EVTX-to-MITRE-Attack gives your SIEM Windows logs labelled by ATT&CK

Samples with labels, not detection rules

The project description says it plainly: a set of EVTX samples, more than 270 of them, mapped to MITRE ATT&CK tactic and techniques, to measure your SIEM coverage or to develop new use cases. There is no code here and no detection content. What the repository holds is Windows event log data, in the EVTX format, with each sample placed against an ATT&CK technique so a defender can tell whether their pipeline would ever have seen that activity. That is a different artefact from a detection rule pack, and it is worth understanding why it exists. A rule pack tells you what someone believes is worth detecting. A labelled sample tells you what a real event stream looks like, so you can write a rule against actual data and then check whether your collection and parsing layer would deliver it. The ATT&CK label is the index that makes the corpus navigable, and the tactic grouping is the second axis, since a technique only tells you so much without knowing where it sits in the kill chain.

Four jobs the corpus is meant to support

The README frames the project as oriented toward a Security Information Management System, and lists what the classification is for. Measuring your security coverage is the first, and it is the clearest use, since each labelled sample answers a specific question about your pipeline. Enhance your detection capacities is the second, because a sample tells you which fields are present in the event and therefore what a rule could key on. Identify security gaps or uncovered threats is the third, and it follows from the same mechanism, since a technique whose samples never arrive at your SIEM is a gap you can name rather than one you speculate about. Design new use cases is the fourth, and it is the one that changes how a team works, since the corpus turns an empty SIEM into a source of real data to develop against. These four are listed as the reason for classifying by tactic and technique, so the labelling exists to serve these jobs, not as an end in itself. That framing also sets the limit of the project, since it assumes you already have a SIEM and a collector.

The directory layout is the ATT&CK tactic taxonomy

The top level of the repository is organised by ATT&CK tactic rather than by log source or by date, and that choice determines how you browse it. The directories are Antivirus/, then TA0001-Initial access/, TA0002-Execution/, TA0003-Persistence/, TA0004-Privilege Escalation/, TA0005-Defense Evasion/, TA0006-Credential Access/, TA0007-Discovery/, TA0008-Lateral Movement/, TA0009-Collection/, TA0011-Command and Control/ and TA0040-Impact/. Two gaps in that sequence are worth noting because they are meaningful. There is no TA0010 in the list, and TA0011 sits between TA0009 and TA0040, so the sequence follows the ATT&CK numbering rather than a simple count. And TA0040-Impact appears after TA0011, which reflects how ATT&CK itself orders its later tactics. Two directories sit outside the tactic scheme. EVTX_full_APT_attack_steps/ holds the complete step-by-step logs of an attack chain rather than samples isolated per technique, and the Antivirus/ folder sits outside the numbered tactics entirely, which is a sign that the project treats antivirus events as their own category rather than forcing them into a tactic. The layout is:

TA0001-Initial access/
TA0002-Execution/
TA0003-Persistence/
TA0004-Privilege Escalation/
TA0005-Defense Evasion/
TA0006-Credential Access/
TA0007-Discovery/
TA0008-Lateral Movement/
TA0009-Collection/
TA0011-Command and Control/
TA0040-Impact/

Event IDs and the agent that has to read them

The index table is what makes the corpus usable, because each row ties a description to the Windows event IDs that carry it and, where it applies, names the tool or CVE behind it. The granularity is fine. Under initial access and valid accounts, a login denied due to account policy restrictions is event 4625, a login failure from a single source with a disabled account is 33205, a successful login on an OpenSSH server appears as both event 4 and event 4624, and RDP reconnaissance with valid credentials performed to multiple hosts is 4624 or 1149. Under execution, Impacket WMIexec process execution is event 1 or 4688, a scheduled task with suspicious arguments is 4698, a remote schedule task creation via named pipes is 5145 and is attributed to Atexec, and PSexec installation detected is 1 or 4688. The naming of tools is a bonus, so a row tagged Tchopper or Rubeus or WMIexec tells you not only what happened but what did it. Using this with a SIEM means pointing a collection agent at the EVTX files, and the README names the ones it expects you might use, NXLog, Winlogbeat, Splunk UF, ArcSight, WinCollect and Snare, with the caveat that depending on your SIEM you may need to configure the agent to send the content in the adequate format.

Where the samples came from, and what is still planned

The Microsoft log sources used are listed, and the list is the honest statement of the corpus's scope. Windows 10 and Windows Server 2012 R2 and higher are there, along with Active Directory Domain Services, Active Directory Certification Services with an online responder for OCSP, SQL Server 2014, Windows Defender, SYSMON v11 and higher, and Exchange 2016. One entry is marked planned, and it is a notable one: Internet Information Services, the IIS web server. So the web server logs are not in the corpus yet, which means coverage of web-facing techniques is thinner than coverage of host and directory activity. That distinction matters when you read a coverage result. A technique with no IIS sample may be absent from the corpus rather than absent from your blind spots. The SYSMON floor of v11 also dates the collection, since Sysmon 11 is a specific schema generation, and event definitions have changed across versions, so a sample from that era will not necessarily carry the fields a current Sysmon build would produce.

How this sits alongside the other corpora

The README points at several related projects, and comparing them explains what this one contributes. EVTX-ATTACK from sbousseaden is the closest sibling, offering a larger set of ATT&CK mapped samples in the same format, so it is the thing to compare coverage against rather than a substitute. The OTRF Security-Datasets repository from the Mordor project is a broader source of adversary emulation datasets, with a Windows atomic directory among others. Atomic RedTeam from Red Canary is the best known of the three and works differently, since it executes the behaviour rather than replaying a captured log, which is a complement rather than a competitor, because it produces fresh events on your own systems while this corpus replays real ones. Zircolite is SIGMA detection for EVTX, so it is the bridge from a sample to a rule. The EvtxToElk write-up by Dragos and the Winlogbeat import guide are there for the practical problem of getting these files into an Elastic-backed SIEM, which is the step between having samples and having them searchable. The project also carries a public domain CC0-1.0 licence on the data, which removes the friction of building a corpus on top of these files.

Editorial conclusion

Adopt EVTX-to-MITRE-Attack when you want to measure which ATT&CK techniques your SIEM and collection actually reach, or when you need realistic Windows event logs to design a use case against. Do not adopt it as a detection ruleset, because the repository contains log samples and their ATT&CK labels rather than queries, and the CC0 licence on the data says nothing about the rules you write from it. Verify first that your log collector can ingest the EVTX format directly or needs conversion, since the README names NXLog, Winlogbeat, Splunk UF, ArcSight, WinCollect and Snare as the agents that would need to be pointed at the files, and that the Windows sources your estate runs overlap with the list the samples were collected from.

Frequently asked questions

Official sources

1. Issues
2. License: CC0-1.0
3. mdecrevoisier/EVTX-to-MITRE-Attack on GitHub
4. README