← all datasets
from the project README
◆ Attack logs
EVTX-ATTACK-SAMPLES
GPL-3.0Windows event log captures of ATT&CK techniques, organised by tactic — standard input for testing EVTX detections.
Summary
This is a container for windows events samples associated to specific attack and post-exploitation techniques. N.B: Mapping has been done to the level of ATT&CK technique (not procedure).
- Formats
evtx- License
- GPL-3.0
- Added
- 2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
-
$ git clone --depth 1 https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
Shallow clone: history isn’t needed for testing.
Contents
316 files 6.2 MB repository
-
.evtx278 -
.png7 -
.md6 -
.py5 -
.pyc5 -
.ps12 -
.txt2 -
.csv1
Use it with
Commands are curated, not yet run by us.
chainsaw — Run your Sigma rules over every event log in the dataset.
$ chainsaw hunt ./EVTX-ATTACK-SAMPLES -s rules/ --mapping mappings/sigma-event-logs-all.yml
Hayabusa — Build a CSV timeline of detections across every .evtx file in the directory.
$ hayabusa csv-timeline -d ./EVTX-ATTACK-SAMPLES -o timeline.csv