- [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) - Atomic tests for each ATT&CK technique
- [LOLBAS Project](https://lolbas-project.github.io/) - Living off the Land Binaries
- [Elastic Detection Rules](https://github.com/elastic/detection-rules) - Elastic detection rules
- [KQL Reference](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/) - Microsoft KQL documentation
### Disclaimer
This content is strictly educational. Any use of these techniques without explicit authorization is illegal.
Always consult the applicable legal framework before any security testing.
"""
# ---------------------------------------------------------------------------
# Gradio application
# ---------------------------------------------------------------------------
FOOTER_HTML = """
"""
CSS = """
.gradio-container { max-width: 1200px !important; }
.disclaimer-box {
background: linear-gradient(135deg, #1a1a2e, #16213e);
border: 1px solid #e74c3c;
border-radius: 10px;
padding: 15px;
margin: 10px 0;
text-align: center;
color: #f0f0f0;
}
"""
def create_app():
with gr.Blocks(css=CSS, title="EDR Evasion Explorer", theme=gr.themes.Base()) as app:
lang_state = gr.State("en")
# Header
gr.HTML(
''
"EDR/XDR Evasion Technique Explorer
"
)
gr.HTML(
''
"This content is strictly educational and intended for cybersecurity "
"professionals to improve defenses. | "
"Ce contenu est strictement \u00e9ducatif et destin\u00e9 aux professionnels "
"de la cybers\u00e9curit\u00e9."
"
"
)
with gr.Row():
lang_toggle = gr.Radio(
choices=["EN", "FR"],
value="EN",
label="Language / Langue",
)
# ---------------------------------------------------------------
# Tab 1: Technique Browser
# ---------------------------------------------------------------
with gr.Tab("Technique Browser"):
with gr.Row():
cat_filter = gr.Dropdown(
choices=["All"] + CATEGORIES,
value="All",
label="Category",
)
diff_filter = gr.Dropdown(
choices=["All", "Easy", "Medium", "Hard", "Expert"],
value="All",
label="Difficulty",
)
technique_list = gr.Dropdown(
choices=get_technique_names("en"),
label="Select a technique",
)
technique_detail = gr.Markdown("")
def on_filter_change(cat, diff, lang):
lang_code = "fr" if lang == "FR" else "en"
all_label = t("all", lang_code)
if cat == "All" or cat == "Toutes":
cat = all_label
if diff == "All" or diff == "Toutes":
diff = all_label
names = filter_techniques(cat, diff, lang_code)
first_label = t("select_technique", lang_code)
return gr.Dropdown(choices=names, label=first_label, value=None)
cat_filter.change(
on_filter_change,
inputs=[cat_filter, diff_filter, lang_toggle],
outputs=[technique_list],
)
diff_filter.change(
on_filter_change,
inputs=[cat_filter, diff_filter, lang_toggle],
outputs=[technique_list],
)
def on_technique_select(name, lang):
lang_code = "fr" if lang == "FR" else "en"
if not name:
return ""
return build_technique_detail(name, lang_code)
technique_list.change(
on_technique_select,
inputs=[technique_list, lang_toggle],
outputs=[technique_detail],
)
# ---------------------------------------------------------------
# Tab 2: Detection Engineering
# ---------------------------------------------------------------
with gr.Tab("Detection Engineering"):
detect_technique_list = gr.Dropdown(
choices=get_technique_names("en"),
label="Select a technique for detection rules",
)
detection_detail = gr.Markdown("")
def on_detect_select(name, lang):
lang_code = "fr" if lang == "FR" else "en"
if not name:
return ""
return build_detection_detail(name, lang_code)
detect_technique_list.change(
on_detect_select,
inputs=[detect_technique_list, lang_toggle],
outputs=[detection_detail],
)
# ---------------------------------------------------------------
# Tab 3: EDR Comparison
# ---------------------------------------------------------------
with gr.Tab("EDR Comparison"):
edr_names = [e["name"] for e in EDR_SOLUTIONS]
edr_selector = gr.CheckboxGroup(
choices=edr_names,
value=edr_names[:4],
label="Select EDR/XDR Solutions to Compare",
)
radar_plot = gr.Plot(label="EDR Capabilities Radar")
edr_table = gr.Dataframe(
headers=["Solution", "Prevention", "Detection", "Response", "Threat Hunting", "MDR"],
value=[[e["name"], e["prevention"], e["detection"], e["response"], e["threat_hunting"], e["mdr"]] for e in EDR_SOLUTIONS],
label="EDR/XDR Comparison Table",
)
def on_edr_change(selected, lang):
lang_code = "fr" if lang == "FR" else "en"
if not selected:
selected = edr_names[:4]
return build_radar_chart(selected, lang_code)
edr_selector.change(
on_edr_change,
inputs=[edr_selector, lang_toggle],
outputs=[radar_plot],
)
# Initial chart
app.load(
on_edr_change,
inputs=[edr_selector, lang_toggle],
outputs=[radar_plot],
)
# ---------------------------------------------------------------
# Tab 4: Attack Simulation Planner
# ---------------------------------------------------------------
with gr.Tab("Attack Simulation Planner"):
scenario_selector = gr.Dropdown(
choices=SCENARIO_KEYS,
label="Select an attack scenario",
)
scenario_detail = gr.Markdown("")
def on_scenario_select(scenario, lang):
lang_code = "fr" if lang == "FR" else "en"
if not scenario:
return ""
return build_scenario_detail(scenario, lang_code)
scenario_selector.change(
on_scenario_select,
inputs=[scenario_selector, lang_toggle],
outputs=[scenario_detail],
)
# ---------------------------------------------------------------
# Tab 5: Resources
# ---------------------------------------------------------------
with gr.Tab("Resources"):
resources_md = gr.Markdown(build_resources_md("en"))
# ---------------------------------------------------------------
# Language toggle handler
# ---------------------------------------------------------------
def on_lang_change(lang_choice):
lang_code = "fr" if lang_choice == "FR" else "en"
all_label = t("all", lang_code)
names = get_technique_names(lang_code)
cat_choices = [all_label] + CATEGORIES
diff_choices_list = [all_label] + [diff_label(d, lang_code) for d in ["Easy", "Medium", "Hard", "Expert"]]
cat_lbl = t("category", lang_code)
diff_lbl = t("difficulty", lang_code)
sel_lbl = t("select_technique", lang_code)
scn_lbl = t("select_scenario", lang_code)
scenario_choices = [SCENARIOS[k]["name"][lang_code] for k in SCENARIO_KEYS]
return [
lang_choice,
gr.Dropdown(choices=cat_choices, value=all_label, label=cat_lbl),
gr.Dropdown(choices=diff_choices_list, value=all_label, label=diff_lbl),
gr.Dropdown(choices=names, label=sel_lbl, value=None),
"",
gr.Dropdown(choices=names, label=sel_lbl, value=None),
"",
gr.Dropdown(choices=SCENARIO_KEYS, label=scn_lbl, value=None),
"",
build_resources_md(lang_code),
]
lang_toggle.change(
on_lang_change,
inputs=[lang_toggle],
outputs=[
lang_state,
cat_filter,
diff_filter,
technique_list,
technique_detail,
detect_technique_list,
detection_detail,
scenario_selector,
scenario_detail,
resources_md,
],
)
# Footer
gr.HTML(FOOTER_HTML)
return app
if __name__ == "__main__":
demo = create_app()
demo.launch()