Evaluating Security Tools

• sliver

  20 7,551 9.6 Go

  Adversary Emulation Framework

  

For the additional more advanced steps I used sliver as a c2. Sliver is an excellent tool for the job and unlike some other tools, it's FOSS! You can easily replace sliver with your tool of choice, however.

• atomic-red-team

  32 9,020 9.8 C

  Small and highly portable detection tests based on MITRE's ATT&CK.

  

This is just a single possible test setup that you can use for testing and evaluating a security tool or a set of security tools. It is not by any means an exhaustive test, if anything it's extremely basic. But if you try it with your security tools I bet you'll be amazed at what is and isn't caught and you'll learn something valuable. There are some great resources out there for finding different methods to use with different platforms and threat scenarios. One of my favorites is Atomic Red Team.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• attack-stix-data

  58 280 4.8 Python

  STIX data representing MITRE ATT&CK

  

Regardless of the method in which the tool is designed to work, it should create alerts that can be mapped to techniques and tactics the MITRE ATT&CK framework. If you're not familiar with the ATT&CK framework, you should pause here and read the excellent ATT&CK 101 blog post here

Suggest a related project