APT Dataset repository

This is a repository of our work on implementing APT campaigns on Caldera, as well as the corresponding logs and attack paths.

Overview

This repository contains the dataset for the paper: Paper-name-here. The dataset contains the following:

1. MITRE Caldera adversary profiles and abilities.
2. Low-level telemetry logs.
3. MITRE techniques.

We implemented 24 diverse APT campaigns for 12 APTs for both Windows and Linux environments. The low-level telemetries as a result of these campaigns are shared along with the adversary profiles and abilities for reproducibility. Through this dataset we aim to empower researchers in developing advanced defense methods and advancing research for threat attribution.

APTs Testbed

The figure above depicts the testbed setup and network topology. The testbed is structured to ensure scalability and extensibility and is divided into three main components:

1. Attack Box: The attack box consists of a virtual machine where MITRE Caldera is installed, serving as the command center for launching and managing simulated APT operations. In addition to Caldera, the attack box also hosts a file-sharing HTTP server to facilitate payload delivery or file transfers between the attacker and the targets.
2. Targeted Devices: The targeted devices are a set of virtual machines running different operating systems, such as Windows, Linux, or any other OS. These machines represent the infrastructure typically found in enterprise environments and can be configured with various server roles like Active Directory, DNS, DHCP, or application services.
3. Monitoring Box: The monitoring box is an ELK stack deployment, which consumes and visualizes logs generated from the targeted devices. It allows for real-time tracking and analysis of the activities occurring on the targets.

The testbed is designed with extensibility and scalability at its core. The Attack Box can support multiple users and a diverse set of APT profiles, allowing for varied attack simulations and collaborative testing scenarios. The Targeted Devices can be expanded to include additional virtual machines running different operating systems or configured with additional services, such as web servers, databases, or other enterprise applications, providing a flexible environment that mirrors complex infrastructures. Furthermore, the Monitoring Box is adaptable, allowing for the integration of additional monitoring and analysis tools, such as SIEM systems, to enhance data visibility and provide a comprehensive view of simulated attack activities. This flexible setup enables the testbed to evolve alongside emerging threats and diverse research needs.

MITRE Caldera

MITRE Caldera is an automated threat emulation tool released by the MITRE corporation. Using this tool, organizations can perform automated cybersecurity assessments on their organization's infrastructure. It can significantly reduce the time and effort of cybersecurity professionals when performing cybersecurity testing. The figure above depicts a typical deployment for the MITRE Caldera server and agents.

• Caldera Agents: These are lightweight programs deployed on target machines to facilitate communication and control between the target and the main Caldera server. These agents handle the reliable execution of abilities—scripts or tasks designed to simulate adversary tactics on the target system(s).
• Caldera Abilities: These are specific implementations executed on target machines, each mapping directly to a tactic and technique from the MITRE ATT&CK framework. Designed to simulate adversary behavior, these abilities consist of several key components essential to their operation. Executors define how each ability runs on the target system, with different executors available for various operating systems, allowing command-line instructions to be executed in the shell of choice.
• Caldera Adversary Profiles: These correspond to the threat actor you are aiming to emulate during security testing or red-teaming operations. These profiles are composed of a sequence of abilities, which simulate the TTPs of real-world adversaries.
• Caldera Operations: Caldera operations are used to execute abilities on your target machines during a security simulation. These operations typically leverage the adversary profiles created earlier, ensuring that the sequence of abilities aligns with the tactics and techniques of the emulated threat actor.

Data Collection with ELK

The Elasticsearch stack (ELK) combines Elasticsearch, Logstash, and Kibana for real-time storage, analysis, and visualization of event logs. The figure above represents how we use ELK to collect our event logs.

• Elasticsearch: Elasticsearch, the stack’s core, is a distributed search engine optimized for speed and scalability, making it ideal for indexing and full-text search across large datasets. Its powerful query DSL supports complex searches, enabling nuanced data exploration critical for tracking security anomalies.
• Logstash: Logstash ingests logs from diverse sources like files, databases, and networks, centralizing log management. Its pipeline architecture supports log transformation through filters such as grok for parsing and mutate for field modification.
• Kibana: Kibana provides visualization tools for data in Elasticsearch, allowing users to create dashboards with bar charts, line graphs, and maps to reveal data trends and patterns. Interactive elements enable users to drill down into data, while alerting features aid in anomaly detection and incident response, making it a valuable asset for real-time monitoring.
• Beats: Beats are lightweight data shippers that send data directly to Logstash or Elasticsearch. Each Beat specializes in a specific data type.

In the Logstash configuration, we apply rule-based mapping to identify log events containing Indicators of Compromise (IoCs) and enrich them with relevant tactic and technique information. The logstash.conf file contains all the mapping rules used. The code snippet below shows an example of a rule to map low-level logs to Process Discovery technique. Keywords or phrases indicating a TTP are identified within event logs, and the log entry is enriched with MITRE ATT&CK tactic and technique details.

  # View process
  else if
    [message] =~ "/tmp/process-discovery.txt" or
    [command_executed] =~ "ps aux" or
    [command_executed] =~ "ps aux >> /tmp/process-discovery.txt" or
    [command_executed] =~ "/tmp/process-discovery.txt" or
    [command_executed] =~ "cat /tmp/process-discovery.txt" or
    [command_executed] =~ "ps aux" or

    [command_executed] =~ "Get-Process" or
    [command_executed] =~ "tasklist"
  {
    mutate { add_field => { "tactic" => "discovery" } }
    mutate { add_field => { "technique" => "Process Discovery" } }
  }

Implemented APTs

	MITRE	OS	# of Tech.	Telemetries	Techniques	Abilities
APT41	G0096	🐧 🐧 🖥️	12 11 20	✔️	✔️	✔️
APT39	G0087	🐧 🖥️	13 18	✔️	✔️	✔️
APT32	G0050	🐧 🖥️	11 18	✔️	✔️	✔️
APT10	G0045	🐧 🖥️	11 17	✔️	✔️	✔️
APT28	G0007	🐧 🖥️	12 17	✔️	✔️	✔️
APT5	G1023	🐧 🖥️	11 16	✔️	✔️	✔️
Aquatic Panda	G0143	🐧 🖥️	13 12	✔️	✔️	✔️
APT3	G0022	🐧 🖥️	18 18	✔️	✔️	✔️
Windshift	G0112	🐧 🖥️	12 11	✔️	✔️	✔️
Dragonfly	G0035	🐧 🖥️	12 18	✔️	✔️	✔️
APT29	G0016	🐧	18	✔️	✔️	✔️
APT35	G0059	🐧 🖥️	17 18	✔️	✔️	✔️

Other APTs: APT19, FIN.

Citation

To cite our dataset paper:

A. Syed and B. Nour and M. Pourzandi and C. Assi and M. Debbabi. "Comprehensive Advanced Persistent Threats Dataset," in IEEE Networking Letters, 2025, DOI: 10.1109/LNET.2025.3551989

@article{syed2025comprehensive,
  title     =  {{Comprehensive Advanced Persistent Threats Dataset}},
  author    =  {A. Syed and B. Nour and M. Pourzandi and C. Assi and M. Debbabi},
  journal   =  {IEEE Networking Letters},
  publisher =  {IEEE},
  year      =  {2025},
  doi       =  {10.1109/LNET.2025.3551989}
}

Acknowledgement

Thanks to Yousef Moustafa for implementing APT19, and Aya Al Haj for implementing FIN5.

License

CC-BY-4.0