language:
- en
license: apache-2.0
size_categories: - n<1K
task_categories: - question-answering
- text-classification
tags: - cybersecurity
- ayinedjimi-consultants
- en
- active-directory
- ad-attacks
- pentesting
- threat-intelligence
- attack-techniques
- adversary-emulation
- english
- security
- pentest
- red-team
- blue-team
- SOC
- CTI
- kerberos
- windows
- detection
- sigma
- SIEM
- threat-hunting
- incident-response
- vulnerability-assessment
- devsecops
- offensive-security
- defensive-security
- security-training
- CTF
- OSCP
- CEH
pretty_name: Active Directory Attacks (English)
authors: - name: Ayi NEDJIMI
url: https://ayinedjimi-consultants.fr/bio.html
configs: - config_name: default
data_files:- split: train
path: data/train-*
source_datasets:
- split: train
- original
dataset_info:
dataset_size: null
download_size: null
Active Directory Attacks - Complete English Dataset
Comprehensive dataset of Active Directory attacks on Hugging Face. Complete reference for offensive and defensive security in AD environments.
Description
This dataset covers all known Active Directory attack techniques:
- 46 attacks documented with detailed descriptions, prerequisites, tools, detection and mitigation
- 33 AD pentest tools (Mimikatz, Impacket, BloodHound, Rubeus, etc.)
- 30 detection rules in Sigma format with Windows Event IDs
- 80+ Q&A pairs covering all aspects of AD security
Structure
1. attacks.json (46 entries)
id, name, description, category, mitre_technique_ids, severity, prerequisites, tools, detection, mitigation, source_url
Categories: credential_access, lateral_movement, persistence, privilege_escalation, reconnaissance, defense_evasion
2. tools.json (33 entries)
id, name, description, url, category, attacks_related, platforms, source_url
3. detection_rules.json (30 entries)
id, name, description, event_ids, log_source, sigma_rule, attacks_related, source_url
4. qa_dataset.json (80+ entries)
id, question, answer, category, reference, difficulty, keywords, source_url
Attacks Covered
| Category | Attacks |
|---|---|
| Credential Access | Kerberoasting, AS-REP Roasting, DCSync, LSASS Dump, SAM Dump, NTDS.dit Extraction, Silver Ticket, Golden Ticket, Diamond Ticket, Sapphire Ticket |
| Lateral Movement | Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, PSExec, WMI Exec, DCOM Exec, WinRM, RDP Hijacking, SMB Relay, NTLM Relay |
| Persistence | Skeleton Key, AdminSDHolder, SID History, DCShadow, GPO Abuse, DSRM Abuse, Custom SSP, Machine Account Persistence |
| Privilege Escalation | PrintNightmare, ZeroLogon, PetitPotam, Shadow Credentials, RBCD Abuse, ACL Abuse, Constrained Delegation, Unconstrained Delegation |
| Reconnaissance | BloodHound, LDAP Enumeration, SPN Scan, GPO Enumeration, Trust Enumeration |
Usage
from datasets import load_dataset
# Load attacks
ds = load_dataset("AYI-NEDJIMI/ad-attacks-en", data_files="data/attacks.json")
for attack in ds["train"]:
print(f"{attack['id']} - {attack['name']} ({attack['severity']})")
# Load detection rules
ds = load_dataset("AYI-NEDJIMI/ad-attacks-en", data_files="data/detection_rules.json")
for rule in ds["train"]:
print(f"{rule['name']} - Events: {rule['event_ids']}")
Use Cases
- Red Team: Reference for AD penetration testing
- Blue Team / SOC: Ready-to-use Sigma detection rules
- Training: Educational material for security analysts
- Threat Intelligence: AD attack mapping with MITRE ATT&CK
- Detection Engineering: Windows Event ID to attack technique mapping
- RAG / Fine-tuning: Training specialized cybersecurity AI models
Other Datasets
| Dataset | Description | Link |
|---|---|---|
| OWASP Top 10 FR | OWASP Top 10 in French | owasp-top10-fr |
| OWASP Top 10 EN | OWASP Top 10 in English | owasp-top10-en |
| ISO 27001:2022 FR | ISO 27001 in French | iso27001 |
| ISO 27001:2022 EN | ISO 27001 in English | iso27001-en |
| MITRE ATT&CK FR | ATT&CK in French | mitre-attack-fr |
| MITRE ATT&CK EN | ATT&CK in English | mitre-attack-en |
| AD Attacks FR | AD Attacks in French | ad-attacks-fr |
Interactive Explorer
Explore this dataset interactively: AD Attack Explorer
Full Collection
This dataset is part of the Cybersecurity Datasets & Tools collection on HuggingFace.
Source
- MITRE ATT&CK: Technique mapping via ATT&CK Enterprise
- Sigma Rules: Standard detection format Sigma
License
Citation
@dataset{ad_attacks_en_2025,
title={Active Directory Attacks - Complete English Dataset},
author={AYI-NEDJIMI},
year={2025},
publisher={Hugging Face},
url={https://huggingface.co/datasets/AYI-NEDJIMI/ad-attacks-en}
}
Author & Resources
Ayi NEDJIMI - Senior Consultant in Offensive Cybersecurity & AI
Cybersecurity Articles
- Website - Cybersecurity & AI Articles
- OAuth 2.0 Security Guide
- NTLM Relay Attacks Guide
- Kubernetes Security Hardening
- Memory Forensics with Volatility
- Securing Microsoft 365 with Conditional Access
AI Articles
- RAG: Retrieval-Augmented Generation
- Optimizing Document Chunking
- Choosing a Vector Database
- Embedding Security & Privacy
Networks
Author
Ayi NEDJIMI - Cybersecurity Consultant & Trainer | AI Expert
Related Articles
- Top 10 Attaques Active Directory
- Top 10 Outils Audit AD 2025
- Guide Sécurisation AD 2025
- Hub Ressources Active Directory
- Livre Blanc Sécurité AD
- Golden Ticket Attack
- DCSync Attack
- Kerberoasting
- Pass-the-Hash
- Pass-the-Ticket
- Skeleton Key
- DC Shadow Attack
- Silver Ticket
- ADCS - Certificats
Free Cybersecurity Resources
- Livre Blanc NIS 2
- Livre Blanc Sécurité Active Directory
- Livre Blanc Pentest Cloud AWS/Azure/GCP
- Livre Blanc Sécurité Kubernetes
- Livre Blanc IA Cyberdéfense
- Livre Blanc Anatomie Ransomware
- Guide Sécurisation AD 2025
- Guide Tiering Model AD
Part of the Collection
This dataset is part of the Cybersecurity Datasets & Tools Collection by AYI-NEDJIMI Consultants.