Facad1ng

If you find this GitHub repo useful, please consider giving it a star! ⭐️ Facad1ng is an open-source URL masking and analysis tool designed for security research, phishing awareness, and defensive testing. It demonstrates how adversaries may disguise malicious links using URL manipulation and...

red-kube

Red Team K8S Adversary Emulation Based on kubectl Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure or active for performing...

ThreatHunting

ThreatHunting | A Splunk app mapped to MITRE ATT&CK to guide your threat hunts This is a Splunk application containing several dashboards and over 130 reports that will facilitate initial hunting indicators to investigate. You obviously need to be ingesting Sysmon data into Splunk, a good...

bandjacks

Bandjacks Cyber Threat Defense World Modeling System Overview Bandjacks is a comprehensive cyber threat intelligence CTI system that: Extracts MITRE ATT&CK techniques from threat reports in 12-40 seconds Builds a knowledge graph of threat actors, techniques, and defenses Generates STIX 2.1...

Threat-Hunting

Threat-Hunting | Detection Engineering Collection of threat hunting and detection queries for: CrowdStrike Falcon using CQL – CrowdStrike Query Language Microsoft Defender XDR using KQL – Kusto Query Language Aimed at surfacing suspicious processes, anomalous network behaviors, living-off-the-lan...

Attacker-Group-Predictor

Attacker-Group-Predictor The tool predicts attacker groups from techniques and softwares used. It searches based on the MITRE ATT&CK™ framework How it works? 1- Collect data from https://attack.mitre.org/ about attacker groups 2- Get data from user about attack 3- Compare data and create result...

shennina

Shennina Automating Host Exploitation with AI Abstract Shennina is an automated host exploitation framework. The mission of the project is to fully automate the scanning, vulnerability scanning/analysis, and exploitation using Artificial Intelligence. Shennina is integrated with Metasploit and Nm...

caldera

Caldera™ Caldera™ is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response. It is built on the MITRE ATT&CK™ framework and is an active research project at MITRE. The framework consists of two components: 1. The core...

azure-sentinel-detection-engineering

Azure Sentinel Detection Engineering Detection engineering on a live Microsoft Sentinel and Defender XDR environment I operate. Nine custom analytics rules span three planes, each mapped to MITRE ATT&CK and proven end to end: a controlled action triggers the rule, the rule raises an incident, and...

dorothy

Creado por David French @threatpunter en Elastic Security Dorothy es una herramienta que ayuda a los equipos de seguridad a probar sus capacidades de monitoreo y detección para su entorno de Okta. Dorothy cuenta con varios módulos para simular acciones que un atacante podría realizar al operar en...

dorothy

Created by David French @threatpunter at Elastic Security Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and...

AI-driven-MITRE-Attack

POC : AI-driven MITRE Attack Detection and Alert Enrichment This repository demonstrates a machine learning pipeline for detecting MITRE ATT&CK techniques from logs and enriching the output using a local LLM. Overview The project is divided into two main components : 1. Machine Learning Model ML ...

atomic-red-team

Atomic Red Team Atomic Red Team™ es una biblioteca de pruebas asociadas al framework MITRE ATT&CK®. Los equipos de seguridad pueden usar Atomic Red Team para probar sus entornos de manera rápida, portable y reproducible. Comenzar Puede ejecutar pruebas atómicas directamente desde la línea de...

ThreatActors-TTPs

NOTE: This is a fork from Crocodyli - All I'm doing is adding to it for my own purposes. I'm using it to power the gapMATRIX pages on https://incidentbuddy.ai THREAT ACTORS AND RANSOMWARES - TTPs This repository was created with the aim of assisting companies and independent researchers in studyi...

ThreatActors-TTPs

THREAT ACTORS AND RANSOMWARES - TTPs This repository was created with the aim of assisting companies and independent researchers in studying the Tactics, Techniques, and Procedures TTPs , based on the MITRE ATT &CK framework, adopted by active or inactive Ransomware operators/groups and other...

oasis

OASIS Estándar de Inteligencia de Seguridad Ofensiva con IA — Evaluación comparativa de seguridad con IA de código abierto. Evalúa cómo los modelos de IA realizan tareas de seguridad ofensiva: descubrimiento de vulnerabilidades, explotación, escalada de privilegios y más. Análisis completo con...

Qu1cksc0pe

Qu1cksc0pe All-in-One malware analysis tool for analyze many file types, from Windows binaries to E-Mail files. You can get : What DLL files are used. Functions and APIs. Sections and segments. URLs, IP addresses and emails. Android permissions Dangerous/Special/Info. MITRE ATT&CK mappings Window...

APTs-Adversary-Simulation

APTs Adversary Simulation A comprehensive collection of simulated Advanced Persistent Threat APT attacks based on real world tactics, techniques, and procedures TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly f...

auditd-attack

auditd-attack A Linux Auditd rule set mapped to MITRE's Attack Framework Disclaimer Please ensure you test these rules prior to pushing them into production. This rule set is NOT meant to have all of its rules enabled all at once although that'd be ideal it is setup to serve as guidance toward...

ServerSecurityAudit

🛡️ Windows Server Security Audit NIS2 Alignment 📋 Overview A modular PowerShell-based engine designed to perform deep security hygiene audits on Windows Server systems. It delivers actionable risk scoring mapped to NIS2 Directive Article 21 , MITRE ATT &CK, and CIS Controls v8 , generating...