GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → sbousseaden → Evtx Attack Samples

sbousseaden / Evtx Attack Samples

Licence: gpl-3.0
Windows Events Attack Samples

Programming Languages

powershell
5483 projects

Labels

datasetdfirthreat-huntingmitre-attack

Projects that are alternatives of or similar to Evtx Attack Samples

Sysmon Modular
A repository of sysmon configuration modules
Stars: ✭ 1,229 (-1.13%)
Mutual labels:  dfir, threat-hunting, mitre-attack
Attackdatamap
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
Stars: ✭ 264 (-78.76%)
Mutual labels:  dfir, threat-hunting, mitre-attack
Threathunting
A Splunk app mapped to MITRE ATT&CK to guide your threat hunts
Stars: ✭ 738 (-40.63%)
Mutual labels:  dfir, threat-hunting, mitre-attack
rhq
Recon Hunt Queries
Stars: ✭ 66 (-94.69%)
Mutual labels:  dfir, threat-hunting, mitre-attack
fastfinder
Incident Response - Fast suspicious file finder
Stars: ✭ 116 (-90.67%)
Mutual labels:  dfir, threat-hunting
ir scripts
incident response scripts
Stars: ✭ 17 (-98.63%)
Mutual labels:  dfir, threat-hunting
Threatpinchlookup
Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension
Stars: ✭ 257 (-79.32%)
Mutual labels:  dfir, threat-hunting
Detectionlabelk
DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
Stars: ✭ 273 (-78.04%)
Mutual labels:  dfir, threat-hunting
Threatingestor
Extract and aggregate threat intelligence.
Stars: ✭ 439 (-64.68%)
Mutual labels:  dfir, threat-hunting
Auditd Attack
A Linux Auditd rule set mapped to MITRE's Attack Framework
Stars: ✭ 642 (-48.35%)
Mutual labels:  threat-hunting, mitre-attack
Bluespawn
An Active Defense and EDR software to empower Blue Teams
Stars: ✭ 737 (-40.71%)
Mutual labels:  threat-hunting, mitre-attack
Signature Base
Signature base for my scanner tools
Stars: ✭ 1,212 (-2.49%)
Mutual labels:  dfir, threat-hunting
S2AN
S2AN - Mapper of Sigma/Suricata Rules/Signatures ➡️ MITRE ATT&CK Navigator
Stars: ✭ 70 (-94.37%)
Mutual labels:  threat-hunting, mitre-attack
MindMaps
#ThreatHunting #DFIR #Malware #Detection Mind Maps
Stars: ✭ 224 (-81.98%)
Mutual labels:  dfir, threat-hunting
SIGMA-detection-rules
Set of SIGMA rules (>250) mapped to MITRE Att@k tactic and techniques
Stars: ✭ 97 (-92.2%)
Mutual labels:  threat-hunting, mitre-attack
TA-Sysmon-deploy
Deploy and maintain Symon through the Splunk Deployment Sever
Stars: ✭ 31 (-97.51%)
Mutual labels:  dfir, threat-hunting
Atc React
A knowledge base of actionable Incident Response techniques
Stars: ✭ 226 (-81.82%)
Mutual labels:  dfir, mitre-attack
Threathunter Playbook
A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.
Stars: ✭ 2,879 (+131.62%)
Mutual labels:  dfir, threat-hunting
Sentinel Attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
Stars: ✭ 676 (-45.62%)
Mutual labels:  threat-hunting, mitre-attack
Beagle
Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
Stars: ✭ 976 (-21.48%)
Mutual labels:  dfir, threat-hunting
View All Similar Projects ➔

Windows EVTX Samples [200 EVTX examples]:

alt text

This is a container for windows events samples associated to specific attack and post-exploitation techniques. Can be useful for:

  • Testing your detection scripts based on EVTX parsing

  • Training on DFIR and threat hunting using event logs

  • Designing detection use cases using Windows and Sysmon event logs

  • Avoid/Bypass the noisy techniques if you are a redteamer

N.B: Mapping has been done to the level of ATT&CK technique (not procedure).

Details of the EVTX content mapped to MITRE tactics can be found here, stats summary:

alt text

alt text

Overview of the covered TTPs using attack-navigator:

alt text

Winlogbeat-Bulk-Read

Included is a PowerShell script that can loop through, parse, and replay evtx files with winlogbeat. This can be useful to replay logs into an ELK stack or to a local file. By default this script will output logs to .\winlogbeat\events.json as configured in the winlogbeat_example.yml file, you can configure any of your own destinations in winlogbeat.yml (excluded from git) and the example config file will be ignored if winlogbeat.yml is found.

Winlogbeat-Bulk-Read Usage:

## Display help along with examples:
.\Winlogbeat-Bulk-Read.ps1 -Help

## Run with defaults (read ./ recursively and look for winlogbeat.exe in your path):
.\Winlogbeat-Bulk-Read.ps1

## If you want to point this script at another directory with evtx files and specify a path to the winlogbeat.exe binary:
.\Winlogbeat-Bulk-Read.ps1 -Exe ~\Downloads\winlogbeat\winlogbeat.exe -Source "..\EVTX-ATTACK-SAMPLES\"

License:

EVTX_ATT&CK's GNU General Public License

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].