IATelligence

IATelligence IATelligence is a Python script that extracts the Import Address Table IAT from a PE file and uses OpenAI's GPT-3 model to provide details about each Windows API imported by the file. The script also searches for related MITRE ATT&CK techniques and explains how the API could...

attackgen

AttackGen AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK and ATLAS frameworks. The tool generates tailored incident response scenarios based on user-selected threat actor groups, AI attack case...

APTs-Adversary-Simulation

APTs Adversary Simulation A comprehensive collection of simulated Advanced Persistent Threat APT attacks based on real world tactics, techniques, and procedures TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly f...

DeTTECT

Detect Tactics, Techniques & Combat Threats Latest version: 2.2.0 To get started with DeTT&CT, check out one of these resources: This page on the Wiki. This blog written by Renaud Frère from NVISO has a comprehensive and recent description on the capabilities of DeTT&CT. Blog:...

Mobile-Drop-Device-SOC-Detection

🛡️ Project Phantom: Mobile "Drop Device" SOC Detection Simulation This project demonstrates an end-to-end SOC laboratory workshop simulating how an unauthorized, root-less Android device Casper Via S, used as a "Drop Device" within an internal network, is detected via Wazuh SIEM when launching...

auditd-attack

auditd-attack A Linux Auditd rule set mapped to MITRE's Attack Framework Disclaimer Please ensure you test these rules prior to pushing them into production. This rule set is NOT meant to have all of its rules enabled all at once although that'd be ideal it is setup to serve as guidance toward...

Facad1ng

If you find this GitHub repo useful, please consider giving it a star! ⭐️ Facad1ng is an open-source URL masking and analysis tool designed for security research, phishing awareness, and defensive testing. It demonstrates how adversaries may disguise malicious links using URL manipulation and...

misp-galaxy

misp-galaxy MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes. A cluster can be composed of one or more elements. Elements are expressed as key-values. There are default knowledge base such as Threat Actors, Tools, Ransomware...

Purpleteam

Purpleteam work in progress Scripts i made to trigger events for SOC detections, mapped to MITRE ATT&CK techniques...

BEAR-C2

BEAR-C2 Framework BEAR-C2 is an adversary simulation and emulation framework built around real world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. It provides a flexible environment for diverse engagement scenarios and delivers a realistic foundation for red team...

IOCScraper

IOC Scraper IOC Scraper utilises IOCPARSER service to fetch IOCs from different vendor Blogs, PDFs, and CSV files. Parsing IOCs is time-consuming process, using current script one can automatically extract and aggregate IOCs easily. Features Defanged IOCs : Supports extracting and defanging IOCs...

ThreatActors-TTPs

NOTE: This is a fork from Crocodyli - All I'm doing is adding to it for my own purposes. I'm using it to power the gapMATRIX pages on https://incidentbuddy.ai THREAT ACTORS AND RANSOMWARES - TTPs This repository was created with the aim of assisting companies and independent researchers in studyi...

SecAssessment-GapDetection-Thesis

D3FENDer - Security Assessment & Gap Detection Tool Using MITRE ATT&CK & D3FEND Frameworks D3FENDer is a rule-based CLI tool developed by Michael for his thesis titled Development of a security assessment and gap detection system using the MITRE ATT&CK and D3FEND Frameworks. It is designed to...

ghost

Ghost Ghost is a process injection detection tool written in Rust. It watches running processes and tries to catch suspicious stuff like code injection, memory manipulation, and other tricks that malware uses to hide. What it does The main idea is simple: scan processes and look for weird memory...

shennina

Shennina Automating Host Exploitation with AI Abstract Shennina is an automated host exploitation framework. The mission of the project is to fully automate the scanning, vulnerability scanning/analysis, and exploitation using Artificial Intelligence. Shennina is integrated with Metasploit and Nm...

Awesome-BEC

Awesome-BEC Repository of attack and defensive information for Business Email Compromise investigations Office365/AzureAD ATT&CK O365 ATT&CK Azure Microsoft Azure Threat Research Matrix Microsoft 365 Licensing Microsoft Portals Azure App IDs Microsoft First Party App IDs & Graph Permissions...

gp_netSecDSS

netSecDSS Decision Support System for Risk Assessing Network and System Security in SMEs A Docker-based network security monitoring platform built for small and medium enterprises that can't afford commercial SIEM tools. It simulates a realistic multi-subnet SME network, runs staged attack...

ThreatActors-TTPs

THREAT ACTORS AND RANSOMWARES - TTPs This repository was created with the aim of assisting companies and independent researchers in studying the Tactics, Techniques, and Procedures TTPs , based on the MITRE ATT &CK framework, adopted by active or inactive Ransomware operators/groups and other...

dfir-malware-investigation

DFIR Malware Investigation Lab – Spring4Shell CVE-2022-22965 A comprehensive Digital Forensics & Incident Response DFIR project that simulates, detects, and investigates the Spring4Shell CVE-2022-22965 critical vulnerability. This project demonstrates the complete incident response lifecycle from...

threatmap

threatmap Static IaC threat modeler that parses Terraform, CloudFormation, and Kubernetes manifests and produces structured threat model reports using STRIDE, MITRE ATT&CK, or PASTA frameworks. No network calls, no cloud credentials, fully offline. Runs as a CLI, REST API, or containerized servic...