A new open-core platform called ARES promises to change how red teams, MSSPs, and security operations centers test Active Directory and cloud security. Developed by an individual under the alias “Mafifrizi,” ARES is now available on GitHub. Its core offering is free, while advanced development is supported through sponsorship. Reviewers should treat ARES as an independent project: the repository provides no real name or organization behind it.
What ARES Delivers
ARES includes 66 active attack modules—70 in total—that cover more than 60 techniques mapped to MITRE ATT&CK. It’s designed to run realistic steps that confirm which vulnerabilities lead to high-value targets, rather than simply listing possible CVEs like a vulnerability scanner does. By exploring attack paths, it helps defenders understand which flaws truly matter.
On the Active Directory front, ARES can load data from BloodHound or map live domain sessions using its built‐in graph engine. From there it calculates the shortest path to a Domain Admin role, identifies chokepoints, and assesses lateral move feasibility. The platform supports goal settings such as “domain_admin,” “full_compromise,” or “cloud_audit” and generates multi-step plans to reach those goals. Optionally, AI agents—such as Claude, OpenAI, or a local Ollama model—can be plugged in to suggest next steps, but only with explicit permission from the operator.
Safety, Reporting, and Protections
Understanding that red team operations carry risk, ARES is built with tight guardrails. Before deploying a module, ScopeGuard verifies targets are in scope. A second layer—the Scope Firewall and Egress Filter—blocks unwanted traffic via both the OS firewall (Windows Defender or Linux Netfilter if running as root) and inside the tool’s own Python code. The tool is designed to “fail-closed,” so anything outside permitted scope is halted rather than executed.
The platform also profiles the noise level of each attack step, so operators can choose quieter techniques—especially useful when trying to stay under the radar of blue teams. For data protection, sessions are stored securely, tokens are short-lived, and sensitive information is encrypted using AES-256-GCM; hash and credential data are protected via strong key-derivation (PBKDF2-HMAC-SHA256 with 600,000 rounds).
Once the test ends, ARES produces reports in multiple formats—PDF, HTML, Markdown, JSON. The PDF version uses a headless browser so there’s no need for GUI dependencies.
Getting Started & Best Practices
Security teams are urged to use ARES only on networks they own or have explicit permission to test. Beginners should try it first in a lab environment. Before any engagement, the scope rules should be reviewed carefully to ensure that out-of-bound IP addresses are blocked. After running tests, if the tool identifies a path to domain admin rights, that path should be closed off and then retested.
This tool emerges as defenders increasingly face red-team-style threats from attackers using AI and automation. Giving blue teams the ability to simulate such behavior lets them find gaps in their defenses before adversaries do.
Why this matters: ARES lowers the bar for realistic red team operations and could shift the security testing landscape. Because many organizations still rely on periodic pen-tests that may miss fast-changing misconfigurations, tools like this let defenders test continuously. The inclusion of safety gates like ScopeGuard and the optional AI support reflect the growing demand for both power and responsible automation. Teams adopting ARES should watch for how its module library expands, how well its AI planning agents perform, and how foes may copy its tactics. It’s a development in security where transparency, realism, and control converge—and it might shape where offensive testing goes next.
