license: mit
language:

• en
  task_categories:
• question-answering
• text-classification
  tags:
• mitre-attack
• cybersecurity
• threat-intelligence
• red-team
• blue-team
• soc
• security
  dataset_info:
  features:
  • name: id
    dtype: int64
  • name: technique_id
    dtype: string
  • name: technique_name
    dtype: string
  • name: tactic
    dtype: string
  • name: platforms
    dtype: list
  • name: difficulty
    dtype: string
  • name: question
    dtype: string
  • name: answer
    dtype: string
  • name: detection_guidance
    dtype: string
  • name: mitigation_summary
    dtype: string
  • name: example_scenario
    dtype: string
  • name: related_techniques
    dtype: list
  • name: keywords
    dtype: list
  • name: language
    dtype: string
    splits:
    train:
    num_bytes: 1400000
    num_examples: 475
    dataset_size: 1400000
    configs:
• config_name: default
  data_files:
  • split: train
    path: data/train-00000-of-00001.parquet

MITRE ATT&CK Techniques QA

A question–answer dataset covering 475 MITRE ATT&CK Enterprise techniques and sub-techniques,
designed for training and evaluating security-focused language models, RAG assistants for SOC
analysts, and red/blue/purple-team education.

Dataset Summary

Each record pairs a real ATT&CK technique ID with an instructive question, an original explanatory
answer (defensive framing), concise detection guidance, a single mitigation recommendation, a
fictional enterprise scenario, related technique IDs, and keywords.

Features / Schema

Example Record

{
  "id": 101,
  "technique_id": "T1222",
  "technique_name": "File and Directory Permissions Modification",
  "tactic": "Defense Impairment",
  "platforms": ["ESXi", "Linux", "Windows", "macOS"],
  "difficulty": "Beginner",
  "question": "How can defenders detect and prevent attackers from modifying file and directory permissions to weaken security controls?",
  "answer": "File and Directory Permissions Modification is a defense-impairment technique in which an adversary alters the access control settings on files, folders, or special objects so that protective mechanisms can be bypassed or security tooling is prevented from operating. On Linux and macOS the attacker may use chmod, chown, or setfacl to grant world-writable access to scripts that load at boot or to audit configuration files, while on Windows icacls or PowerShell cmdlets can loosen access control lists on security logs, scheduled task files, or endpoint-agent directories. Weakening permissions lets malware persist, hide, or stop defenders from reading critical evidence. From a defensive standpoint you should treat any unexpected permission change on security-relevant paths as a high-severity event. Enable and forward audit events for permission changes, and baseline the expected permission set for protected directories so deviations are obvious. Use file-integrity monitoring to alert on ACL or ownership changes outside approved change windows. Restrict who can modify permissions through the principle of least privilege, and protect administrative accounts with strong authentication. Regularly review group memberships and inherited permissions, because attackers often exploit overly broad grants that already exist. Automated remediation that restores known-good permissions helps contain the technique quickly.",
  "detection_guidance": "Monitor audit logs for chmod/chown/setfacl (Linux/macOS) and icacls/Set-Acl (Windows) on security-relevant paths; alert on world-writable changes to protected dirs and unexpected ownership changes.",
  "mitigation_summary": "Apply least-privilege and protect security-critical paths with immutable attributes or file-integrity monitoring that restores known-good permissions.",
  "example_scenario": "A regional bank's Linux log server had its audit rules file made world-writable by a compromised service account, allowing an intruder to suppress logging of later activity until integrity monitoring flagged the change.",
  "related_techniques": ["T1687", "T1556.003", "T1222.002", "T1666"],
  "keywords": ["file permissions", "acl", "chmod", "defense impairment", "integrity monitoring", "least privilege"],
  "language": "English"
}

Usage

Load with the datasets library:

from datasets import load_dataset

ds = load_dataset("ismailtasdelen/mitre-attack-techniques-qa")
print(ds["train"][0])  # first record

Or iterate locally:

for row in ds["train"]:
    print(row["technique_id"], "-", row["tactic"], "-", row["question"])

The dataset is distributed as a single Parquet file under data/train-00000-of-00001.parquet.

Tactics Covered (16, all Enterprise)

Reconnaissance, Resource Development, Initial Access, Execution, Persistence,
Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement,
Collection, Command and Control, Exfiltration, Impact, Stealth, Defense Impairment.

Note: Stealth and Defense Impairment are tactics present in the current Enterprise ATT&CK
STIX release; the dataset reflects the tactic assignments from that source.

Intended Use

• Fine-tuning instruction/QA models on MITRE ATT&CK.
• Building or evaluating RAG / knowledge-base assistants for SOC analysts and threat intel.
• Red/blue/purple team education and exercise scenarios.
• Benchmarking technique-classification accuracy of LLMs.

Limitations

• Answers reflect ATT&CK knowledge at time of writing; always cross-check against the
  official MITRE ATT&CK® website for current technique definitions.
• Covers 475 technique/sub-technique IDs (of many); not exhaustive of all sub-techniques.
• Explanations are original wording, not verbatim ATT&CK descriptions.

Safety & Content Notes

• Content is defensive: it teaches identification, detection, and mitigation of adversary
  behavior. It does not provide weaponized step-by-step attack tooling.

License

Released under the MIT License.

Citation

@dataset{mitre_attack_techniques_qa,
  title        = {MITRE ATT&CK Techniques QA Dataset},
  author       = {ismailtasdelen},
  year         = {2026},
  publisher    = {Hugging Face},
  url          = {https://huggingface.co/datasets/ismailtasdelen/mitre-attack-techniques-qa}
}