# Recommended rules for NextronSystems/APTSimulator

**URL:** <https://discuss.elastic.co/t/recommended-rules-for-nextronsystems-aptsimulator/320105>\
**Category:** Elastic Security\
**Tags:** detection-rules\
**Created:** [November 30, 2022, 4:55am UTC](https://discuss.elastic.co/t/recommended-rules-for-nextronsystems-aptsimulator/320105 "2022-11-30T04:55:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nikAizuddin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikaizuddin/32/101962_2.png) [@nikAizuddin](https://discuss.elastic.co/u/nikAizuddin)\
**Post date:** [November 30, 2022, 4:55am UTC](https://discuss.elastic.co/t/recommended-rules-for-nextronsystems-aptsimulator/320105/1 "2022-11-30T04:55:22Z")

</div>

Hi,

I'm using Elastic Stack 8.3.3 with Basic License. I want test Kibana alerts for APT by detecting [NextronSystems/APTSimulator](https://github.com/NextronSystems/APTSimulator/) activity.

By default, Elastic include 716 rules:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/9421ca35f308a9370bb21e9013bbb78bf375990d.png)

May I know which rules are recommended for APT, such as [NextronSystems/APTSimulator](https://github.com/NextronSystems/APTSimulator/)?

Thank you

---

<div class="post-metadata">

**Author:** ![devonkerr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devonkerr/32/56711_2.png) [@devonkerr](https://discuss.elastic.co/u/devonkerr)\
**Post date:** [November 30, 2022, 1:58pm UTC](https://discuss.elastic.co/t/recommended-rules-for-nextronsystems-aptsimulator/320105/2 "2022-11-30T13:58:22Z")

</div>

Hello!

We don't develop rules for or maintain visibility of third party simulation frameworks like APTSimulator, which may not accurately generate reliable datasets. Instead, we provide Red Team Automation (RTA) scripts which you can read more about in our community-facing rules repository [here](https://github.com/elastic/detection-rules).

Additionally, be advised that a nation-state threat (APT) will use whichever technique(s) are effective-- so any technique in MITRE ATT&CK should be considered fair game.

---

<div class="post-metadata">

**Author:** ![nikAizuddin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikaizuddin/32/101962_2.png) [@nikAizuddin](https://discuss.elastic.co/u/nikAizuddin)\
**Post date:** [November 30, 2022, 2:15pm UTC](https://discuss.elastic.co/t/recommended-rules-for-nextronsystems-aptsimulator/320105/3 "2022-11-30T14:15:34Z")

</div>

I see, noted! I'll take a look into the Detection Rules repository.

---

<div class="post-metadata">

**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\
**Post date:** [December 1, 2022, 12:26pm UTC](https://discuss.elastic.co/t/recommended-rules-for-nextronsystems-aptsimulator/320105/4 "2022-12-01T12:26:39Z")

</div>

I don't know if you even looked at this blog [An Evaluation of Elastic EDR with APT Simulator | www.neteye-blog.com](https://www.neteye-blog.com/2022/01/evaluation-of-elastic-edr-with-apt-simulator/) where you have a comparison of detections using APTSimulator

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 29, 2022, 12:27pm UTC](https://discuss.elastic.co/t/recommended-rules-for-nextronsystems-aptsimulator/320105/5 "2022-12-29T12:27:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.