eth‑red‑blue - Mobile Ransomware Red/Blue Lab

Elevator pitch
A complete, reproducible red/blue lab that simulates a mobile ransomware campaign against a physical Google Pixel 6a on an isolated Wi‑Fi AP.
The Red Team delivers and sideloads a lab APK (“LockerSim”) that encrypts a scoped photo folder and sends benign JSON beacons.
The Blue Team ingests Suricata EVE and ADB logcat --> Wazuh, engineers detections (D1/N1/W1–W5), and correlates boot --> first beacon in Elastic Security.
Everything you need to re‑run the exercise end‑to‑end, code, rules, KQL/EQL, and helper scripts, is in this repo.

Introduction

This lab demonstrates a realistic mobile ransomware chain-delivery, sideload/exploitation, installation/persistence, C2, and actions‑on‑objective-against the author’s own Pixel 6a on a dedicated lab SSID. The Blue Team side implements network and handset telemetry, custom detections, and a time‑bound correlation linking BOOT_COMPLETED --> first beacon. All detections are designed to be auditable (JSON/PCAP/Kibana exports) and are scoped to keep the exercise ethical and safe (no exfiltration; file encryption limited to an app‑private directory or a user‑granted tree).

High‑level architecture

flowchart TD
  subgraph Host["Ubuntu 22.04 Host"]
    direction TB
    Suricata["Docker Suricata (IDS)"]
    ELK["Docker ELK stack (ES + Kibana)"]
    Wazuh["Docker Wazuh-manager (SIEM)"]
    Agent["Wazuh Agent (on host)"]
    Logger["ADB logcat --> syslog forwarder (script)"]
  end

  subgraph Phone["Google Pixel 6a (Android 14/16 SDK)"]
    direction TB
    App["LockerSim.apk<br/>- AES-GCM file ops (sandbox/DCIM)<br/>- WorkManager beacons<br/>- BOOT_COMPLETED receiver"]
  end

  Host ---|"isolated lab SSID (hosted by USB Wi‑Fi AP)"| Phone
  Logger --> Agent --> Wazuh
  Suricata --> ELK

Environment & setup

Host prerequisites

Ubuntu 22.04 LTS (or similar Linux host).
Docker + Docker Compose.
ADB / Android Platform Tools on the host.
Python 3.10+ (for tiny utility scripts).
A dual‑band USB Wi‑Fi adapter (hosted AP) - lab SSID without Internet.
The phone (Pixel 6a) connects to the AP; the host is also on the AP and additionally on Ethernet for admin.

Clone & compose

git clone https://github.com/ryanfoxgithub/eth-red-blue.git
cd eth-red-blue

# Bring up the stack (Suricata, Elastic, Wazuh, etc.)
docker compose up -d

# (Optional) verify ingest wiring with the helper
./scripts/vis_ing.sh

Key configs you may want to glance at:

config/suricata/suricata.yaml (EVE types enabled, HOME_NET set to your lab subnet)
config/filebeat/filebeat.yml (ships EVE to Elasticsearch)
config/wazuh/manager/local_rules.xml (custom W rules used below)

Suricata tuning

Drop your local signatures here and include them from suricata.yaml:

config/suricata/rules/local.rules

Two rules are used in this project:

# N1 - Locker beacon (POST + UA + path)
alert http $HOME_NET any -> $HOME_NET any (
  msg:"LockerSim HTTP beacon (UA+path)";
  flow:to_server,established;
  http.method;     content:"POST"; nocase;
  http.uri;        content:"/beacon";
  http.user_agent; content:"Locker-Beacon/1.0"; nocase;
  classtype:trojan-activity;
  sid:420001; rev:7;
)

# D1 - APK download to handset (delivery)
alert http $HOME_NET any -> $HOME_NET 8000 (
  msg:"APK download to handset (lab host)";
  flow:to_server,established;
  http.method; content:"GET"; nocase;
  http.uri;    content:"/app-debug.apk"; nocase;
  classtype:policy-violation;
  sid:420010; rev:3;
)

Reload Suricata (or restart the container) after editing local.rules.

