sbousseaden/EVTX-ATTACK-SAMPLES resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2614 stars · 437 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A dataset of ~200 Windows EVTX event log samples mapped to MITRE ATT&CK tactics and techniques, covering attack and post-exploitation behaviors including Sysmon logs. It includes helper PowerShell scripts for parsing and replaying EVTX files through Winlogbeat into an ELK stack.

Use cases

• test detection scripts that parse evtx files
• train on dfir and threat hunting with windows event logs
• design detection use cases from windows and sysmon logs
• replay evtx samples into an elk stack with winlogbeat
• find noisy techniques to avoid as a red teamer
• build a labeled dataset for security detection research

When to choose

• you are building or validating Windows/Sysmon detection rules
• you need realistic attack event logs for DFIR training or SIEM testing
• you want EVTX samples organized by MITRE ATT&CK technique

When to avoid

• you need live attack traffic or network captures rather than event logs
• you need Linux/macOS audit logs instead of Windows EVTX
• you need a continuously updated dataset - the last release was early 2023

Facets

dataset · maturity maintenance

security testing data-generation logging security developer-tools operating-systems windows python cli evtx windows-event-logs mitre-attack threat-hunting dfir sysmon detection-engineering winlogbeat sample-data

Member repositories

For agents

markdown · JSON · MCP: product_card(name="sbousseaden/EVTX-ATTACK-SAMPLES")