mitre-attack

There are 65 repositories under mitre-attack topic.

redcanaryco / atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
mitre mitre-attack
Language:C 11178
kubescape
kubescape / kubescape
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
best-practice devops kubernetes mitre-attack nsa security vulnerability-detection
Language:Go 11045
RedTeam-Tools
A-poc / RedTeam-Tools
Tools and Techniques for Red Team / Penetration Testing
cheatsheet cybersecurity hacking penetration-testing red-team security-tools linux resources tools windows enumeration payload pentest pentest-tools red-team-tools mitre-attack redteam
7705
caldera
mitre / caldera
Automated Adversary Emulation Platform
adversary-emulation caldera security-automation red-team mitre mitre-attack security-testing mitre-corporation cybersecurity hacking hacktoberfest
Language:Python 6527
olafhartong / sysmon-modular
A repository of sysmon configuration modules
sysmon dfir threat-hunting mitre-attack modular security-tools
Language:PowerShell 2895
sbousseaden / EVTX-ATTACK-SAMPLES
Windows Events Attack Samples
dataset detection-engineering dfir evtx mitre-attack threat-hunting windows-security winlogbeat
Language:HTML 2441
Digital-Forensics-Guide
mikeroyal / Digital-Forensics-Guide
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
digitalforensics digitalforensicreadiness forensics security forensics-tools digital-forensics threat-intelligence intrusion-detection mitre-attack detection-engineering network-security offensive-security cyber-security port-scanning siem alerting forensic-analysis forensics-investigations osint dfir
Language:Python 2315
mitre-attack / attack-navigator
Web app that provides basic navigation and annotation of ATT&CK matrices
cti cyber-threat-intelligence cybersecurity mitre-attack mitre-corporation
Language:TypeScript 2250
DataDog / stratus-red-team
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
aws adversary-emulation purple-team mitre-attack cloud-security cloud-native-security detection-engineering threat-detection security aws-security azure-security kubernetes-security gcp-security
Language:Go 2186
Shuffle
Shuffle / Shuffle
Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
automation cybersecurity discord integrations mitre-attack openapi orchestration orchestrator orchestrator-gui security security-automation security-orchestrator shuffle soar workflow-editor
Language:Shell 2100
Certified-Kubernetes-Security-Specialist
walidshaari / Certified-Kubernetes-Security-Specialist
Curated resources help you prepare for the CNCF/Linux Foundation CKS 2021 "Kubernetes Certified Security Specialist" Certification exam. Please provide feedback or requests by raising issues, or making a pull request. All feedback for improvements are welcome. thank you.
kubernetes-security kubernetes cks ckss kernel-hardening exam-objectives os-footprint security seccomp apparmor falco kube-hunter kube-bench trivy pod certification policy mitre-attack pod-security-policy open-policy-agent
Language:AGS Script 2084
center-for-threat-informed-defense / adversary_emulation_library
An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
adversary-emulation adversary-emulation-plans ctid cyber-threat-intelligence cybersecurity mitre-attack red-team threat-informed-defense
Language:C 2027
cyb3rxp / awesome-soc
A collection of sources of documentation, as well as field best practices, to build/run a SOC
architecture cert csirt detection incident-response management mitre-attack purpleteam risk-management siem sirp soa soar soc tip ttp
1546
Incident-Playbook
austinsonger / Incident-Playbook
GOAL: Incident Response Playbooks Mapped to MITRE Attack Tactics and Techniques. [Contributors Friendly]
cybersecurity playbook cybersecurity-playbook incident-response incident-management incidents mitre-attack mitre contributions-welcome contributors-welcome catalog
1517
BLUESPAWN
ION28 / BLUESPAWN
An Active Defense and EDR software to empower Blue Teams
active-defense windows security security-tools blue-team mitre-attack anti-virus edr threat-hunting
Language:C++ 1306
olafhartong / ThreatHunting
A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
splunk mitre-attack threat-hunting dfir
1169
sentinel-attack
netevert / sentinel-attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
siem threat-hunting azure-sentinel mitre-attack sysmon sysmon-config azure blue-team cybersecurity logging security-tools detection kql workbooks terraform-azure
1073
nshalabi / ATTACK-Tools
Utilities for MITRE™ ATT&CK
adversary-emulation mitre mitre-attack redteam redteaming
Language:HTML 1043
Open-Source-Security-Guide
mikeroyal / Open-Source-Security-Guide
Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.
compliance cyber-security detection-engineering forensics-tools incident-management incident-response information-security infosec intrusion-detection kali-linux mitre-attack network-analysis offensive-security pentesters privacy-protection scanning-tool siem surveillance vulnerabilities vulnerability-detection
Language:Go 1021
atomic-threat-coverage
atc-project / atomic-threat-coverage
Actionable analytics designed to combat threats
incidentresponse mitre-attack threat-model threatdetection threathunting threatintelligence
Language:Python 1004
DataDog / KubeHound
Tool for building Kubernetes attack paths
adversary-emulation attack-graph attack-paths cloud-native-security exploit kubernetes kubernetes-security mitre-attack purple-team red-team security-audit security-automation security-tools
Language:Go 921
bfuzzy / auditd-attack
A Linux Auditd rule set mapped to MITRE's Attack Framework
auditd attack-detection mitre-attack threat-hunting linux
814
ion-storm / sysmon-config
Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
dfir digitalforensics forensic-analysis forensicartifacts forensics graylog graylog-plugin humio logging mitre-attack netsec siem sigma-rules sysinternals sysmon threat-analysis threat-hunting threat-intelligence threat-sharing threatintel
Language:PowerShell 812
SlimKQL / Hunting-Queries-Detection-Rules
KQL Queries. Microsoft Defender, Microsoft Sentinel
azure defender defenderxdr kql microsoft mitre-attack sentinel threatdetection threathunting
Language:JavaScript 774
center-for-threat-informed-defense / attack-flow
Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.
cybersecurity ctid mitre-attack cyber-threat-intelligence threat-informed-defense
Language:TypeScript 694
atc-react
atc-project / atc-react
A knowledge base of actionable Incident Response techniques
amitt dfir incident-response mitre-attack response-playbooks thehive
Language:Python 650
mitre-attack / mitreattack-python
A python module for working with ATT&CK
cti cyber-threat-intelligence cybersecurity mitre-attack mitre-corporation python
Language:HTML 620
mdecrevoisier / EVTX-to-MITRE-Attack
Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
evtx mitre-attack redteam siem threat-hunting
593
mitre-attack / attack-scripts
Scripts and a (future) library to improve users' interactions with the ATT&CK content
cti cyber-threat-intelligence cybersecurity mitre-attack mitre-corporation python
Language:Python 585
mitre-attack / attack-website
MITRE ATT&CK Website
cti cyber-threat-intelligence cybersecurity mitre-attack mitre-corporation
Language:HTML 550
center-for-threat-informed-defense / tram
TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE ATT&CK®.
ctid cyber-threat-intelligence cybersecurity mitre-attack threat-informed-defense
Language:Jupyter Notebook 525
tailpipe
turbot / tailpipe
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
aws azure detections devops duckdb forensics gcp incident-response log-analysis mitre-attack open-source parquet siem tailpipe threat-detection
Language:Go 515
center-for-threat-informed-defense / attack-control-framework-mappings
🚨ATTENTION🚨 The NIST 800-53 mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
cti cyber-threat-intelligence mitre-attack cybersecurity nist800-53 security-controls ctid threat-informed-defense risk-management
Language:Python 497
OpenCTI-Platform / connectors
OpenCTI Connectors
cybersecurity cti threat-intelligence misp mitre-attack
Language:Python 485
mdecrevoisier / SIGMA-detection-rules
Set of SIGMA rules (>350) mapped to MITRE ATT&CK tactic and techniques
sigma windows mitre-attack threat-hunting powershell
392
center-for-threat-informed-defense / security-stack-mappings
🚨ATTENTION🚨 The Security Stack Mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
mitre-attack cloud aws azure security gcp
Language:Python 389

