GHOSTS NPC Framework

GHOSTS simulates user activity on a computer, like creating documents, browsing websites, and downloading files. It drives various popular applications on both Windows and Linux machines. Whether you’re a friendly administrator or a cyber adversary, GHOSTS can replicate your expected behavior.

GHOSTS has many use cases in cyber experimentation, training and exercise, most notably for bringing non-player characters (NPCs) to life. However, it can also be used for other purposes requiring realistic activity on a computer.

https://github.com/cmu-sei/GHOSTS

🔹 1. Detonate

• By: Elastic Security
• What it does: Generates synthetic endpoint activity (browsing, file ops, process creation) for telemetry validation.
• Similarities: Focuses on simulating benign user behavior to test detection.
• GitHub: https://github.com/elastic/detonate

---

🔹 2. OpenNPC (Unofficial)

• Unofficial recreations or forks of GHOSTS-like functionality.
• Try GitHub search for: "npc user simulation" or "synthetic user desktop automation"
• Caveat: Many are proof-of-concepts or outdated.

---

🔹 3. AtomicSim / SysmonSimulator / Eventgen tools

• These tools create realistic logs without full desktop interaction:
  • SysmonSimulator
  • Eventgen
• Difference: Focus on log simulation, not live user desktop behavior.

---

🔹 4. AIWorker / UserSim Bots (custom)

• Custom Python bots using:
  • pyautogui for GUI interactions
  • selenium for browser automation
  • Task scheduler + randomizer to mimic GHOSTS’ timeline behavior
• No official project, but can be scripted to simulate:
  • Browser visits
  • Document editing
  • Email activity
  • App launching

---

🔹 5. FLARE VM + AutoIt Scripts

• Use FLARE VM on a Windows box with AutoIt or PowerShell scripts to simulate user behavior (e.g., open documents, run CLI commands, visit sites).
• Not as robust or managed as GHOSTS, but customizable.

---

🧠 If You Need GHOSTS-Like Capabilities But Want More Control:

You could also roll your own using:

• Python + pyautogui for keyboard/mouse events
• Selenium for browsing
• Task scheduler (.json) to randomize actions per “NPC”

This is essentially how GHOSTS works under the hood.

1. Caldera (MITRE)

• Type: Automated Red Team Framework
• Use: Adversary emulation via agents and plugins.
• Similarities: Simulates post-compromise behavior, can mimic NPC-like behavior in a cyber environment.
• URL: https://github.com/mitre/caldera

---

🔹 2. Sysmon Simulator

• Type: User Behavior Simulation
• Use: Generates realistic Windows event logs (Sysmon) to test SIEM rules.
• Similarities: Emulates user and malware activity like logins, file accesses, process launches.

---

🔹 3. Invoke-AtomicRedTeam / Atomic Red Team

• Type: Red Team Testing Framework
• Use: Runs atomic tests for known TTPs across the MITRE ATT&CK matrix.
• URL: https://github.com/redcanaryco/atomic-red-team

---

🔹 4. PurpleSharp

• Type: Adversary simulation tool
• Use: Executes TTPs directly in Windows environments to validate detection pipelines.
• Written in: C#
• URL: https://github.com/mvelazc0/PurpleSharp

---

🔹 5. Detonate (Elastic)

• Type: Synthetic endpoint activity generator
• Use: Simulates common user activity to generate EDR/telemetry data.
• Similarities: Like NPC behavior for generating noise/data for detection testing.
• URL: https://github.com/elastic/detonate

---

🔹 6. OpenNPC

• Type: Open-source user emulation framework
• Use: Simulates realistic user behavior (logon, file access, browsing, email, etc.)
• Note: Not as widely known as GHOSTS, but similar in scope.

---

Summary Table

Tool	GUI Automation	Behavior Timeline	Open Source	Notes
GHOSTS (CMU SEI)	✅ Yes	✅ Yes	✅ Yes	Full NPC framework
Detonate	✅ Partial	❌	✅ Yes	Focused on EDR telemetry
FLARE VM + Scripts	✅ Yes	❌ Manual	✅ Yes	Needs customization
SysmonSimulator	❌	❌	✅ Yes	Log generation only
Selenium + Scripts	✅ Yes	✅ With effort	✅ Yes	Build-your-own NPC
OpenNPC (unofficial)	✅ ?	?	✅ ?	Varies by project

Reference

• Ludus Roles – https://discord.com/channels/1216801602518782042/1399104140206145746/1399119854669136063