GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → hrbrmstr → attckr

hrbrmstr / attckr

Licence: Apache-2.0 License
⚔️MITRE ATT&CK Machinations in R

Programming Languages

r
7636 projects

Labels

cybersecurityrstatsthreat-intelligencemitre-attack

Projects that are alternatives of or similar to attckr

cycat-service
CyCAT.org API back-end server including crawlers
Stars: ✭ 25 (+13.64%)
Mutual labels:  cybersecurity, threat-intelligence, mitre-attack
connectors
OpenCTI connectors
Stars: ✭ 135 (+513.64%)
Mutual labels:  cybersecurity, threat-intelligence, mitre-attack
ThePhish
ThePhish: an automated phishing email analysis tool
Stars: ✭ 676 (+2972.73%)
Mutual labels:  cybersecurity, threat-intelligence
attack to veris
The principal objectives and outputs of this project are the creation and dissemination of an extension to the VERIS schema incorporating ATT&CK mappings and associated usage documentation.
Stars: ✭ 56 (+154.55%)
Mutual labels:  cybersecurity, mitre-attack
censys-recon-ng
recon-ng modules for Censys
Stars: ✭ 29 (+31.82%)
Mutual labels:  cybersecurity, threat-intelligence
Caldera
Automated Adversary Emulation Platform
Stars: ✭ 3,126 (+14109.09%)
Mutual labels:  cybersecurity, mitre-attack
Attack Website
MITRE ATT&CK Website
Stars: ✭ 231 (+950%)
Mutual labels:  cybersecurity, mitre-attack
MurMurHash
This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform.
Stars: ✭ 79 (+259.09%)
Mutual labels:  cybersecurity, threat-intelligence
Chatter
internet monitoring osint telegram bot for windows
Stars: ✭ 123 (+459.09%)
Mutual labels:  cybersecurity, threat-intelligence
client-python
OpenCTI Python Client
Stars: ✭ 45 (+104.55%)
Mutual labels:  cybersecurity, threat-intelligence
mitrecnd.github.io
MITRE Shield website
Stars: ✭ 17 (-22.73%)
Mutual labels:  cybersecurity, mitre-attack
AutonomousThreatSweep
Threat Hunting queries for various attacks
Stars: ✭ 70 (+218.18%)
Mutual labels:  cybersecurity, threat-intelligence
Osweep
Don't Just Search OSINT. Sweep It.
Stars: ✭ 225 (+922.73%)
Mutual labels:  cybersecurity, threat-intelligence
Opencti
Authors
Stars: ✭ 2,165 (+9740.91%)
Mutual labels:  cybersecurity, threat-intelligence
mitreattack-python
A python module for working with ATT&CK
Stars: ✭ 208 (+845.45%)
Mutual labels:  cybersecurity, mitre-attack
Misp Dashboard
A dashboard for a real-time overview of threat intelligence from MISP instances
Stars: ✭ 142 (+545.45%)
Mutual labels:  cybersecurity, threat-intelligence
Malware-Sample-Sources
Malware Sample Sources
Stars: ✭ 214 (+872.73%)
Mutual labels:  cybersecurity, threat-intelligence
Analyst Arsenal
A toolkit for Security Researchers
Stars: ✭ 112 (+409.09%)
Mutual labels:  cybersecurity, threat-intelligence
Attack Control Framework Mappings
Security control framework mappings to MITRE ATT&CK provide a critically important resource for organizations to assess their security control coverage against real-world threats and provide a bridge for integrating ATT&CK-based threat information into the risk management process.
Stars: ✭ 115 (+422.73%)
Mutual labels:  cybersecurity, mitre-attack
attack-evals
ATT&CK Evaluations website (DEPRECATED)
Stars: ✭ 57 (+159.09%)
Mutual labels:  cybersecurity, mitre-attack
View All Similar Projects ➔

Project Status: WIP – Initial development is in progress, but there has not yet been a stable, usable release suitable for the public. Signed by Signed commit % Linux build Status Coverage Status Minimal R Version License

attckr

Analyze Adversary Tactics and Techniques Using the MITRE ATT&CK CTI Corpus

Description

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. Tools are provided to analyze adversary tactics and techniques, build incident metrics, and identify high level program gaps using the MITRE ATT&CK CTI Corpus.

