Compound Actions

This repository is for sharing SCYTHE Compound Actions. Compound Actions are custom tests that do not classify as an entire threat or adversary emulation plan. However, they are still an attack chain that can be added to larger threats and campaigns.

How To Use Compound Actions

1. Select the Compound Action folder you are interested in
2. Review the README if available
3. Download the raw JSON file.

Import into SCYTHE

1. Login to the SCYTHE instance where you want to import the Compound Action.
2. Click Threat Manager - Migrate Threats
3. Under "Import Threat" click “Choose File” and select the JSON file you downloaded from GitHub
4. Click Import and OK when complete
5. Click Threat Manager - Threat Catalog
6. Find the imported Compound Action and click the tag icon
7. Tag the MITRE ATT&CK Technique for the Compound Action

Community Effort

SCYTHE believes in giving back to the community and encourages everyone to do the same. Please submit pull requests with new Compound Actions in their respective folder and we will review before approving.