An open cybersecurity reference library, cross-referenced to MITRE ATT&CK.
Drafted with an AI assistant from the sources cited; checked against them on 2026-10-17.
| I want to... | Go to |
|---|---|
| Learn a discipline | Learning paths |
| Write detections or hunt | Technique Detection Library |
| Assess ATT&CK coverage | Run a coverage gap assessment |
| Respond to an incident | Incident Response Reference |
| Manage vulnerabilities | Vulnerability Management Reference |
| Secure AI systems | AI Security Reference |
New here? How to use this library shows what lives where, and the website renders the same files with search.
| What | Count | Contents | Start at |
|---|---|---|---|
| Reference documents | 155 | One topic each: its terms, tooling, and the frameworks and guidance that apply | Reference index |
| How-to guides | 21 | One task, step by step, with the time it takes, what you need, and what you produce | Guides |
| Learning paths | 47 | An order of study for one discipline, with training, tools, books, and certifications | Learning paths |
| Framework pages | 2,930 | One page per ATT&CK, CAPEC, D3FEND, ATLAS, and F3 object, generated from MITRE data | Framework pages |
Where a published mapping exists, a technique page links the NIST SP 800-53 controls, MITRE detection strategies and analytics, CAPEC attack patterns, and D3FEND countermeasures that relate to it. The same relationships ship as JSONL files and ATT&CK Navigator layers. About the data gives their sources, the ATT&CK version each part is built from (v19.2 for the data and framework pages), and what CI checks. The library also holds vendor tool pages, AI tooling notes, case studies, tools research, and research notes.
| Project | What it is |
|---|---|
| TeamStarWolf | This library: hand-written references, generated framework pages, and mapping data, published as a website. |
| ATTACK-Navi | A browser-based workbench for the Enterprise, ICS, and Mobile ATT&CK matrices, with views for detection coverage, threat intelligence, vulnerability exposure, and compliance. It needs no backend: live app. |
| cybersecurity-resources | A bookmark collection weighted toward vulnerability management and threat intelligence, released under CC0. |
The references summarize third-party frameworks, standards, and publications, and they can fall behind upstream changes, so check the primary source before relying on a detail, particularly version-specific facts, regulatory requirements, and anything you intend to run. Offensive techniques and tooling are described for authorized testing, education, and defensive research; do not use them against systems you do not have permission to test. The vendor-to-control mappings are this library's own editorial assessments, not vendor statements or evidence of coverage.
MITRE ATT&CK, ATLAS, CAPEC, CWE, D3FEND, EMB3D, Engage, F3, and FiGHT are maintained by The MITRE Corporation. ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. This project is not affiliated with or endorsed by MITRE. The TeamStarWolf name and STARWOLF 64 art are naming and art only, never a claim about people, affiliations, or capability. Star Fox is a Nintendo trademark; this project is not affiliated with or endorsed by Nintendo.
Microsoft Defender quarantines MALWARE_ANALYSIS_REFERENCE.md on checkout because it quotes evasion snippets as analysis samples, which leaves a tracked file deleted in git status. Follow Cloning on Windows before cloning, and never commit that deletion.
Corrections and additions are welcome through issues and pull requests; see CONTRIBUTING, the voice guide, the code of conduct, and the security policy. Changes are recorded in the changelog. Original content is released under the MIT License; data and text drawn from MITRE and other sources stay under their owners' terms, listed in THIRD_PARTY_NOTICES.md. To cite the library, use CITATION.cff or the "Cite this repository" button on the repository page.