threatest
datadog/threatestCLI and Go framework for end-to-end testing of threat detection rules. Detonates attack techniques and verifies alerts in security platforms like…
defensive-toolspenetration-testingred-teaming
datadog/threatestCLI and Go framework for end-to-end testing of threat detection rules. Detonates attack techniques and verifies alerts in security platforms like…
sumidcyber/zeroscout🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…
optiv/dentA framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors.
mcastens/alycon-threat-landscapeTraining-free anomaly detection framework using Shannon Entropy, Fisher Information, and Wasserstein Distance to map system states into geometrically…
adversarial-detection-engineering/adversarial-detection-engineering-frameworkA framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concrete examples…
cea-sec/usbsasTool and framework for securely reading untrusted USB mass storage devices.
ropfuscator/ropfuscatorROPfuscator is a fine-grained code obfuscation framework for C/C++ programs using ROP (return-oriented programming).
datadog/hashYAML-configurable low-interactive honeypot framework for deploying HTTP/HTTPS-based deception servers with built-in honeytraps and Datadog log…
s0lst1c3/dropengineDropEngine provides a malleable framework for creating shellcode runners, allowing operators to choose from a selection of components and combine…
telefonica/uac-a-molaModular framework for Windows UAC bypass attacks and mitigation, featuring DLL hijacking, fileless execution, and real-time monitoring to detect and…
poshsec/poshsecframeworkA framework for PowerShell and PoshSec scripts for network management, security, and maintenance.
trappsec-dev/trappsecOpen-source framework for embedding realistic decoy routes and honey fields into APIs to detect attackers probing business logic, converting…
mahdi13830510/cve-2026-31431-mitigation-suiteKernel-runtime defense framework for AF_ALG vulnerabilities, featuring eBPF socket tracing, Ansible hardening, and a crypto auditor for drift…
opposum0112/cusimanseComposable research-contract and YAML-recipe framework for agent-operated security experiments on disposable compute
didi/kemonAn Open-Source Pre and Post Callback-Based Framework for macOS Kernel Monitoring.
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
m-mizutani/alertresponderAutomatic security alert response framework by AWS Serverless Application Model
alex66366/odpureBlack-box input-stage purification defense that neutralizes backdoor attacks on object detectors via corruption, diffusion reconstruction, and DBSCAN…