Small and highly portable detection tests based on MITRE's ATT&CK.

windows-kernel-exploits Windows平台提权漏洞集合

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.