Windows Events Attack Samples
A collection of 200 Windows EVTX event log samples mapped to MITRE ATT&CK techniques for detection testing and threat hunting.
What is Windows Events Attack Samples?
EVTX-ATTACK-SAMPLES is a collection of Windows EVTX event log files that simulate real attack techniques mapped to the MITRE ATT&CK framework. It provides security professionals with realistic log data to test detection capabilities, train in digital forensics, and understand adversary behaviors without needing to generate attacks themselves.
Cybersecurity professionals, including threat hunters, DFIR analysts, detection engineers, and red team members who work with Windows event logs and need realistic attack data for testing and training.
This project offers a unique, curated dataset of attack-specific EVTX samples directly mapped to ATT&CK techniques, saving security teams time in creating test data and providing standardized examples for detection development and training scenarios.
Overview
Windows Events Attack Samples
Use Cases
Best For
- Testing Windows event log detection rules and SIEM alerts
- Training in digital forensics and incident response (DFIR) using real attack logs
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.