SentinelOne-ATTACK-Queries

ATT&CK 映射的 SentinelOne 查询 为 SentinelOne Deep Visiblity 映射的 MITRE ATT&CK 查询 已停止维护 此项目已被SentinelOne-Queries 仓库取代，该仓库正朝着可共享签名及工具化方向发展。新仓库基于本仓库的成果构建，大多数测试仍针对 Atomic Red Team 进行。这些查询将不会随着 Agent 版本等之间的检测变化而更新。 本项目旨在记录 SentinelOne Deep Visibility 查询，用于检测 Red Canary Co 的 Atomic Red Team 框架生成的 Windows...

UPDATE: MITRE CALDERA 2.5.1

MITRE CALDERA 2.5.1 is now available since the last release – MITRE CALDERA 2.5.0, which was released a couple of days ago. As you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. Among major changes, what I like is that now...