All pull requests

Pull requests

• Add T1134.005 SID history modification test via DSInternals RPC

  20 min review
  #3446·SheriffBLN opened Oct 7, 2026·

  ·

• T1548.003 - Add sudo privilege escalation atomic for xargs (GTFOBins)

  1 min review
  #3445·defamp opened Oct 7, 2026·

  ·

• T1548.003 - Add sudo privilege escalation atomic for gdb (GTFOBins)

  1 min review
  #3444·defamp opened Oct 7, 2026·

  ·

• T1548.003 - Add sudo privilege escalation atomics for tar and tcpdump (GTFOBins)

  1 min review
  #3443·defamp opened Oct 7, 2026·

  ·

• Bump urllib3 from 2.7.0 to 2.8.0

  1 min reviewdependenciespython
  #3442·dependabot[bot] opened Oct 6, 2026Bot·

  ·

• Bump hypothesis from 6.167.1 to 6.168.3

  1 min reviewdependenciespython
  #3440·dependabot[bot] opened Oct 5, 2026Bot·

  ·

• feat(T1685): Add Windows Defender disk exhaustion test via fsutil

  1 min review
  #3439·DevCop95 opened Sep 30, 2026·

  ·

• Fix T1546.008 binary replacement never running on a fresh host

  1 min review
  #3437·cristianchiriac opened Sep 27, 2026·

  ·
  1

• Fix paths containing spaces in T1082 List OS Information

  1 min review
  #3436·S-Venky-06 opened Sep 25, 2026·

  ·

• Fix environment variable syntax in schtasks command

  1 min review
  #3435·saksham-17 opened Sep 24, 2026·

  ·

• feat(atomics): add T1555.005 Password Managers (KeePass) tests

  5 min review
  #3433·DevCop95 opened Sep 19, 2026·

  ·

• Add macOS atomic tests for 15 ATT&CK techniques with no prior macOS coverage

  30 min reviewmacOS
  #3432·liamsomerville opened Sep 16, 2026Contributor·

  ·
  1

  

• Add atomic tests for T1070.009 Clear Persistence

  5 min reviewwindows
  #3430·ashish-cybersec opened Sep 13, 2026Contributor·

  ·
  

• Add T1518.002 Windows Server Backup discovery test

  1 min review
  #3428·aleksei-kislov opened Sep 9, 2026·

  ·

• Use basic parsing for IWR

  ADFScloudlinuxmacOSwindows
  #3427·cyberbuff opened Sep 9, 2026Collaborator·

  ·
  

• Fix display names

  20 min review
  #3426·cyberbuff opened Sep 5, 2026Collaborator·

  ·

• Add atomic tests for T1070.007 Clear Network Connection History and Configurations

  5 min reviewwindows
  #3424·ashish-cybersec opened Sep 1, 2026Contributor·

  ·
  

• Add go prereq for T1027.004

  1 min reviewlinuxmacOSStale
  #3422·cyberbuff opened Aug 24, 2026Collaborator·

  ·
  1

  

• Add Atomic Test for T1204.005 - Execute NPM Package Post-install Script

  5 min reviewwindows
  #3419·RandomLinoge opened Aug 22, 2026Contributor·

  ·
  

• Add T1692.001 (Command Message) atomic tests for Modbus/TCP

  10 min reviewStale
  #3417·AAH20 opened Aug 18, 2026·4 of 5 tasks·

  ·
  1

• Add atomic test for T1574.014 AppDomainManager

  10 min review
  #3404·AmirHoseinTangsiriNET opened Jul 26, 2026·

  ·
  3

• Add wevtutil PowerShell log clearing test to T1070.003

  5 min reviewStalewindows
  #3403·Mahshid-MSH opened Jul 22, 2026Contributor·

  ·
  1

  

• Add esentutl file extension masquerading test to T1036

  5 min reviewwindows
  #3402·Mahshid-MSH opened Jul 22, 2026Contributor·

  ·
  2

  

• Add csvde AD automated collection test to T1119

  1 min reviewwindows
  #3401·Mahshid-MSH opened Jul 22, 2026Contributor·

  ·
  2

  

• Add csvde discovery

  1 min reviewwindows
  #3399·Mahshid-MSH opened Jul 22, 2026Contributor·

  ·
  1