Results for “mitre-attack-ics”

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization.

Map MITRE ATT&CK coverage to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.

Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines.

Query MITRE ATT&CK data programmatically, map APT group TTPs to Navigator layers, create multi-layer overlays for gap analysis, and generate actionable intelligence reports for detection engineering teams.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Map adversary TTPs against organizational assets using the MITRE ATT&CK framework, assess detection coverage gaps, and prioritize defensive investments.

Detects cyber attacks targeting SCADA systems, including man-in-the-middle, command injection, HMI compromise, historian manipulation, and DoS, using OT-specific intrusion detection and protocol anomaly analysis.

Reverse-engineers EDR, Defender, and AV hook tables, ETW providers, and AMSI implementations to build targeted bypasses including unhooking, indirect syscalls, ETW patching, and call stack spoofing for authorized red team operations.

Parse and analyze Cobalt Strike Malleable C2 profiles using dissect.cobaltstrike and pyMalleableC2 to extract C2 indicators, detect evasion techniques, and generate network detection signatures.

Triages and enriches indicators of compromise (IPs, domains, file hashes, URLs, email artifacts) from phishing emails, security alerts, or threat feeds, assigning confidence scores and dispositions using VirusTotal, AbuseIPDB, MalwareBazaar, and MISP.

Deploy and configure Tofino industrial firewalls to protect SCADA systems and PLCs using deep packet inspection for OT protocols including Modbus, EtherNet/IP, OPC, and S7comm, enforcing granular access control between ICS security zones.

Automates multi-source enrichment of IPs, domains, URLs, and file hashes using VirusTotal, AbuseIPDB, Shodan, GreyNoise, URLScan.io, and MISP to provide contextual risk scoring and disposition recommendations for SOC analysts.