license: mit
task_categories:
- text-generation
language: - en
tags: - cybersecurity
- APT
- redteam
pretty_name: sunnythakur
size_categories: - n<1K
LOTL APT Red Team Dataset
Overview
The LOTL APT Red Team Dataset is a comprehensive collection of simulated Advanced Persistent Threat (APT) attack scenarios leveraging Living Off The Land (LOTL) techniques. Designed for cybersecurity researchers, red teamers, and AI/ML practitioners, this dataset focuses on advanced tactics such as DNS tunneling, Command and Control (C2), data exfiltration, persistence, and defense evasion using native system tools across Windows, Linux, macOS, and cloud environments. Each entry aligns with the MITRE ATT&CK framework, providing detailed attack commands, detection logic, mitigation strategies, and AI training prompts to enhance threat detection models.
The dataset is structured in JSONL format, optimized for AI training, and includes 500 unique entries (as of May 2025) simulating multi-stage APT attacks with dynamic fuzzing for realism. It aims to challenge detection systems by incorporating obscure utilities, unconventional methods, and obfuscation techniques.
Dataset Description
The dataset contains simulated LOTL-based APT attack scenarios, with each entry including:
id: Unique identifier for the attack scenario.
tactic: MITRE ATT&CK tactic (e.g., Command and Control, Exfiltration).
technique: MITRE ATT&CK technique ID and name (e.g., T1071.004: Application Layer Protocol: DNS).
threat: Description of the attack (e.g., "Using nslookup with TXT records for DNS tunneling C2").
command: Fuzzed command simulating the attack (e.g., nslookup -type=TXT <random>.c2cmd.<random>.com).
detection: Detection logic (e.g., tshark -Y 'dns.qry.type == 16').
mitigation: Mitigation strategies (e.g., Restrict nslookup: icacls nslookup.exe /deny Everyone:RX).
references: Relevant MITRE ATT&CK and CWE links.
ai_training_prompt: Guidance for training AI models to detect the attack (e.g., "Train AI to detect DNS tunneling via nslookup TXT queries by analyzing query frequency").
Key Features
500 unique entries covering DNS tunneling, C2, exfiltration, persistence, and defense evasion.
Dynamic fuzzing for randomized domains, payloads, and intervals to simulate real-world APTs.
MITRE ATT&CK alignment for standardized threat modeling.
AI-optimized with detailed prompts for training detection models.
Cross-platform coverage (Windows, Linux, macOS, cloud).
Obscure tools (e.g., dnscmd, wevtutil, launchctl) and novel techniques (e.g., DNS SRV records for C2).
Install Dependencies (for parsing/analyzing JSONL):pip install pandas jsonlines
Usage
The dataset can be used for:
Threat Hunting: Analyze commands and detection logic to improve SIEM rules.
AI/ML Training: Use ai_training_prompt fields to train models for detecting DNS tunneling and C2.
Red Team Exercises: Simulate APT attacks to test blue team defenses.
Research: Study LOTL techniques and develop new mitigation strategies.
Example: Parsing the Dataset
import jsonlines
import pandas as pd
# Load JSONL dataset
data = []
with jsonlines.open('lotl_apt_redteam_dataset.jsonl') as reader:
for obj in reader:
data.append(obj)
# Convert to DataFrame
df = pd.DataFrame(data)
print(df[['id', 'tactic', 'technique', 'threat']].head())
Example: Filtering DNS Tunneling Scenarios
grep '"technique":"T1071.004' lotl_apt_redteam_dataset.jsonl | wc -l
Contribution Guidelines
We welcome contributions to expand the dataset with new LOTL techniques, detection methods, or AI training prompts. To contribute:
Fork the repository.
Create a new branch (git checkout -b feature/new-technique).
Add new entries to lotl_apt_redteam_dataset.jsonl following the existing schema.
Ensure commands are unique, fuzzed, and aligned with MITRE ATT&CK.
Submit a pull request with a clear description of changes.
Contribution Checklist
Validate JSONL format using a linter (e.g., jsonlint).
Include MITRE ATT&CK and CWE references.
Provide detailed ai_training_prompt for AI model training.
Avoid duplicating existing entries (check id and command).
License
This project is licensed under the MIT License. See the LICENSE file for details.
Contact
For questions or feedback, contact the project maintainers at <[email protected] .
Acknowledgments
MITRE ATT&CK for the threat framework.
CWE for vulnerability references.
Contributors to open-source cybersecurity tools and research.