RTA

Red Team Automation RTA RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK. RTA is composed of python scripts that generate evidence of over 50 different ATT&CK tactics, as well as a compil...

gp_netSecDSS

netSecDSS Decision Support System for Risk Assessing Network and System Security in SMEs A Docker-based network security monitoring platform built for small and medium enterprises that can't afford commercial SIEM tools. It simulates a realistic multi-subnet SME network, runs staged attack...

decider

Decider This work is licensed under a Creative Commons Attribution 4.0 International License. This project makes use of MITRE ATT&CK® - ATT&CK Terms of Use. 📰 3.0.0 - Kiosk is Here Decider is now login-less and responsive. Content updates have been simplified to copying files and restarting Docke...

auditd-attack

auditd-attack A Linux Auditd rule set mapped to MITRE's Attack Framework Disclaimer Please ensure you test these rules prior to pushing them into production. This rule set is NOT meant to have all of its rules enabled all at once although that'd be ideal it is setup to serve as guidance toward...

Qu1cksc0pe

Qu1cksc0pe All-in-One malware analysis tool for analyze many file types, from Windows binaries to E-Mail files. You can get : What DLL files are used. Functions and APIs. Sections and segments. URLs, IP addresses and emails. Android permissions Dangerous/Special/Info. MITRE ATT&CK mappings Window...

cve-search

cve-search cve-search is a tool to import CVE Common Vulnerabilities and Exposures and CPE Common Platform Enumeration into a MongoDB to facilitate search and processing of CVEs. The main objective of the software is to avoid doing direct and public lookups into the public CVE databases. Local...

Elemental

Elemental Elemental is a centralized threat library of MITRE ATT&CK techniques, Atomic Red Team tests, and over 280 Sigma rules. It provides an alternative way to explore the ATT&CK dataset, mapping relevant Atomic Red Team tests and Sigma rules to their respective technique. Elemental allows...

attackintel

UPDATE 26 Nov 2018 MITRE has deprecated the ATT&CK API functionality and will soon be phasing it out. They have moved to utilizing STIX. My code will be available for reference but you can check out my ATT&CK Intel webapp which is in the preliminary phases of development and offers the same info...

SecAssessment-GapDetection-Thesis

D3FENDer - Security Assessment & Gap Detection Tool Using MITRE ATT&CK & D3FEND Frameworks D3FENDer is a rule-based CLI tool developed by Michael for his thesis titled Development of a security assessment and gap detection system using the MITRE ATT&CK and D3FEND Frameworks. It is designed to...

deception-as-detection

Deception-as-Detection Deception based detection techniques mapped to the MITRE’s Adversarial Tactics, Techniques, and Common Knowledge ATT&CK™: Windows Technique Matrix Linux Technique Matrix Mac Technique Matrix 📔 Deception Stories A sample deception story is created as a reference. More...

Attacker-Group-Predictor

Attacker-Group-Predictor The tool predicts attacker groups from techniques and softwares used. It searches based on the MITRE ATT&CK™ framework How it works? 1- Collect data from https://attack.mitre.org/ about attacker groups 2- Get data from user about attack 3- Compare data and create result...

AzureAD-Attack-Defense

Attack and Defense Playbook for Microsoft Entra This publication is a collection of various common attack scenarios on Microsoft Entra and how they can be mitigated or detected. All of the included scenarios, insights and comments are based on experiences from the contributors during their attack...

CVE-2021-42558

CVE-2021-42558: Multiple Cross-Site Scripting in MITRE Caldera Caldera versions =2.8.1 contains multiple reflected, stored and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers. Vendor Disclosure: The vendor's disclosure for this vulnerability can be...

Detection-Rules

APT29 Detection Engineering Production-ready Sigma detection rules developed from analysis of 196,071 Sysmon events in the MITRE ATT&CK Evaluations APT29 dataset. Overview This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was...

oasis

OASIS Offensive AI Security Intelligence Standard — Open-source AI security benchmarking. Benchmark how AI models perform offensive security tasks — vulnerability discovery, exploitation, privilege escalation, and more. Full analysis with MITRE ATT&CK mapping, behavioral scoring, and detailed...

detection-rules

Detection Rules Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine. This repository was first announced on Elastic's blog post, Elastic Security...

stride-gpt

STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models LLMs to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the...

BEAR-C2

BEAR-C2 Framework BEAR-C2 is an adversary simulation and emulation framework built around real world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. It provides a flexible environment for diverse engagement scenarios and delivers a realistic foundation for red team...

DeTTECT

Detect Tactics, Techniques & Combat Threats Latest version: 2.2.0 To get started with DeTT&CT, check out one of these resources: This page on the Wiki. This blog written by Renaud Frère from NVISO has a comprehensive and recent description on the capabilities of DeTT&CT. Blog:...

PurpleKeep

Description With the rapidly increasing variety of attack techniques and a simultaneous rise in the number of detection rules offered by EDRs Endpoint Detection and Response and custom-created ones, the need for constant functional testing of detection rules has become evident. However, manually...