A public repository of quality research on cyber attack techniques. This is the backend for the Technique Research Report (TRR) Library.
☆33Sep 1, 2026Updated last month
Alternatives and similar repositories for techniques
Users that are interested in techniques are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Utility for ClickOnce usage for Red Teams.☆15Jun 11, 2026Updated 4 months ago
- ☆28Updated this week
- Adversarial Detection Engineering knowledge base — ADE taxonomy, worked technique files, platform bug patterns, mitigations, and purple-t…☆84Sep 30, 2026Updated 3 weeks ago
- Detection engineering template☆15Jul 24, 2025Updated last year
- how to strangle threats☆69Updated this week
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Public research documentation, methodology, and STIX examples for TI Mindmap HUB - an AI-powered Cyber Threat Intelligence platform☆20Updated this week
- A framework for developing alerting and detection strategies for incident response.☆10Mar 26, 2024Updated 2 years ago
- Best Practices, queries, and packages for CQL the language of CrowdStrike's LogScale (Humio) log manager.☆14May 7, 2026Updated 5 months ago
- Community-driven PowerShell detection indicators☆46Jan 27, 2026Updated 8 months ago
- A Model Context Protocol (MCP) server that provides tools for working with the MITRE ATT&CK framework using the mitreattack-python librar…☆15Oct 9, 2026Updated 2 weeks ago
- Threat Hunting queries of multiple platforms☆86Updated this week
- Threat feeds designed to extract adversarial TTPs and IOCs, using: ✨AI✨☆75Jun 17, 2026Updated 4 months ago
- CTI resources for Claude, maintained by Feedly☆36Updated this week
- A security research tool for enabling Chrome DevTools Protocol (CDP) debugging on Microsoft Edge browser processes at runtime.☆26Jan 2, 2026Updated 9 months ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- DetectPack Forge turns plain-English behaviors or sample logs into production-ready detection packs — Sigma, KQL (Sentinel), SPL (Splunk)…☆24Mar 19, 2026Updated 7 months ago
- ☆91Sep 25, 2026Updated last month
- Stupid Simple Detection Testing☆13Mar 7, 2024Updated 2 years ago
- Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research…☆70Sep 29, 2026Updated 3 weeks ago
- MCP server for .NET reverse engineering automation☆27Apr 10, 2026Updated 6 months ago
- A threat hunting process☆146Oct 2, 2026Updated 3 weeks ago
- ☆16Aug 27, 2026Updated last month
- Detection engineering with durable memory, a five-stage lifecycle, and an agentic surface — the sibling of ATHF.☆33Oct 14, 2026Updated last week
- A PowerShell module for the M365 admin center☆25Jun 23, 2026Updated 4 months ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Sysmon configuration file templates with advanced event tracing and blocking☆72Updated this week
- Public repository of Sigma and YARA rules created by Synacktiv☆21Oct 15, 2025Updated last year
- Datasets from the Sophos Active Adversary Report☆14Feb 24, 2026Updated 8 months ago
- Convert Sigma rules to SIEM queries, directly in your browser.☆124Oct 18, 2026Updated last week
- RE for champions☆18Sep 22, 2026Updated last month
- A curated collection of small, practical Identity Engineering Artifacts (I.D.E.A.) for Entra and identity security. Each artifact is a se…☆38Updated this week
- The Kerberoasting / AD password-audit wordlist I use on engagements: priority-merged HashMob large list + The-Viper-One's kerberoast_pws,…☆16Oct 2, 2026Updated 3 weeks ago
- This project provides a set of Google Apps Scripts designed to help you identify and analyze potentially malicious domains directly from …☆14Sep 4, 2024Updated 2 years ago
- Slides of my public talks☆65Feb 20, 2026Updated 8 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Project to Support The Hunter's Framework (THF)☆11Apr 16, 2024Updated 2 years ago
- CQL Hub is an open repository of detection and hunting queries for CrowdStrike NextGen SIEM and Falcon LogScale. All queries stored here …☆86Updated this week
- Microsoft Sentinel SIEM Log Source Analyzer☆31Updated this week
- Open source tooling to stop ICS phishing (malicious calendar invites)☆20Feb 24, 2026Updated 8 months ago
- ☆17Jul 23, 2024Updated 2 years ago
- NoDelete is a tool that assists in malware analysis by locking a folder where malware drops files before deleting them.☆49Nov 17, 2025Updated 11 months ago
- A community-driven repository for threat hunting ideas, methodologies, and research that serves as a central gathering place for hunters …☆357Updated this week