Projects sharing features with SSVC

A tool matrix for Russian APTs based on the Ransomware Tool Matrix

This project is a detection-as-code framework providing a library of security monitoring rules and predefined detection content for Elasticsearch data indices. It serves as a threat detection rule library designed to identify malicious activity and attack patterns across diverse data streams in cloud and on-premises environments. The framework implements a detection engineering workflow where rules are defined in YAML and managed as versioned code. It includes a set of command-line utilities for automated rule deployment, metadata searching, and template generation, supported by a Python-base

Community Sigma Rules written by Joe Security for threat hunting in sandboxes, licensed under GPL. For a detailed description about our Sigma rules for Sandboxes please have a look at this Blog Post.

A curated collection of C2 frameworks that leverage legitimate services to evade detection.

LOLESXi is a curated list of living off the land behaviours observed via public reporting.

Welcome to LOLRMM (Living Off the Land Remote Monitoring and Management), a community-driven project that provides a curated list of Remote Monitoring and Management (RMM) tools that could potentially be abused by threat actors. Our mission is to assist security professionals in staying informed…

SIGMA detection rules provides a free set of >350 advanced correlation rules to be used for suspicious hunting activities.

GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.

All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io (thanks @ConsciousHacker for this bit of eyecandy and the team over at https://gtfobins.github.io/). This repo serves as a place where we maintain the YML files that are used by the fancy frontend.

Generic Signature Format for SIEM Systems

Sigma-Rule-Repository is a collection of detection rules in Sigma Format. In contrast to other Sigma repositories, this repository contains for every detection rule a testing documentation. The detection rules are sorted based on the Mitre ATT&CK Techniques.

Latest version: 2.2.0

Atomic Red Team is an adversary simulation tool and detection validation suite designed to emulate attacker behaviors. It functions as a security control testing framework that uses a library of portable tests to verify if security monitoring and alerting systems correctly identify specific malicious techniques. The project serves as a MITRE ATT&CK emulation framework, mapping individual test executions to a standardized industry taxonomy of adversary behaviors. This mapping allows for the validation of security controls against the MITRE ATT&CK matrix to identify gaps in detection and respon

Rules generated from our public reports are now directly contributed to the SigmaHQ project.

Graphical map of known Advanced Persistent Threats

This project aims to compare and evaluate the telemetry of various EDR products.

``` ██ ██ ██████ ██ ██ ██ ██ ██ ██ █████ ██ ██ ██ ██ ██ ██ ▄▄ ██ ██ ██ ██ ██████ ███████ ▀▀