Wazuh ingest (ADB logcat --> syslog)

The host streams filtered adb logcat into /var/log/syslog with a stable program name (pixel6a). The Wazuh agent (on the host) tails syslog by default.

# On the host (with the phone connected over USB or wireless ADB):
./scripts/logcat_to_syslog.sh

Custom Wazuh rules are already under:

config/wazuh/manager/local_rules.xml

They cover:

W1/W2 – Sideload/install (PackageInstaller/PackageManager lines)
W3 – Persistence (BootReceiver BOOT_COMPLETED)
W4 – Beacon worker executed (WorkManager / Beacon logs)
W5 – Actions on Objective (Encrypt/Decrypt messages)

Restart Wazuh manager after updates:

docker compose exec wazuh-manager /var/ossec/bin/wazuh-control restart

Android app (LockerSim)

The app code lives under:

apps/locker-sim-android/

Key files to review:

AndroidManifest.xml (INTERNET, RECEIVE_BOOT_COMPLETED, cleartext allowed for lab)
beacon/BeaconWorker.kt (POST /beacon, UA Locker-Beacon/1.0 (SIMULATION))
boot/BootReceiver.kt (schedules a oneshot beacon on boot)
crypto/Crypto.kt (AES‑GCM using AndroidKeyStore)
data/FileRepo.kt (seed/list/encrypt/decrypt in app‑private dir)
ransom/RansomNoteActivity.kt (offline note for a screenshot)
MainActivity.kt + activity_main.xml (explicit lab UI)

Build the debug APK from Android Studio or via Gradle; the path typically ends up at:

apps/locker-sim-android/app/build/outputs/apk/debug/app-debug.apk

Lab HTTP service for delivery / beacons

For delivery (D1) and beacon (N1) testing you need an HTTP listener on the lab host:

Easiest path (delivery only): python3 -m http.server 8000 from the folder that contains app-debug.apk (serves /app-debug.apk).
If you also want to record beacons, run a tiny handler (e.g., any lightweight Flask/Node/go‑http) that accepts POST /beacon. Note: Suricata will still alert on the POST/UA even if /beacon returns 404.

Update MainActivity.kt / BeaconWorker to point to your lab host (e.g., http://10.42.0.1:8000/beacon).

Detection engineering

Suricata rules (network)

See the two rules above (N1, D1). Confirm they load (no errors) and then trigger them with:

# D1 - generate a GET for the APK
curl -s -o /dev/null http://10.42.0.1:8000/app-debug.apk

# N1 - generate a beacon POST (host side)
curl -s -X POST http://10.42.0.1:8000/beacon \
  -H 'User-Agent: Locker-Beacon/1.0 (SIMULATION)' \
  -H 'Content-Type: application/json' \
  -d '{"lab":true,"ts":"'"$(date -Iseconds)"'"}' >/dev/null

Evidence extraction (host side):

# Prefer host bind if present
EVE=./suricata/log/eve.json
[ -r "$EVE" ] || EVE=/var/log/suricata/eve.json  # fallback (inside container)

# D1
jq -c 'select(.event_type=="alert" and .alert.signature_id==420010)
  | {ts:.timestamp,src:.src_ip,dst:.dest_ip,method:.http.http_method,uri:.http.url,sid:.alert.signature_id,sig:.alert.signature}' \
  "$EVE" | tail -n 3 | tee -a evidence/3.2/delivery/d1_alert.json

# N1
jq -c 'select(.event_type=="alert" and .alert.signature_id==420001)
  | {ts:.timestamp,src:.src_ip,dst:.dest_ip,method:.http.http_method,uri:.http.url,ua:.http.http_user_agent,sid:.alert.signature_id,sig:.alert.signature}' \
  "$EVE" | tail -n 3 | tee -a evidence/3.2/c2/n1_alert.json

If your Suricata container doesn’t have jq, run jq on the host against the bind‑mounted EVE file.