What’s Inside The Tin

The following functions are implemented:

  • attck_cdf_tactic: Product an ATT&CK Cumulative Distribution Function by Tactic
  • attck_map: Generate an ATT&CK heatmap
  • enterprise_attack: Enterprise Attack Taxonomy v2.0
  • fct_tactic: Make an ordered Tactics factor with optional better labelling
  • mobile_attack: Mobile Attack Taxonomy v2.0
  • pre_attack: Pre-Attack Taxonomy v2.0
  • read_events: Read in ATT&CK events from a file
  • tactics_f: Tactics factors (generally for sorting & pretty-printing)
  • theme_enhance_atkmap: Remove cruft from ATT&CK heatmaps
  • tidy_attack: Combined ATT&CK Matricies Tactics, Techniques and Technique detail
  • validate_tactics: Validate Tactics strings against MITRE authoritative source
  • validate_technique_ids: Validate Technique IDs
  • validate_techniques: Validate Techniques strings against MITRE authoritative source

The following datasets are included:

  • enterprise_attack: Enterprise Attack Taxonomy v2.0
  • mobile_attack: Mobile Attack Taxonomy v2.0
  • pre_attack: Pre-Attack Taxonomy v2.0
  • tactics_f: Tactics factors (generally for sorting & pretty-printing)
  • tidy_attack: Combined ATT&CK Matricies Tactics, Techniques and Technique detail

Installation

install.packages("attckr", repos = "https://cinc.rud.is")
# or
remotes::install_git("https://git.rud.is/hrbrmstr/attckr.git")
# or
remotes::install_git("https://git.sr.ht/~hrbrmstr/attckr")
# or
remotes::install_gitlab("hrbrmstr/attckr")
# or
remotes::install_bitbucket("hrbrmstr/attckr")
# or
remotes::install_github("hrbrmstr/attckr")

NOTE: To use the ‘remotes’ install options you will need to have the {remotes} package installed.

Usage

library(attckr)
library(hrbrthemes)
library(tidyverse)

# current version
packageVersion("attckr")
## [1] '0.2.0'
tidy_attack
## # A tibble: 795 x 5
##    technique          description                                                        id      matrix    tactic       
##    <chr>              <chr>                                                              <chr>   <chr>     <chr>        
##  1 .bash_profile and… "<code>~/.bash_profile</code> and <code>~/.bashrc</code> are shel… T1156   mitre-at… persistence  
##  2 Access Token Mani… "Windows uses access tokens to determine the ownership of a runni… T1134   mitre-at… defense-evas…
##  3 Access Token Mani… "Windows uses access tokens to determine the ownership of a runni… T1134   mitre-at… privilege-es…
##  4 Access Token Mani… "Windows uses access tokens to determine the ownership of a runni… CAPEC-… mitre-at… defense-evas…
##  5 Access Token Mani… "Windows uses access tokens to determine the ownership of a runni… CAPEC-… mitre-at… privilege-es…
##  6 Accessibility Fea… "Windows contains accessibility features that may be launched wit… T1015   mitre-at… persistence  
##  7 Accessibility Fea… "Windows contains accessibility features that may be launched wit… T1015   mitre-at… privilege-es…
##  8 Accessibility Fea… "Windows contains accessibility features that may be launched wit… CAPEC-… mitre-at… persistence  
##  9 Accessibility Fea… "Windows contains accessibility features that may be launched wit… CAPEC-… mitre-at… privilege-es…
## 10 Account Access Re… "Adversaries may interrupt availability of system and network res… T1531   mitre-at… impact       
## # … with 785 more rows
events <- read_events(system.file("extdat/sample-incidents.csv.gz", package = "attckr"))
## Parsed with column specification:
## cols(
##   event_id = col_character(),
##   incident_id = col_character(),
##   event_ts = col_date(format = ""),
##   detection_ts = col_date(format = ""),
##   tactic = col_character(),
##   technique = col_character(),
##   discovery_source = col_character(),
##   reporting_source = col_character(),
##   responder_id = col_character()
## )
## You appear to be using Tactic ids.
## You appear to be using Techinque ids.

attck_map(
  events, "pretty", "nl", "enterprise",
  dark_value_threshold = 1,
  size = 3, family = font_rc, lineheight = 0.875
) +
  scale_fill_distiller(
    palette = "Spectral", na.value = "white", label = scales::comma, breaks = 1:3
  ) +
  labs(x = NULL, y = NULL, fill = NULL) +
  theme_ipsum_rc(grid="") +
  theme(axis.text.y = element_blank())

attckr Metrics

Lang # Files (%) LoC (%) Blank lines (%) # Lines (%)
R 13 0.93 304 0.93 72 0.78 180 0.84
Rmd 1 0.07 24 0.07 20 0.22 34 0.16

Code of Conduct

Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].