Small and highly portable detection tests based on MITRE's ATT&CK.

Automated Adversary Emulation Platform

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

Vulnerability Intelligence Platform

Adversary tradecraft detection, protection, and hunting

GOAL: Incident Response Playbooks Mapped to MITRE Attack Tactics and Techniques. [Contributors Friendly]

Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.

Utilities for MITRE™ ATT&CK

MAAD Attack Framework - An attack tool for simple, fast & effective security testing of M365 & Entra ID (Azure AD).

A PowerShell script to interact with the MITRE ATT&CK Framework via its own API

Chain Reactor is an open source framework for composing executables that simulate adversary behaviors and techniques on Linux endpoints.

Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads

MITRE Caldera™ for OT Plugins & Capabilities

Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.

Templates for the Microsoft Threat Modeling Tool

The MITRE Security Automation Framework (SAF) Command Line Interface (CLI) brings together applications, techniques, libraries, and tools developed by MITRE and the security community to streamline security automation for systems and DevOps pipelines

A simple, fully python ransomware PoC using AES-CTR and RSA. Supports Windows, Linux and macOS

This repository contains helper scripts and custom configs to get the best out of Google's Timesketch project.

attack2jira automates the process of standing up a Jira environment that can be used to track and measure ATT&CK coverage

🧬 Mitre Interactive Network Graph (APTs, Malware, Tools, Techniques & Tactics)

Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io

Collection of CVEs from Sick Codes, or collaborations on https://sick.codes security research & advisories.

Find relevant incidents, logs, events, and alerts to all of your incidents. [Attack Flows, Attack Chains, & Root Cause Discovery - NO LLMs, NO Queries, Just Explainable Machine Learning] >> Use it for free here: https://app.cypienta.io

MITRE Engage™ is a framework for conducting Denial, Deception, and Adversary Engagements.

A command line CWE discovery tool based on OWASP / CAPSEC database of Common Weakness Enumeration.

This tool maps a file's behavior on MITRE ATT&CK matrix.

A utility for validating and parsing Common Platform Enumeration (CPE) v2.2 and v2.3 as originally defined by MITRE and maintained by NIST

Library of threat hunts to get any user started!

uCVE is a tool written in GO that allows to extract CVE's related to a specific software and version, obtaining a report in HTML format with the result and/or exporting it to the pentesting report.

BugBoard: A comprehensive open-source cybersecurity tool for vulnerability detection and bug hunting.