efstratioslontzetidis/whathitme

WhatHitMe is a Python3 tool which provides the possible Groups and their attributed Campaigns that may have attacked you in an incident, based on specific Techniques and Software you have identified (MITRE ATT&CK). It supports both enterprise, mobile and ICS matrixes. It also provides searches to known sources for these Groups for insight!

whathitme's Issues

threat intelligence search for groups

opencti, etc

ATTACK NAVIGATOR LAYERS

Techniques and Software Extraction from Groups

Flags from command line

Comparison and Results Presentation

Lists comparison and results presentations

GUI

Implement Scoring indicators

Implement Scoring indicators based on the techniques matched and techniques used by a specific group.

CTI feed produce based on the incident artifacts to disclose specific group's activity

Import from File

CTI feeds search based on this group

Input Receive

Process to receive user input with guidelines

HTTP request issues?

I'm getting HTTP issues on multiple systems, was there a change that broke this? (verified updated, tested with different tags, versions, software, etc)

whathitme -v 13.1 -t T1555 -o groups.txt

---

\ \ / / | | | | | | () | | / |
\ \ /\ / /| |__ __ | | | |__| || |_ | \ / | ___
\ / / / | '_ \ / ` | __| | __ | | __| | |/| |/ _
\ /\ / | | | | (| | |_ | | | | | |_ | | | | /
/ / || ||_,|_| || |||_| || |_|_|

This is a python script that offers the visibility to a defender to know the possible APT groups and their campaigns that targeted an organization, after understanding the techniques and software used.

[!] Downloading the Techniques excel file for the matrix: enterprise and version: ['13.1']

[-] HTTP request was not successful. Please check the provided version of the matrix and check again