Adrenaline

Adrenaline BOF Kit A C2-agnostic collection of Beacon Object Files BOFs for red team and offensive security operations. BOFs are organized by attack chain phase and designed to be small, modular, and automation-friendly for use in reconnaissance, enumeration, and post-exploitation workflows. Tabl...

ghost

Ghost Ghost is a process injection detection tool written in Rust. It watches running processes and tries to catch suspicious stuff like code injection, memory manipulation, and other tricks that malware uses to hide. What it does The main idea is simple: scan processes and look for weird memory...

EVTX-ATTACK-SAMPLES

Windows EVTX Samples 200 EVTX examples: This is a container for windows events samples associated to specific attack and post-exploitation techniques. Can be useful for: Testing your detection scripts based on EVTX parsing Training on DFIR and threat hunting using event logs Designing detection u...

dorothy

Created by David French @threatpunter at Elastic Security Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and...

ThreatActors-TTPs

NOTE: This is a fork from Crocodyli - All I'm doing is adding to it for my own purposes. I'm using it to power the gapMATRIX pages on https://incidentbuddy.ai THREAT ACTORS AND RANSOMWARES - TTPs This repository was created with the aim of assisting companies and independent researchers in studyi...

ForensiX-Studio

ForensiX Studio Forensic Intelligence Platform | Malware Analysis | Threat Correlation Engine 🧠 Multi-Signal Analysis • ⚡ Behavioral Intelligence • 🎯 MITRE Mapping ⚠️ LEGAL DISCLAIMER ForensiX Studio is intended strictly for authorized digital forensics, security research, and defensive analysis. ...

CVE-2021-42559

CVE-2021-42559: Command Injection via Configurations in MITRE Caldera Caldera versions =2.8.1 contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the Rest API, an authenticated user can insert arbitrary commands that...

enterpriseattack

enterpriseattack - MITRE's Enterprise ATT&CK® A lightweight Python module to interact with the MITRE ATT&CK Enterprise dataset. Built to be used in production applications due to it's speed and minimal depedancies. Read the docs for more info. MITRE ATT&CK® MITRE ATT&CK® is a globally-accessible...

attack-stix-data

ATT&CK® STIX Data MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and ...

ARES

Operator-Directed Red Team Orchestration & Continuous Security Validation Platform The open-core platform empowering enterprise red teams, MSSPs, and security operations centers to execute targeted offensive engagements, discover deterministic attack paths, and continuously validate defensive...

APTs-Adversary-Simulation

APTs Adversary Simulation A comprehensive collection of simulated Advanced Persistent Threat APT attacks based on real world tactics, techniques, and procedures TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly f...

Purpleteam

Purpleteam work in progress Scripts i made to trigger events for SOC detections, mapped to MITRE ATT&CK techniques...

Purple-Team-Automation

Purple-Team-Automation Automated purple-team validation of the Sigma detection rules built in detection-as-code-repo, using MITRE Caldera to execute a chained Active Directory credential-access attack path against an existing domain lab, and an ATT&CK Navigator heatmap to visualize coverage. Why...

sysmon-modular

sysmon-modular | A Sysmon configuration repository for everybody to customise Sysmon Modular is a configuration repository for Microsoft Sysinternals Sysmon. Small XML modules make it easier to select, review and maintain the telemetry that is useful to your organisation. The sysmon-modular Go to...

Cve-api

Parse & filter the latest CVEs from https://cve.mitre.org Docs Usage http://localhost:4000/cve?target=KEYWORD The year parameter is optional. http://localhost:4000/cve?target=KEYWORD&year=YEAR Examples http://localhost:4000/cve?target=ruby%20on%20rails...

VeilTransfer

VeilTransfer 2.0 VeilTransfer is a data exfiltration utility designed to test and enhance detection capabilities. This tool simulates real-world data exfiltration techniques used by advanced threat actors, allowing organizations to evaluate and improve their security posture. By leveraging multip...

BloodSOCer

BloodSOCer BloodSOCer is a Python automation tool that aggregates threat intelligence data from multiple sources Mitre ATT&CK, Sigma rules, Atomic Red Team and produces JSON files to ingest in BloodHound in OpenGraph format. BloodSOCer can also upload the files to BloodHound and set the icons for...

cwe-sdk-javascript

cwe-sdk A Common Weakness Enumeration CWE Node.js SDK compliant with MITRE / CAPEC Install yarn add cwe-sdk Usage Require the CweManager class and use its methods const CweManager = require'cwe-sdk' Example const CweManager = require'cwe-sdk' const cweManager = new CweManager const result =...

ThreatActors-TTPs

THREAT ACTORS AND RANSOMWARES - TTPs This repository was created with the aim of assisting companies and independent researchers in studying the Tactics, Techniques, and Procedures TTPs , based on the MITRE ATT &CK framework, adopted by active or inactive Ransomware operators/groups and other...

IOCScraper

IOC Scraper IOC Scraper utilises IOCPARSER service to fetch IOCs from different vendor Blogs, PDFs, and CSV files. Parsing IOCs is time-consuming process, using current script one can automatically extract and aggregate IOCs easily. Features Defanged IOCs : Supports extracting and defanging IOCs...