This repository is a community-driven research project that maintains structured telemetry coverage matrices for major EDR (Endpoint Detection and Response) products across Windows, Linux, and macOS. It currently tracks 25+ vendors with approximately 100 telemetry sub-categories mapped to MITRE ATT&CK data sources. The primary data artifacts are three JSON files (EDR_telem_windows.json, EDR_telem_linux.json, EDR_telem_macOS.json) that are manually curated through pull requests, each with evidence requirements. The project provides a scoring system that computes weighted vendor scores based on coverage, an automated statistics pipeline that generates historical change events, vendor score timeseries, and contributor summaries, and platform-specific telemetry generators that produce test events for validation purposes. While the core asset is the curated dataset, the repository also contains reusable software components including a modular scoring model, a diff engine for snapshot comparison, and a PR evidence classifier. The project has a substantial community with nearly 2000 stars, active issue triage, and continuous updates through GitHub Actions workflows that regenerate statistics and synchronize data to a Supabase database.
CHAPS (Configuration Hardening Assessment PowerShell Scripts) is a security assessment toolkit designed for Windows systems where additional assessment software cannot be installed. It consists of three script variants (PowerShell v3+, PowerShell v2, and CMD batch) that perform 63 security checks across System Info, Security, Authentication, Network, PowerShell, and Logging categories. All scripts output results in Markdown format to stdout. The companion analysis tool (chaps-analyze.ps1) processes these reports to produce structured findings with recommendations, risk explanations, and MITRE ATT&CK mappings using a JSON knowledge base. The toolkit is specifically designed for ICS/OT environments, air-gapped systems, and locked-down Windows installations where traditional security assessment tools cannot be deployed.
This repository is a community-driven threat hunting and detection engineering knowledge base rather than a deployable application. It contains 26+ Windows-focused Jupyter notebooks (authored as Jupytext Markdown) that each follow a strict hypothesis-driven methodology: hypothesis, technical context, offensive tradecraft, pre-recorded security datasets, SQL/Pandas analytics, and Sigma rule output. The repo also includes deep Windows internals documentation, MITRE ATT&CK group profiles (CTI), pre-hunt data management guidance, and a small YARA signature set. The dominant character is data_research: the core artifacts are analytical notebooks, structured metadata, and threat intelligence data, with a hybrid component of Python build scripts that generate the Jupyter Book, table of contents, ATT&CK Navigator layers, and evaluation reports.
KubeHound is a security analysis tool for Kubernetes clusters that automatically models and computes attack paths. It collects Kubernetes resources (pods, roles, bindings, endpoints, nodes) via a live API or offline dump, transforms them into a property graph stored in JanusGraph (with MongoDB as an intermediate store), and computes privilege escalation and lateral movement paths mapped to MITRE ATT&CK techniques. The system exposes a CLI for local analysis and a gRPC API (KHaaS) for service-oriented deployments, with optional Jupyter notebooks for querying the graph using a custom Gremlin DSL. The architecture is modular: a collector abstraction handles rate-limited streaming from the Kubernetes API; an ingestion pipeline converts raw objects into normalized store models and graph vertices/edges; an edge registry defines over 20 attack types (e.g., PodExec, TokenSteal, ContainerEscape); and a graph builder executes Gremlin traversals to connect vertices into paths. Storage layers use asynchronous writers with micro-batching for high throughput, and an in-memory cache deduplicates identities and roles. Telemetry (Datadog APM, metrics, logs) is integrated throughout. While primarily an application, the repository includes experimental research components (exp/khaudit) for audit reports and MITRE Attack Flow conversion, plus Jupyter notebooks for interactive graph queries, giving it a hybrid character. The codebase demonstrates strong engineering practices: provider interfaces, test mocking, worker pools, retry logic, and comprehensive system tests against real Kind clusters. However, some areas (large cluster optimizations, experimental code, deprecated flags) indicate ongoing evolution and minor technical debt.
This repository provides a collection of 52 specialized AI agent definitions for penetration testing and red team operations, designed to be used with Claude Code. It is distributed as a Claude Code plugin, with an interactive installer (install.sh), a SQLite findings database (db/findings.sh) for persisting engagement data, and a versioned migration system. The agents are defined as Markdown files with YAML frontmatter, each containing structured system prompts that enforce scope validation, OPSEC tagging, evidence handling, and MITRE ATT&CK mapping. The system includes a swarm orchestrator for multi-agent coordination, a scope guard for safety, and a two-tier safety model (advisory vs. Bash-capable agents). While primarily a configuration/instruction set rather than a traditional software application, it demonstrates strong engineering practices in prompt architecture, database schema design, and distribution automation. The repository is actively maintained with CI validation, shellcheck, and unit tests for the database scripts.
This repository is a curated list of over 150 red teaming tools and resources, organized by MITRE ATT&CK categories (Reconnaissance, Resource Development, Initial Access, etc.). It contains no original source code; instead, it provides descriptions, installation instructions, usage examples, and links to external tools. The README is the sole deliverable, serving as a comprehensive reference for red team operators. While not a software application itself, it functions as a catalog of applications. The backlog file contains a few additional URLs and notes for future additions. The repository is well-maintained with active issue triage and recent commits, but its value lies in curation rather than code craftsmanship.