THUGS(red) Security Check

A standardised benchmark for endpoint security posture — and for whether your EDR, AV and SOC actually notice when something hostile happens.

under construction The full site is being built right now. This page is a placeholder so you know what is coming.


What it is

Most companies buy endpoint protection and assume it works. This project tests that assumption. You run a client on a machine, it inventories exactly what protection is installed and how it is configured, then it performs a series of controlled, deliberately suspicious actions — mimicking known malware, signatures and attacker behaviour — and records what the machine detected, blocked, or quietly let through.

Everything is a test. Nothing is real malware and nothing persists. The point is measurement, not damage.

The second half of the test is human: while the client runs, you watch your own SOC. Did they see it? Did they raise an alert? Did the right process trigger — major incident management, escalation, contact paths? The client cannot measure that for you, but it gives you a precise timeline to hold your response against.

What it inspects

  • Installed EDR — SentinelOne, CrowdStrike, Tanium, Elastic Agent, Cortex, Carbon Black and many more
  • AV and other protection software, with live status and definition age
  • Microsoft Defender state, including real-time and tamper protection
  • Group Policy, MDM profiles and GRC-relevant policy compliance
  • Active Directory / Entra membership and join type
  • Firewall, disk encryption and patch currency
  • Local administrators and account hygiene
  • Platform, hardware details and attached USB devices

What it triggers

  • EICAR and other public, inert AV test signatures
  • Known-malware signature checks (test strings only, never live samples)
  • Ransomware-style mass file renaming, inside a sandbox it created itself
  • Obfuscated base64 PowerShell and cmd execution
  • Attempted creation of a privileged local user, immediately reverted
  • Download of offensive tooling such as mimikatz — fetched, never executed, deleted
  • Egress to known-bad Chinese networks and to TOR nodes
  • Nearest-neighbour scanning of the local subnet

The payload set is designed to be extended over time.

How it will work

  1. Download the client for Windows, macOS or Linux. Single binary, no installer, no dependencies.
  2. Run it on a dedicated test machine. Watch the results stream past live as each check and trigger completes.
  3. Get a JSON report with the full posture inventory and a per-test detected / not-detected verdict.
  4. Read it locally, or upload it here to see how you compare against everyone else.
  5. Choose what is shared. Public feeds the comparative statistics; organisation-only or fully private keeps it to yourself.

Uploading is entirely optional — the client is useful on its own.

Run this on a disposable machine only

The client intentionally behaves like malware in order to provoke a reaction. Use a dedicated laptop you can wipe, or a virtual machine you can roll back.

Never run it on an employee's production machine, on a server, or on anything whose loss or lockdown would hurt. Expect quarantine, alerts, and possibly the machine being isolated by your own SOC — that is a successful test, not a malfunction.

Only run it against machines and networks you are authorised to test, and tell your SOC afterwards.

Why compare?

A detection rate on its own means little. Knowing that comparable organisations catch a particular technique far more often than you do is actionable. Once reports are flowing, the statistics pages will break results down by platform, protection product, test category and technique — so you can see which tooling actually earns its licence cost, and which techniques slip past almost everyone.

Build status

  • done Database schema and application core
  • done Report format specification
  • in progress Client for Windows, macOS and Linux
  • in progress EDR & AV detection catalogue
  • in progress Site design, accounts and report upload
  • next Comparative statistics pages

Client target version: 0.1.0

root@thugsred:~$ check back soon