Topics / #mitre-attack

Mitre-attack projects on GitHub

Resources mapping security detections and tests to the ATT&CK knowledge framework.

As of , the most-starred Mitre-attack projects on GitHub are Anthropic-Cybersecurity-Skills (34.6K stars), atomic-red-team (12.7K stars) and kubescape (11.8K stars). GitHub.Locker tracks 10 Mitre-attack repositories with 79.8K stars combined. The fastest-growing on October 16 was Anthropic-Cybersecurity-Skills, with +71 stars in a day.

10Projects
79.8KStars in total
+145Stars in a day
Browse in the catalog →github.com/topics/mitre-attack ↗

Hot right now

Most stars gained in a day · Oct 16

+71

Anthropic-Cybersecurity-Skills

mukul975/Anthropic-Cybersecurity-Skills · ★ 34.6K

An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

+30

artex-global

jiwoochris/artex-global · ★ 1.6K

ARTEX-KO is a Korean localization of the ARTEX (Autumn-27/ARTEX) framework: a system where multiple LLM-driven agents autonomously run a penetration test end-to-end, from reconnaissance to exploitation, with a Go backend and an embedded Next.js frontend.

+21

Decepticon

BitterSecurity/Decepticon · ★ 6.2K

Decepticon is a professional autonomous Red Team agent that runs full attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, and C2 — the way a real adversary would, instead of just scanning and printing a report.

+11

atomic-red-team

redcanaryco/atomic-red-team · ★ 12.7K

Atomic Red Team is a library of small, portable security tests, each mapped to a specific MITRE ATT&CK technique, that security teams run to check whether their defenses actually detect real attacker behavior.

The all-time top

10 projects · by stars

  1. #1 · mukul975/Anthropic-Cybersecurity-Skills

    Anthropic-Cybersecurity-Skills

    An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

    34.6K
  2. #2 · redcanaryco/atomic-red-team

    atomic-red-team

    Atomic Red Team is a library of small, portable security tests, each mapped to a specific MITRE ATT&CK technique, that security teams run to check whether their defenses actually detect real attacker behavior.

    12.7K
  3. #3 · kubescape/kubescape

    kubescape

    Kubescape is an open-source Kubernetes security platform that scans clusters, YAML files, Helm charts, and container images for misconfigurations and vulnerabilities, covering the whole lifecycle from development to runtime.

    11.8K
  1. 4

    sigma

    11.3KSigmaHQ/sigma · Python

    Sigma is a generic, open signature format for describing detection patterns in log events, and this repository is the main collection of over 3000 community-written Sigma detection rules for SIEM systems.

  2. 5

    Decepticon

    6.2KBitterSecurity/Decepticon · Python

    Decepticon is a professional autonomous Red Team agent that runs full attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, and C2 — the way a real adversary would, instead of just scanning and printing a report.

  3. 6

    artex-global

    1.6Kjiwoochris/artex-global · Go

    ARTEX-KO is a Korean localization of the ARTEX (Autumn-27/ARTEX) framework: a system where multiple LLM-driven agents autonomously run a penetration test end-to-end, from reconnaissance to exploitation, with a Go backend and an embedded Next.js frontend.

  4. 7

    BEAR-C2

    703S3N4T0R-0X0/BEAR-C2 · Python

    BEAR-C2 is an adversary simulation and emulation framework for red team operations, built around real-world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups.

  5. 8

    safelabs-eval

    569AgentSafeLabs/safelabs-eval · Python

    safelabs-eval is an open-source red-teaming and evaluation framework for AI agents, built around an OWASP-inspired ASI01-ASI10 taxonomy. It fires 300 curated adversarial prompts at an agent and scores every response with pattern-based detectors to produce a structured security report.

  6. 9

    k8scout

    258k8scout/k8scout · Go

    k8scout is a single-binary tool you drop into a compromised Kubernetes pod to automatically map every realistic attack path from that foothold to cluster-admin, node escape, secret theft, or cloud IAM takeover.

  7. 10

    Claude-AD

    211ADScanPro/Claude-AD

    Claude-AD is a Claude Code plugin that gives Claude the methodology for an internal Active Directory penetration test: skills, agents and slash commands covering Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay and delegation abuse, each with OPSEC and telemetry notes.

Often tagged together