🧰 MITRE ATT&CK

The items that name it 49

• IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
  articleas tools2026-10-29It is written here as MITRE ATT&CK: framework used for the report appendix.
• MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
  articleas classification.technologies2026-10-19
• dbugs (@ptdbugs) on X
  toolas classification.technologies2026-10-15
• SMTP is the key: BPFDoor and AVERAT hitting the network edge
  writeupas classification.technologies2026-10-02
• The Fine Art of Frustrating the Adversary
  articleas tools2026-10-01

  Taxonomy of adversary techniques recommended as a foundation for building resilient behavioral detections.

• Adversarial-Detection-Engineering/adeskills
  repoas classification.technologies2026-09-27
• Threat Actors Abuse IronPython to Deliver CastleLoader/CastleRAT
  writeupas classification.technologies2026-09-17
• ThreatIntel-Aggregator
  repoas tools2026-09-17

  Technique tagging/heatmap coverage matrix for threat intel and detections

• Huntress: How Attackers Abuse VSS, and How Huntress Detects It
  articleas classification.technologies2026-09-15
• Socket: "JeetBot" Twitch Extension Steals 31,000 Users' OAuth Tokens
  writeupas classification.technologies2026-09-12
• Top GenAI security resources — September 2026
  articleas tools2026-09-09

  framework used to map the two adversary emulation scenarios (credential-based model invocation abuse and knowledge base poisoning)

• mukul975/cve-mcp-server
  repoas tools2026-09-07

  STIX mapping of techniques to CVEs

• Numbat
  repoas classification.technologies2026-09-05
• An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
  writeupas classification.technologies2026-09-02
• Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps
  articleas classification.technologies2026-08-27
• ThreatRadar
  repoas tools2026-08-27

  Enterprise threat technique and actor knowledge base used for IOC enrichment/mapping

• Cyberful
  repoas classification.technologies2026-08-25
• hunt.md
  repoas classification.technologies2026-08-17
• Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands
  writeupas classification.technologies2026-08-12
• Dark-Moon
  repoas classification.technologies2026-08-05
• Precogly
  repoas classification.technologies2026-08-05
• Bank of America Phishing Email Delivers ScreenConnect Malware
  writeupas classification.technologies2026-08-04
• LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection
  writeupas tools2026-08-03

  Framework the post uses to map the attack's TTPs for purple-team exercises (mapping included in an appendix).

• Orca Security: AI Threat Detection
  articleas tools2026-07-30It is written here as MITRE ATT&CK (Detection Strategies and Analytics).

  Neutral framework for mapping detections to specific techniques and behaviors, used to evaluate vendor detection claims

• Rapid7
  articleas classification.technologies2026-07-30
• How Anthropic Secures its AI-Native SDLC
  articleas classification.technologies2026-07-26
• Gabson0x/pentdem
  repoas classification.technologies2026-07-20
• Socket: Operation Muck and Load
  writeupas classification.technologies2026-07-16
• meta-llama/PurpleLlama
  repoas classification.technologies2026-07-14
• DataDog/pathfinding-labs
  repoas classification.technologies2026-07-04
• Orca Security: ITDR for the Cloud
  articleas classification.technologies2026-07-03
• XORCISM-AI/XORCISM
  repoas classification.technologies2026-07-01
• Socket: Chrome and Firefox VPN Extensions Add Clipboard Stealers via Malicious Updates
  writeupas classification.technologies2026-06-30
• DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
  writeupas classification.technologies2026-06-08
• mukul975/Anthropic-Cybersecurity-Skills
  repoas classification.technologies2026-05-26
• Tachi
  repoas classification.technologies2026-05-23
• offensive-claude
  repoas classification.technologies2026-05-22
• OpenCTI-Platform/opencti
  repoas tools2026-05-14

  Framework used via a dedicated connector to help structure threat data within OpenCTI

• Linux Attack Detection & Forensics
  repoas classification.technologies2026-05-12
• Socket: 5 Malicious NuGet Packages Target Chinese .NET Developers
  writeupas classification.technologies2026-05-07
• BufferZoneCorp Malicious Gems & Go Modules
  writeupas classification.technologies2026-05-06
• Introducing MacNoise!
  toolas classification.technologies2026-02-26
• Today I learned: binfmt_misc
  writeupas classification.technologies2025-10-30
• Optimizing the SOC
  articleas classification.technologies2024-12-07
• #StopRansomware: SafePay Ransomware (AA26-293A)
  advisoryas classification.technologies
• AI Agents for Cybersecurity: A Guided Tour of a Repository with Tons of Resources and Examples
  articleas toolsIt is written here as MITRE ATT&CK (educational mapping in Part 8 phase files).

  educational mapping in Part 8 phase files

• AI Agents for Cybersecurity: A Guided Tour of a Repository with Tons of Resources and Examples
  articleas toolsIt is written here as MITRE ATT&CK: educational mapping in Part 8 phase files.
• CISA AA26-281A: Chinese Government-linked Actors Combine Automated and Hands-on Hacking Tools to Steal Data
  advisoryas classification.technologies
• Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories - StepSecurity
  writeupas classification.technologies