Kibana KQL hunts (saved searches)

H1 – Delivery (APK):

event.module : "suricata" and (
  suricata.eve.http.url : "/app-debug.apk" or
  url.path : "/app-debug.apk" or
  url.original : "*app-debug.apk"
) and ( destination.ip : 10.42.0.1 or host.hostname : "10.42.0.1" )

H3 – Beacon (UA contains):

event.module : "suricata" and user_agent.original : "*Locker-Beacon/1.0*"

Exports live under:

evidence/3.2/delivery/H1.ndjson
evidence/3.2/c2/H3.ndjson

Wazuh rules (handset logs)

config/wazuh/manager/local_rules.xml defines IDs in the 9101xx range:

<!-- W1/W2: Sideload/Install observed -->
<rule id="910110" level="8">
  <if_program_name>pixel6a</if_program_name>
  <match>Package(Installer|Manager).*(install|installed|install succeeded|Added package)</match>
  <description>Android package install observed (possible sideload) - LockerSim chain</description>
  <mitre><id>T1476</id><id>T1404</id></mitre>
</rule>

<!-- W3: BOOT_COMPLETED receiver fired -->
<rule id="910120" level="7">
  <if_program_name>pixel6a</if_program_name>
  <match>BootReceiver.*BOOT_COMPLETED</match>
  <description>Android BOOT_COMPLETED handled by app (persistence)</description>
  <mitre><id>T1624.001</id></mitre>
</rule>

<!-- W4: WorkManager/Beacon run -->
<rule id="910130" level="8">
  <if_program_name>pixel6a</if_program_name>
  <match>BeaconWorker.*(POST|Beacon|200)|WorkManager.*Starting work.*BeaconWorker</match>
  <description>Beacon worker executed</description>
  <mitre><id>T1603</id><id>T1437.001</id></mitre>
</rule>

<!-- W5: Encryption/Decryption activity -->
<rule id="910140" level="10">
  <if_program_name>pixel6a</if_program_name>
  <match>(LockerSim|FileRepo).*(ENCRYPT|DECRYPT|Encrypt|Decrypt|encrypted|decrypted)</match>
  <description>LockerSim AoO activity (encrypt/decrypt)</description>
  <mitre><id>T1471</id><id>T1486</id></mitre>
</rule>

Evidence extraction (manager container):

# Last N alerts for a rule id
wazuh_last_by_id() {
  local rule_id="$1" ; local n="${2:-20}"
  docker compose exec -T wazuh-manager sh -lc \
    "grep -F '\"id\":\"$rule_id\"' /var/ossec/logs/alerts/alerts.json | tail -n $n"
}

mkdir -p evidence/3.2/{sideload,persistence,c2,aoo}

# W1/W2
wazuh_last_by_id 910110 20 | tee -a evidence/3.2/sideload/w1w2_alerts.json

# W3
wazuh_last_by_id 910120 10 | tee -a evidence/3.2/persistence/w3_boot.json

# W4
wazuh_last_by_id 910130 10 | tee -a evidence/3.2/c2/w4_alerts.json

# W5
wazuh_last_by_id 910140 20 | tee -a evidence/3.2/aoo/w5_alerts.json

Elastic Security correlation (EQL)

Saved export: evidence/3.2/correlation/C1.ndjson

sequence with maxspan=10m
  [ any where event.module == "wazuh" and event.original : "*BootReceiver*BOOT_COMPLETED*" ]
  [ any where event.module == "suricata" and user_agent.original : "*Locker-Beacon/1.0*" ]

Run the full validation flow

Baseline ingest – confirm Filebeat --> ES is live (./scripts/vis_ing.sh shows counts, or check Kibana Discover).
Delivery – browse http://10.42.0.1:8000/app-debug.apk from the phone --> expect D1 alert + H1 hits.
Sideload – install the APK (repeat your filmed flow) --> expect W1/W2 alerts.
C2 – press “Send Beacons (x5 @ 60s)” in the app --> expect N1 alert + H3 hits and W4 on the handset logs.
Persistence – reboot the phone --> expect W3, then the EQL sequence (C1) when the first beacon lands.
AoO – run ENCRYPT then DECRYPT in the app UI --> expect W5 (impact & recovery evidence).

