Small and highly portable detection tests based on MITRE's ATT&CK.

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

Tools and Techniques for Red Team / Penetration Testing

Automated Adversary Emulation Platform

A repository of sysmon configuration modules

Windows Events Attack Samples

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Web app that provides basic navigation and annotation of ATT&CK matrices

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

Curated resources help you prepare for the CNCF/Linux Foundation CKS 2021 "Kubernetes Certified Security Specialist" Certification exam. Please provide feedback or requests by raising issues, or making a pull request. All feedback for improvements are welcome. thank you.

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

A curated knowledge base to build, run and mature a SOC (including CSIRT).

GOAL: Incident Response Playbooks Mapped to MITRE Attack Tactics and Techniques. [Contributors Friendly]

An Active Defense and EDR software to empower Blue Teams

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

Utilities for MITRE™ ATT&CK

Actionable analytics designed to combat threats

Tool for building Kubernetes attack paths

KQL Queries. Microsoft Defender, Microsoft Sentinel

A Linux Auditd rule set mapped to MITRE's Attack Framework

Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.

A python module for working with ATT&CK

A knowledge base of actionable Incident Response techniques

Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

Scripts and a (future) library to improve users' interactions with the ATT&CK content

MITRE ATT&CK Website

TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE ATT&CK®.