A curated knowledge base to build, run and mature a SOC (including CSIRT).

architecture incident-response dfir cybersecurity cert csirt threat-hunting siem tip soc risk-management ttp soar sirp mitre-attack purpleteam threat-detection security-monitoring detection-engineering

• Updated Nov 2, 2026

A web application that assists network defenders, analysts, and researchers in the process of mapping adversary behaviors to the MITRE ATT&CK® framework.

cybersecurity ttp

• Updated Feb 20, 2026
• HTML

This repository contains cutting-edge open-source security notes and tools that will help you during your Red Team assessments.

playbook penetration-testing offensive-security ttp redteam offensive-methodology

• Updated Jul 6, 2026
• PowerShell

MAAD Attack Framework - An attack tool for simple, fast & effective security testing of M365 & Entra ID (Azure AD).

microsoft security powershell mitre red-team microsoft-graph ttp cloud-security security-testing cloud-administration azuread adversary-emulation microsoft365 identity-access-management microsoft-azure-security entra-id

• Updated Jan 13, 2026
• PowerShell

Repository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving to other types of threats.

malware ransomware threat-intelligence ttp mitre-attack ransomware-group threat-acto

• Updated Jan 29, 2026

Halberd : Multi-Cloud Agentic Attack Tool

microsoft aws azure gcp offensive-security security-tools ttp cloud-security security-testing azuread redteam mitre-attack m365 redteam-tools blueteam-tools entra-id

• Updated Apr 8, 2026
• Python

Generate MITRE ATT&CK and D3FEND from a list of CVEs. Database with CVE, CWE, CAPEC, MITRE ATT&CK D3FEND and ATLAS Techniques data is updated daily. Showcased at BlackHat Europe 2025 Arsenal.

blackhat cybersecurity infosec cve cwe capec ttp mitre-attack-db mitre-attack cves infosectools mitre-attack-navigator d3fend mitre-d3fend mitre-cwe mitre-capec mitre-defend blackhat-arsenal blackhateurope-2025

• Updated Nov 12, 2026
• Python

This repository contains indicators of compromise (IOCs) of our various investigations.

ioc apt malware cybersecurity ransomware threat-hunting malware-research threatintel threat-intelligence ttp malware-detection threatintelligence indicator-of-compromise

• Updated Nov 4, 2025
• Python

A collection of intelligence about Log4Shell and its exploitation activity.

java ioc log4j mirai cybersecurity threatintel cti log4j2 cobalt-strike ttp threatintelligence cve-2021-44228 log4shell kinsing m8220 swrort muhstik khonsari kirabash sitesloader

• Updated Mar 4, 2022
• Python

A python app to predict Att&ck tactics and techniques from cyber threat reports

attack multi-label-classification ttp cyber-threat-intelligence

• Updated Nov 15, 2023
• Python

Python script for periodically fetching appointment dates from the Trusted Traveler Program API for Global Entry, Nexus, SENTRI, and FAST, with notifications to the user when new appointments are discovered.

python docker fast nexus global entry cbp program traveler ttp global-entry globalentry trusted sentri trusted-traveler-program trusted-traveler

• Updated Oct 19, 2026
• Python

Adversary emulation for EDR/SIEM testing (macOS/Linux)

security ioc benchmark ids intrusion ttp edr

• Updated Jun 8, 2026
• Go

PoC showcasing new DarkGate Install Script retrieval technique via DNS TXT Record

dns reverse-engineering malware cybersecurity poc infosec threat-hunting malware-analysis threatintel malware-development threat-intelligence ttp darkgate

• Updated Dec 15, 2023

TTP Parser kit for SROS devices.

nokia ttp sros 7750

• Updated Oct 10, 2023
• Python

TTP template for Cisco IOS "show run"

ios cisco netmiko cisco-device devnet ttp cisco-ios netpalm netmiko-ios

• Updated Aug 9, 2022
• Python

This central repository is crafted for cybersecurity enthusiasts, researchers, and professionals aiming to advance their skills. It offers valuable resources for those focused on analyzing and understanding different types of malware.

malware malware-analysis offensive-security ttp mitre-attack

• Updated Jun 10, 2026
• HTML

A collection of commands, tools, techniques and procedures of the purplestorm ctf team.

pentesting ctf offensive-security red-team ttp purplestorm

• Updated Mar 20, 2025
• Shell

Open threat actor dataset: APT groups, ransomware groups, malware and MITRE ATT&CK techniques with aliases, TTPs and sources. JSON, CSV, STIX 2.1.

json osint apt malware open-data dataset cybersecurity ransomware infosec threat-hunting threatintel cti threat-actors threat-intelligence ttp mitre-attack cyber-threat-intelligence stix2 apt-groups ransomware-groups

• Updated Oct 28, 2026

Wiki to collect Red Team infrastructure hardening resources

dns scala resource wiki https red domain phishing domain-fronting resources tactics smtp team smtpclient red-team phishing-attacks c2 phish ttp command-and-control

• Updated Jun 18, 2018

Official Black Hat Arsenal Security Tools Repository

list tools defcon hat black ttp arsenal black-hat

• Updated Jan 4, 2018