An open cybersecurity reference library for the community.
Website · Intelligence Hub · ATT&CK-Navi · Browse all references · Contribute
Explore the library: Languages · Paradigms · Frameworks · Commands · Formats · Domains · Guides · Learning paths · ATT&CK · Detections · Data
| I want to... | Go to |
|---|---|
| Follow cybersecurity news and advisories | Intelligence Hub |
| Learn a discipline | Learning paths |
| Write detections or hunt | Technique Detection Library |
| Assess ATT&CK coverage | Run a coverage gap assessment |
| Respond to an incident | Incident Response Reference |
| Manage vulnerabilities | Vulnerability Management Reference |
| Secure AI systems | AI Security Reference |
New here? How to use this library shows what lives where, and the website renders the same files with search.
| What | Count | Contents | Start at |
|---|---|---|---|
| Reference documents | 164 | One topic each: its terms, tooling, and the frameworks and guidance that apply | Reference index |
| How-to guides | 21 | One task, step by step, with the time it takes, what you need, and what you produce | Guides |
| Learning paths | 47 | An order of study for one discipline, with training, tools, books, and certifications | Learning paths |
| Framework pages | 3,019 | One page per Enterprise ATT&CK technique, tactic, group, software entry, campaign, and mitigation, CAPEC attack pattern, D3FEND countermeasure, ATLAS technique and mitigation, and F3 technique | Framework pages |
| Developer reference pages | 191 | One page per programming language, paradigm, software framework, command-line tool, data format, and database engine | Languages |
| Security platform pages | 59 | One page per vendor platform a security program runs on, from endpoint and exposure management to identity, cloud, OT, and backup | Security platforms |
| AI tooling pages | 50 | AI tools and models in groups, a one-page manual for each tool, a learning path, and hands-on labs | AI tooling |
| Case studies | 8 | Evidence-graded studies of how the threat landscape is changing, written from primary sources, with figures and PDF downloads | Case studies |
The references, guides, and learning paths are written for defenders, learners, and anyone with a security job to do, and corrections from anyone are welcome. Where a published mapping exists, a technique page links the NIST SP 800-53 controls, MITRE detection strategies and analytics, CAPEC attack patterns, and D3FEND countermeasures that relate to it. The same relationships ship as JSONL files and ATT&CK Navigator layers. About the data gives their sources, the ATT&CK version each part is built from (v20.0 for the data and framework pages), and what CI checks. The library also holds vendor tool pages, AI tooling notes, case studies, tools research, and research notes.
| Project | What it is |
|---|---|
| TeamStarWolf | This library: hand-written references, generated framework pages, and mapping data, published as a website. |
| Intelligence Hub | Searchable security news, advisories, CVE mitigation guidance, and a sourced historical timeline. Live feed. |
| ATT&CK-Navi | A browser-based workbench for the Enterprise, ICS, and Mobile ATT&CK matrices, with views for detection coverage, threat intelligence, vulnerability exposure, and compliance. It needs no backend: live app. |
| cybersecurity-resources | A bookmark collection weighted toward vulnerability management and threat intelligence, released under CC0. |
The references summarize third-party frameworks, standards, and publications, and they can fall behind upstream changes, so check the primary source before relying on a detail, particularly version-specific facts, regulatory requirements, and anything you intend to run. Offensive techniques and tooling are described for authorized testing, education, and defensive research; do not use them against systems you do not have permission to test. The vendor-to-control mappings are this library's own editorial assessments, not vendor statements or evidence of coverage.
MITRE ATT&CK, ATLAS, CAPEC, CWE, D3FEND, EMB3D, Engage, F3, and FiGHT are maintained by The MITRE Corporation. ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. This project is not affiliated with or endorsed by MITRE. The TeamStarWolf name and STARWOLF 64 art are naming and art only, never a claim about people, affiliations, or capability. Star Fox is a Nintendo trademark; this project is not affiliated with or endorsed by Nintendo.
Microsoft Defender quarantines MALWARE_ANALYSIS_REFERENCE.md on checkout because it quotes evasion snippets as analysis samples, which leaves a tracked file deleted in git status. Follow Cloning on Windows before cloning, and never commit that deletion.
Corrections and additions are welcome through issues and pull requests; see CONTRIBUTING, the voice guide, the code of conduct, and the security policy. Changes are recorded in the changelog. Original content is released under the MIT License; data and text drawn from MITRE and other sources stay under their owners' terms, listed in THIRD_PARTY_NOTICES.md. To cite the library, use CITATION.cff or the "Cite this repository" button on the repository page.
TeamStarWolf: Library · Intelligence Hub · ATT&CK-Navi · Bookmarks