A repository of sysmon configuration modules
-
Updated
Jul 13, 2026 - PowerShell
#
mitre-attack
Here are 53 public repositories matching this topic...
Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
graylog logging forensics dfir sysmon threat-hunting siem threat-sharing threatintel netsec sysinternals graylog-plugin forensic-analysis threat-analysis threat-intelligence humio mitre-attack sigma-rules forensicartifacts digitalforensics
-
Updated
Nov 5, 2023 - PowerShell
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
-
Updated
Nov 3, 2020 - PowerShell
Purpleteam scripts simulation & Detection - trigger events for SOC detections
windows linux security ioc awesome simulation detection tactics awesome-list threat-hunting siem soc techniques blueteam redteam mitre-attack purpleteam threathunting offensive-scripts detection-engineering
-
Updated
Dec 20, 2024 - PowerShell
Templates for the Microsoft Threat Modeling Tool
security attack fabric sdl cybersecurity threat-modeling mitre threat-model stride mitre-attack purview
-
Updated
May 7, 2026 - PowerShell
PowerShell-based Windows Server Security Audit Engine by Cyb3rint3l Labs. Measures alignment with the NIS2 directive and maps findings to MITRE ATT&CK tactics & CIS Controls v8 practices. Generates interactive HTML dashboards & structured JSON datasets.
cis security-audit automation powershell reporting sysadmin cybersecurity windows-server compliance hardening vulnerability-assessment mitre-attack nis2 audit-tool
-
Updated
Feb 1, 2026 - PowerShell
CTRL-ESC-HOST is an assessment methodology for testing for security flaws in Kiosks and Presented Applications.
-
Updated
Jul 1, 2026 - PowerShell
PowerShell Post-exploitation agent based on Mitre Att&ck framework
-
Updated
Feb 1, 2023 - PowerShell
Windows environment hunting at scale!
-
Updated
May 22, 2026 - PowerShell
STI ISE 5901 Whitepaper repository
-
Updated
Oct 1, 2021 - PowerShell
Applied SOC Analysis and Incident Response documentation covering endpoint forensics, network traffic analysis (PCAP), and detection engineering. Demonstrating analyst-level investigative methodology using Splunk, Wireshark, and Sysinternals.
log-analysis splunk powershell network-forensics incident-response cybersecurity wireshark siem malware-analysis digital-forensics sysinternals log-monitoring security-analysis mitre-attack security-monitoring endpoint-security security-operations detection-engineering soc-analyst
-
Updated
Jul 20, 2026 - PowerShell
Presentations
-
Updated
Feb 9, 2024 - PowerShell
CafeSec Lab - defensive research and tooling for internet cafe, gaming venue, and shared-PC security
security incident-response yara-rules internet-cafe integrity-monitoring security-research blue-team mitre-attack defensive-security threat-detection windows-security windows-hardening east-asia sigma-rules gaming-venue shared-pc managed-pcs hospitality-security
-
Updated
Jun 6, 2026 - PowerShell
GitHub Action for local execution of Atomic Red Team tests using Invoke-Atomic
-
Updated
Jan 4, 2025 - PowerShell
Small and highly portable detection tests based on MITRE's ATT&CK.
-
Updated
Aug 3, 2018 - PowerShell
Исследование тактики Initial Access (TA0001) из матрицы MITRE ATT&CK для Kubernetes
-
Updated
Jul 28, 2026 - PowerShell
Windows security auditing, event generation, and MITRE ATT&CK mapping toolkit for detection validation.
-
Updated
Jun 15, 2026 - PowerShell
Splunk-based home SOC lab for Windows and Linux log analysis, detection engineering, and security investigation workflows.
log-analysis splunk incident-response cybersecurity siem soc linux-security blue-team mitre-attack threat-detection security-monitoring windows-security home-lab detection-engineering soc-analyst
-
Updated
Apr 8, 2026 - PowerShell
Improve this page
Add a description, image, and links to the mitre-attack topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the mitre-attack topic, visit your repo's landing page and select "manage topics."