awesome-mitre-attack

A curated list of awesome resources related to Mitre ATT&CK™ Framework
https://github.com/infosecn1nja/awesome-mitre-attack

Last synced: 2 days ago
JSON representation

Red and Purple Team
- Tools
  - PoshC2 - PoshC2 is a proxy aware C2 framework that utilises Powershell and/or equivalent (System.Management.Automation.dll) to aid penetration testers with red teaming, post-exploitation and lateral movement.
  - PowerSploit - Collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment.
  - Mordor - The Mordor project provides pre-recorded security events generated by simulated adversarial techniques in the form of JavaScript Object Notation (JSON) files for easy consumption.
  - Purple Team ATT&CK Automation - Praetorian's public release of our Metasploit automation of MITRE ATT&CK™ TTPs
  - MITRE CALDERA - CALDERA is an automated adversary emulation system, built on the MITRE ATT&CK™ framework.
  - Empire - Post-exploitation framework that includes a pure-PowerShell2.0 Windows agent, and a pure Python 2.6/2.7 Linux/OS X agent.
  - Invoke-PSImage - Invoke-PSImage takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image.
  - RE:TERNAL - RE:TERNAL is a centralised purple team simulation platform. Reternal uses agents installed on a simulation network to execute various known red-teaming techniques in order to test blue-teaming capabilities.
  - VECTR - VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
  - Atomic Red Team - Small and highly portable detection tests based on MITRE's ATT&CK.
  - Metta - An information security preparedness tool to do adversarial simulation.
  - Red Team Automation (RTA) - RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
  - Cobalt Strike - Software for Adversary Simulations and Red Team Operations
- Resources
Threat Hunting
- Resources
  - DeTTACT - DeTT&CT aims to assist blue teams using ATT&CK to score and compare data log source quality, visibility coverage, detection coverage and threat actor behaviours.
  - Sigma - Generic Signature Format for SIEM Systems
  - Quantify Your Hunt: Not Your Parent’s Red Teaming Redux
  - MITRE ATT&CK Windows Logging Cheat Sheets
  - osquery-attck - Mapping the MITRE ATT&CK Matrix with Osquery
  - ATTACKdatamap - A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
  - Splunk Mitre ATT&CK App - A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
  - HELK - A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.
  - atomic-threat-coverage - Automatically generated actionable analytics designed to combat threats based on MITRE's ATT&CK.
  - Wayfinder - Artificial Intelligence Agent to extract threat intelligence TTPs from feeds of malicious and benign event sources and automate threat hunting activities.
  - pyattck - A python package to interact with the Mitre ATT&CK Framework. You can find documentation [here](https://pyattck.readthedocs.io/en/latest/)
  - MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, SpecterOps and Jose Luis Rodriguez, Student
  - Testing the Top MITRE ATT&CK Techniques: PowerShell, Scripting, Regsvr32
  - Ten Ways Zeek Can Help You Detect the TTPs of MITRE ATT&CK
  - SEC1244 - Cops and Robbers: Simulating the Adversary to Test Your Splunk Security Analytics
  - Post-Exploitation Hunting with ATT&CK & Elastic
  - How MITRE ATT&CK helps security operations
  - MITRE Cyber Analytics Repository
  - Defensive Gap Assessment with MITRE ATT&CK
  - Finding Related ATT&CK Techniques
  - Getting Started with ATT&CK: Detection and Analytics
  - 2019 Threat Detection Report
  - A Process is No One : Hunting for Token Manipulation
  - auditd-attack - A Linux Auditd rule set mapped to MITRE's Attack Framework
  - CyberMenace - A one stop shop hunting app in Splunk that can ingest Zeek, Suricata, Sysmon, and Windows event data to find malicious indicators of compromise relating to the MITRE ATT&CK Matrix.
  - Mapping your Blue Team to MITRE ATT&CK™
  - ThreatHunter-Playbook
  - A Process is No One : Hunting for Token Manipulation
  - Prioritizing the Remediation of Mitre ATT&CK Framework Gaps
  - Ten Ways Zeek Can Help You Detect the TTPs of MITRE ATT&CK
Threat Intelligence
- Resources
- Tools
  - cti - Cyber Threat Intelligence Repository expressed in STIX 2.0
  - TALR - A public repository for the collection and sharing of detection rules in STIX format.
Community
- Tools
  - EU ATT&CK Community
  - MITRE ATT&CKcon 2018

Programming Languages

Python 7 PowerShell 3 Shell 1 Jupyter Notebook 1 C 1 Ruby 1

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

awesome-mitre-attack

Red and Purple Team

Tools

Resources

Threat Hunting

Resources

Threat Intelligence

Resources

Tools

Community

Tools