Evidence pack layout

This repo already includes representative exports/receipts (add your fresh run beside them):

evidence/
└── 3.2
    ├── delivery/    # d1_alert.json , H1.ndjson
    ├── c2/          # n1_alert.json , w4_alerts.json , H3.ndjson , pcap/
    ├── sideload/    # w1w2_alerts.json
    ├── persistence/ # w3_boot.json
    ├── aoo/         # w5_alerts.json
    └── correlation/ # C1.ndjson

Host ingest receipts (counts/docs/sample EVE) are stored under config/evidence/ingest-*/ and are handy for screenshots in the report.

Repo structure (excerpt)

Generated from the project’s tree.txt (top‑level only; see repo for the full view).

.
├── config
│   ├── evidence/ingest-*/{compose_ps.txt,es_count.json,es_docs.json,eve_sample.json}
│   ├── filebeat/filebeat.yml
│   ├── suricata/suricata.yaml
│   └── wazuh/manager/local_rules.xml
├── docker-compose.yml
├── evidence/3.2/{delivery,c2,aoo,correlation,persistence,sideload}/...
├── scripts/{logcat_to_syslog.sh,vis_ing.sh}
└── kibana/exports (optional)

Tools list

Red team

Android Studio / Gradle – build the LockerSim app (Kotlin).
OkHttp, WorkManager, Coroutines – networking & reliable background work.
Android Keystore + AES‑GCM – file encryption in a scoped directory.
Python 3 – simple HTTP service for APK hosting (and optional /beacon capture).
adb / platform‑tools – install, logcat, dumpsys evidence.

Blue team

Suricata – IDS with custom HTTP rules (EVE JSON).
Filebeat/Elastic/Kibana – ship and analyse network telemetry (KQL/EQL).
Wazuh (manager + agent) – parse handset logs from syslog with local rules.
jq – extract alert slices from EVE.
tcpdump/Wireshark – optional PCAP for beacon verification.

Safety & ethics

My device only, on an isolated SSID with no Internet egress.
Encryption is limited to an app‑private folder (or a user‑granted tree via SAF) and is reversible in‑app.
APK requests only INTERNET and RECEIVE_BOOT_COMPLETED.
After demos: uninstall the APK, stop lab services, and archive only benign evidence (logs/exports).

Acknowledgements

MITRE ATT&CK for Mobile (technique mapping).
Open‑source ecosystems behind Suricata, Elastic Stack, and Wazuh.
Android Open Source Project & Jetpack libraries used by LockerSim.

Name		Name	Last commit message	Last commit date
Latest commit History 67 Commits
apps/locker-sim-android		apps/locker-sim-android
blue-pipeline		blue-pipeline
docs		docs
evidence		evidence
infra		infra
rules		rules
runbooks		runbooks
scripts		scripts
suricata/log		suricata/log
.gitattributes		.gitattributes
README.md		README.md
tree.txt		tree.txt

Navigation Menu

Repository files navigation

eth‑red‑blue - Mobile Ransomware Red/Blue Lab

Contents

Introduction

High‑level architecture

Environment & setup

Host prerequisites

Clone & compose

Suricata tuning

Wazuh ingest (ADB logcat --> syslog)

Android app (LockerSim)

Lab HTTP service for delivery / beacons

Detection engineering

Suricata rules (network)

Kibana KQL hunts (saved searches)

Wazuh rules (handset logs)

Elastic Security correlation (EQL)

Run the full validation flow

Evidence pack layout

Repo structure (excerpt)

Tools list

Red team

Blue team

Safety & ethics

Acknowledgements

About

Releases

Packages

Contributors

Languages

Folders and files

Latest commit

History

Repository files navigation

eth‑red‑blue - Mobile Ransomware Red/Blue Lab

Contents

Introduction

High‑level architecture

Environment & setup

Host prerequisites

Clone & compose

Suricata tuning

Wazuh ingest (ADB logcat --> syslog)

Android app (LockerSim)

Lab HTTP service for delivery / beacons

Detection engineering

Suricata rules (network)

Kibana KQL hunts (saved searches)

Wazuh rules (handset logs)

Elastic Security correlation (EQL)

Run the full validation flow

Evidence pack layout

Repo structure (excerpt)

Tools list

Red team

Blue team

Safety & ethics

Acknowledgements

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages