opseclint
A free tool that answers a question security teams often can't: "if an attacker ran this exact command on our systems, would our monitoring actually notice?" It checks scripts against known attack techniques and scores how visible they'd be to your defens
🔗 Visit opseclint
Description
Detection engineers and red teams often run a specific command or script and then have to guess whether their monitoring tools would have caught it. opseclint removes the guesswork: it analyzes shell commands and scripts, maps them to known MITRE ATT&CK techniques, and evaluates what defensive telemetry each one would actually generate across Linux, Windows, and macOS.
It's MIT-licensed and distributed via crates.io, prebuilt binaries, a GitHub Action, and a Docker image. Each analyzed command gets a detectability score from 0 to 100, and results can be checked against SigmaHQ detection rules to see if a matching alert rule already exists. Output includes SARIF 2.1.0 for GitHub code scanning, coverage-gap analysis to find blind spots, before/after coverage diffing, EDR vendor mapping (CrowdStrike, Microsoft Defender, SentinelOne, Elastic), ATT&CK Navigator layer export for visualization, and CI/CD integration with configurable pass/fail thresholds. It can also ingest real telemetry from sensors to validate its predictions against what actually got logged.
💬 Our review
The short version: this is a purpose-built tool for a specific, useful job — validating detection coverage against MITRE ATT&CK before or after a red-team exercise — and it's free where the closest equivalents are typically expensive purple-team consulting engagements or enterprise detection-engineering platforms.
The honest alternative to opseclint isn't really another product, it's manual work: reading Sigma rules by hand and cross-referencing them against ATT&CK techniques, which doesn't scale past a handful of commands. opseclint's SARIF output and CI/CD integration mean detection coverage can be checked automatically every time a new attack technique or playbook is added, rather than as a one-off audit. The limitation is scope: it evaluates what telemetry a command *should* generate based on known mappings, and its real-telemetry ingestion feature is what actually confirms your sensors agree — without wiring that up, it's a coverage estimate, not a guarantee.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Licence MIT, disponible via crates.io, binaires prêts à l'emploi, GitHub Action et image Docker.
Pros
Score de détectabilité (0-100) par commande, mappé sur MITRE ATT&CK
Intégration CI/CD avec seuils configurables et sortie SARIF pour GitHub
Gratuit et open source, mapping vers les principaux EDR (CrowdStrike, Defender, SentinelOne, Elastic)
Cons
Estime la télémétrie attendue plutôt que de la garantir sans ingestion de télémétrie réelle
Outil de niche destiné aux équipes de détection/purple team, pas un usage grand public
Nécessite de connaître MITRE ATT&CK et les règles Sigma pour en tirer le plein potentiel