license: mit
language:

• en
  tags:
• cybersecurity
• mitreframework
  pretty_name: sunnythakur
  size_categories:
• 1K<n<10K

MITRE ATT&CK Enterprise Dataset

Overview

This dataset provides a comprehensive collection of MITRE ATT&CK Enterprise techniques (v14.1) in JSONL format, designed for cybersecurity professionals, red teams, and threat hunters.

Each entry maps to a specific ATT&CK technique, including its ID, name, description, real-world example, and source.

The dataset is structured for seamless integration into security tools such as SIEMs, threat intelligence platforms, or custom red team frameworks.

Dataset Details

Format: JSONL (JSON Lines)
Total Entries: 1500entries all techniques, including sub-techniques
Schema:
id: Unique MITRE ATT&CK technique ID (e.g., T1003.001)
technique: Name of the technique (e.g., "LSASS Memory")
description: Brief description of the adversary behavior
example: Real-world example tied to APT29 (Cozy Bear) for consistency
source: Attribution to MITRE ATT&CK

Source: MITRE ATT&CK Enterprise Framework (v14.1, )

File: mitre_framework_dataset.jsonl

Purpose

This dataset serves multiple use cases:

Red Teaming: Map adversary TTPs to simulate realistic attack scenarios.
Threat Hunting: Correlate observed behaviors with ATT&CK techniques for faster detection.
Vulnerability Management: Link vulnerabilities (e.g., CVEs) to ATT&CK IDs for vendor-ready impact reports.
Threat Intelligence: Enhance SIEM or TIP ingestion with structured ATT&CK data.

Usage

Ingestion:

Import mitre_techniques.jsonl into tools like Splunk, Elastic, or custom scripts.

Example (Python):

import json
with open('mitre_framework_dataset.jsonl', 'r') as f:
    for line in f:
        technique = json.loads(line)
        print(technique['id'], technique['technique'])

Red Team Operations:

Use the dataset to build attack playbooks or map exploits to techniques (e.g., T1190 to Log4Shell).
Request specific POCs or scripts for techniques (e.g., T1055.001 for DLL injection).

Threat Hunting:

Query the dataset to match IOCs or logs against ATT&CK techniques.
Example: Filter for T1566.001 to investigate phishing campaigns.

Reporting:

Generate vendor-ready reports by mapping CVEs to techniques for impact analysis.

Example Entry

{"id":"T1003.001","technique":"LSASS Memory","description":"Adversaries may dump LSASS memory to extract credentials.","example":"APT29 has used Mimikatz to dump LSASS memory.","source":"MITRE ATT&CK"}

Notes

Completeness: Covers all Enterprise techniques, including sub-techniques, as of v14.1.
Examples: APT29 (Cozy Bear) is used consistently for illustrative purposes. Request custom examples or POCs for specific techniques.
Updates: Reflects the latest MITRE ATT&CK framework as of September 20, 2025.
Security: Ensure the dataset is stored securely, as it contains detailed adversary TTPs.

Contributing

For additional POCs, scripts, or integrations (e.g., BloodHound, Metasploit).
This dataset is provided under the MIT License, with attribution to MITRE ATT&CK. Redistribution and use are permitted with proper credit to MITRE.

Contact

For questions, customizations, or operational support, reach out to the dataset maintainer by email [email protected].