TTPRunner

TTPRunner Autonomous TTP execution agent for purple team operations Feed it a threat report. It builds the attack plan. You approve. It executes. Features Screenshots Dashboard Input| Execution Plan Graph ---|--- | Step Edit Modal| Execution Detail ---|--- | Targets| VECTR Integration ---|---...

ThreatActors-TTPs

THREAT ACTORS AND RANSOMWARES - TTPs This repository was created with the aim of assisting companies and independent researchers in studying the Tactics, Techniques, and Procedures TTPs , based on the MITRE ATT &CK framework, adopted by active or inactive Ransomware operators/groups and other...

ThreatActors-TTPs

NOTE: This is a fork from Crocodyli - All I'm doing is adding to it for my own purposes. I'm using it to power the gapMATRIX pages on https://incidentbuddy.ai THREAT ACTORS AND RANSOMWARES - TTPs This repository was created with the aim of assisting companies and independent researchers in studyi...

SentinelOne-ATTACK-Queries

ATT&CK マッピング済み SentinelOne クエリ MITRE ATT&CK にマッピングされた SentinelOne Deep Visiblity 用クエリ 開発終了 このプロジェクトは、共有可能なシグネチャとツールでの利用を目指すSentinelOne-Queries リポジトリに置き換えられました。新しいリポジトリはこのリポジトリ内の作業を基に構築されており、テストのほとんどは依然として Atomic Red Team に対して実施されています。これらのクエリは、エージェントのバージョン間などで検出内容が変化するため、更新されません。 このプロジェクトは、Red...

APTs-Adversary-Simulation

APTs Adversary Simulation A comprehensive collection of simulated Advanced Persistent Threat APT attacks based on real world tactics, techniques, and procedures TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly f...

Breach-Report-Collection

侵害レポート集 侵害を受けた後に脅威アクターのTTPを公開した企業群 測定可能な効果と影響をもたらす脅威アクターによる侵入の分析に有用 組織| 侵害日| 脅威アクター| 出典 ---|---|---|--- DigiCert| 2026年4月| GoldenEyeDog 中国APT| bugzilla.mozilla.org / アーカイブ F5 Networks| 2025年10月| 不明 APT| my.f5.com / アーカイブ BeyondTrust| 2024年12月| 不明 中国APT| beyondtrust.com / アーカイブ ロードアイランド州| 2024年12月...

PurpleKeep

설명 공격 기술의 다양성이 급격히 증가하고 EDREndpoint Detection and Response에서 제공하는 탐지 규칙과 사용자 정의 규칙이 동시에 증가함에 따라 탐지 규칙의 지속적인 기능 테스트 필요성이 명확해졌습니다. 그러나 이러한 공격을 수동으로 재실행하고 탐지 규칙과 대조하는 것은 노동 집약적인 작업이므로 자동화할 가치가 있습니다. 이 문제를 해결하기 위해 저는 "PurpleKeep"을 개발했습니다. 이는 탐지 규칙의 자동화된 테스트를 용이하게 하기 위해 설계된 오픈 소스 이니셔티브입니다. Atomic Red...

AutoTTP

AutoTTP 자동화된 전술, 기법 및 절차. 회귀 테스트, 제품 평가, 연구자를 위한 데이터 생성 등을 위해 복잡한 시퀀스를 수동으로 재실행하는 것은 지루할 수 있습니다. 저는 Empire 또는 Metasploit RPC, Cobalt-Strike 등과 같이 API를 제공하는 모든 프레임워크/제품/툴킷를 Visual Studio Code 또는 이에 상응하는 IDE와 같은 IDE를 사용하여 스크립팅하기 쉽게 만드는 아이디어를 구상했습니다. 그래서 AutoTTP를 설계하기 시작했습니다. 이것은 아직 진행 중인 작업입니다...

leonidas

Leonidas This is the repository containing Leonidas, a framework for executing attacker actions in the cloud. It provides a YAML-based format for defining cloud attacker tactics, techniques and procedures TTPs and their associated detection properties. These definitions can then be compiled into:...

presentations

Presentazioni di Christopher Peacock Anno| Organizzazione| Titolo della presentazione| Slide| Video ---|---|---|---|--- 2023| BSides Tampa| Purple Team 101| Slide| 2022| SANS PenTest HackFest 2022| In trincea: cosa fare e cosa non fare nel Purple Team| Slide| YouTube 2022| BSides St Petersburg|...

Turning threat reports into detection insights with AI

Security teams routinely need to transform unstructured threat knowledge, such as incident narratives, red team breach-path writeups, threat actor profiles, and public reports into concrete defensive action. The early stages of that work are often the slowest. These include extracting tactics,...

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan

This blog discusses the latest modifications observed in Earth Kasha’s TTPs from their latest campaign detected in March 2025 targeting Taiwan and Japan...

Honeypot-Factory: The Use of Deception in ICS/OT Environments

The recently published Security Navigator report of Orange Cyberdefense shows there has been a rapid increase of attacks on industrial control systems ICS in the past few years. Looking a bit closer, most of the attacks seem to have spilt over from traditional IT. That's to be expected, as...

Malicious code in ttp-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a26808cf09478fb5d542a42e4631fb27a558c438802a79dc2cef43a1023ef22e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6675 Malicious code in ttp-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a26808cf09478fb5d542a42e4631fb27a558c438802a79dc2cef43a1023ef22e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

packetStrider - A Network Packet Forensics Tool For SSH

packetStrider for SSH is a packet forensics tool that aims to provide valuable insight into the nature of SSH traffic, shining a light into the corners of SSH network traffic where golden nuggets of information previously lay in the dark. The problem that packet strider aims to help with AKA Why?...

MITRE ATT&CK Evaluation Demonstrates the Power of the VMware Carbon Black Cloud

MITRE has released the results for its latest endpoint detection and response EDR product evaluation using its now industry-standard open methodology, the ATT&CK® framework. This year’s results further demonstrate why VMware Carbon Black, now a two-time participant, is a top choice of security an...

Real-life cybercrime stories from DART, the Microsoft Detection and Response Team

When we published our first blog about the Microsoft Detection and Response Team DART in March of 2019, we described our mission as responding to compromises and helping our customers become cyber-resilient. In pursuit of this mission we had already been providing onsite reactive incident respons...

UPDATE: MITRE CALDERA 2.5.1

MITRE CALDERA 2.5.1 is now available since the last release – MITRE CALDERA 2.5.0, which was released a couple of days ago. As you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. Among major changes, what I like is that now...

Managed Detection and Response analytics report, H1 2019

Download full report PDF Introduction This report contains the results of the Managed Detection and Response MDR service brand name - Kaspersky Managed Protection. The MDR service provides managed threat hunting and initial incident response. Threat hunting is the practice of iteratively searchin...