ATTPwn

ATTPwn root@kitploit: / || || || | || || \ | o || || || o | | || | | ||| |||| ||| /| | | || | | | | | | | | | | | ' || | | | | | | | | | | | \ / | | | ||| || || || // ||| ATTPwn is a computer security tool designed to emulate adversaries. The tool aims to bring emulation of a real threat into...

dorothy

Created by David French @threatpunter at Elastic Security Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and...

presentations

Presentations by Christopher Peacock Year| Organization| Talk Title| Slides| Video ---|---|---|---|--- 2023| BSides Tampa| Purple Team 101| Slides| 2022| SANS PenTest HackFest 2022| In the Trenches: Purple Team Do’s and Don’ts| Slides| YouTube 2022| BSides St Petersburg| TTP Pyramid| Slides|...

VECTR

Documentación de VECTR: https://docs.vectr.io Canal de Discord de la comunidad VECTR: https://discord.gg/2FRd8zf728 VECTR es una herramienta que facilita el seguimiento de las actividades de prueba de tus equipos rojo y azul para medir las capacidades de detección y prevención en diferentes...

brawl-public-game-001

BRAWL One of the challenging problems for cyber security researchers developing detection and response capabilities is finding a realistic environment in which to test their hypothesis and capabilities. The cheapest method is to test capabilities on a small lab network. But this environment is...

columbo

Columbo Columbo es una herramienta de análisis forense informático utilizada para simplificar e identificar patrones específicos en conjuntos de datos comprometidos. Descompone los datos en secciones pequeñas y utiliza reconocimiento de patrones y modelos de aprendizaje automático para identifica...

Breach-Report-Collection

Breach Report Collection A collection of companies that disclose adversary TTPs after they have been breached Useful for analysis of intrusions launched by adversaries with measurable effects and impact Organization| Breach Date| Adversary| Source ---|---|---|--- DigiCert| April 2026| GoldenEyeDo...

decider

Decider Este trabajo está licenciado bajo una Licencia Creative Commons Attribution 4.0 International. Este proyecto hace uso de MITRE ATT&CK® - Términos de uso de ATT&CK. 📰 3.0.0 - Kiosk ya está aquí Decider ahora es sin inicio de sesión y adaptable. Las actualizaciones de contenido se han...

adversary_emulation_library

Adversary Emulation Library In collaboration with Center Participants, the MITRE Center for Threat-Informed Defense Center maintains a library of adversary emulation plans to allow organizations to evaluate their defensive capabilities against the real-world threats they face. Emulation plans are...

red-team-scripts

Red Team Scripts A collection of red teaming and adversary emulation related tools, scripts, techniques, notes, etc. Made for Education purpose only, do not use for illegal purposes...

BEAR-C2

BEAR-C2 Adversary Simulation Framework BEAR-C2 is an adversary simulation and emulation framework built around real world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. It provides a flexible environment for diverse engagement scenarios and delivers a realistic foundatio...

offensive-security-adversary-emulation

Project 5 — Offensive Security & Adversary Emulation Part of a 5-project home-lab SOC arc: build → detect & enrich → investigate → monitor & hunt → attack & cross-check. This project adds the missing half of the picture from Projects 1–4: everything before this was blue team building detections,...

connectwise-automate-AiTM-rce

ConnectWise Automate Ejecución Remota de Código mediante Adversario en el Medio Tabla de Contenidos Antecedentes Cronología Reflexiones y Aprendizajes Divulgación Responsable Código PoC Informe Proporcionado a ConnectWise Resumen Configuración Vulnerable Impacto Detalles Técnicos 1. Transporte...

dod-blue-team-network-lab

DoD Blue Team Network Security & Hardening Lab Executive Summary High fidelity defensive security lab simulating a DoD aligned enterprise network. This project demonstrates structured network segmentation, system hardening, centralized telemetry ingestion, detection engineering, adversary...

caldera-agent

Agente CALDERA La carpeta calderaagent contiene el código fuente del agente CALDERA o cagent , un servicio de Windows que facilita la comunicación entre el servidor CALDERA y los CALDERA Rats. El programa cagent debe instalarse en cada computadora que participe en la operación de emulación de...

Empire v7.0.2

Empire Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server...

How to Spot and Stop Rogue Device Joins

Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attack...

SUSE CVE-2026-20716

Improper access control for some IntelR Processors within Ring 3: User Applications may allow an escalation of privilege. Simple hardware adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local...

Linux Distros Unpatched Vulnerability : CVE-2026-20901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation for some IntelR XeonR processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privilege...

Linux Distros Unpatched Vulnerability : CVE-2025-31938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient granularity of access control in some subsystem for some IntelR XeonR 6 Scalable processors with IntelR TDX may allow an information disclosure...