mitre-attack

redcanaryco / atomic-red-team

kubescape / kubescape

A-poc / RedTeam-Tools

mitre / caldera

olafhartong / sysmon-modular

sbousseaden / EVTX-ATTACK-SAMPLES

mikeroyal / Digital-Forensics-Guide

mitre-attack / attack-navigator

DataDog / stratus-red-team

Shuffle / Shuffle

walidshaari / Certified-Kubernetes-Security-Specialist

center-for-threat-informed-defense / adversary_emulation_library

cyb3rxp / awesome-soc

austinsonger / Incident-Playbook

ION28 / BLUESPAWN

olafhartong / ThreatHunting

netevert / sentinel-attack

nshalabi / ATTACK-Tools

mikeroyal / Open-Source-Security-Guide

atc-project / atomic-threat-coverage

DataDog / KubeHound

bfuzzy / auditd-attack

ion-storm / sysmon-config

SlimKQL / Hunting-Queries-Detection-Rules

center-for-threat-informed-defense / attack-flow

atc-project / atc-react

mitre-attack / mitreattack-python

mdecrevoisier / EVTX-to-MITRE-Attack

mitre-attack / attack-scripts

mitre-attack / attack-website

center-for-threat-informed-defense / tram

turbot / tailpipe

center-for-threat-informed-defense / attack-control-framework-mappings

OpenCTI-Platform / connectors

mdecrevoisier / SIGMA-detection-rules

center-for-threat-informed-defense / security-stack-mappings