MITRE ATT&CK 安全技能训练数据集

{
  "entry_id": "ATTACK-TRN-2024-0000891",
  "technique_metadata": {
    "technique_id": "T1003",
    "name": "OS凭证转储",
    "tactic": "Credential Access",
    "platform": ["Windows", "Linux"],
    "permissions_required": "Administrator / root",
    "data_sources": ["Process Creation", "File Access", "API Monitoring"]
  },
  "attack_description": {
    "description": "攻击者从操作系统和软件中提取账户凭证（哈希、明文密码、Kerberos票据），用于横向移动和权限提升。常见手段包括LSASS内存转储、SAM注册表提取、/etc/shadow读取等。",
    "procedure_example": "APT28使用Mimikatz从lsass.exe进程内存中提取NTLM哈希和明文密码，通过sekurlsa::logonpasswords命令一次性获取所有登录凭证。",
    "detection_recommendation": "监控对LSASS进程的访问（Sysmon Event ID 10）、SAM/SYSTEM注册表访问、异常进程注入行为。"
  },
  "detection": {
    "detection_type": "Signature + Behavioral",
    "data_source_required": ["Sysmon", "Windows Security Log", "EDR"],
    "detection_logic": "检测Mimikatz命令行参数（sekurlsa::、lsadump::）、procdump针对lsass.exe的调用、异常DLL加载到LSASS进程空间。"
  },
  "mitigation": {
    "mitigation_id": "M1043",
    "mitigation_name": "凭证保护",
    "mitigation_description": "启用Credential Guard、LSA保护（RunAsPPL）、限制Debug权限、使用Windows Defender ASR规则阻止LSASS访问。"
  },
  "procedure_example": {
    "example_command": "mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"",
    "example_tool": "Mimikatz 2.2.0",
    "procedure_description": "通过Debug权限提升后从LSASS内存中提取登录凭证，输出包括NTLM Hash、明文密码（如WDigest启用）和Kerberos票据。"
  },
  "pcap_info": {
    "pcap_file": "T1003_mimikatz_cred_dump_20240203.pcap",
    "pcap_md5": "b7e3f15d28a936014c8729e1f53a6078",
    "pcap_size": "189234",
    "flow_signature": "SMB流量异常 + Kerberos TGT请求频率突增，源进程为mimikatz.exe"
  },
  "answer": {
    "is_attack": true,
    "attack_type": "凭证窃取",
    "attck_phase": "Credential Access",
    "true_positive_rate": 0.99
  }
}

{
  "entry_id": "ATTACK-TRN-2024-0002014",
  "technique_metadata": {
    "technique_id": "T1078",
    "name": "有效账户",
    "tactic": "Persistence / Privilege Escalation / Defense Evasion",
    "platform": ["Windows", "Linux", "macOS", "AWS", "Azure"],
    "permissions_required": "User",
    "data_sources": ["Authentication Logs", "Process Creation", "CloudTrail"]
  },
  "attack_description": {
    "description": "攻击者使用被盗、泄露或默认的合法账户凭证获取初始访问权限、维持持久化或提升权限。包括域账户、本地账户、云服务账户（AWS IAM、Azure AD）等。",
    "procedure_example": "APT41利用前期钓鱼获取的VPN账户凭证登录企业内网，通过RDP横向移动到域控制器，使用域管理员账户创建后门账户。",
    "detection_recommendation": "监控异常登录时间/地点、多因素认证失败、新增账户创建（Event ID 4720）、特权账户的异常使用模式。"
  },
  "detection": {
    "detection_type": "Analytics + UEBA",
    "data_source_required": ["Windows Security Log", "Azure AD Sign-in Logs", "VPN Logs"],
    "detection_logic": "检测不可能旅行（impossible travel）登录、异常时间登录、新增特权账户、服务账户交互式登录（Event ID 4624 Logon Type 2/10）。"
  },
  "mitigation": {
    "mitigation_id": "M1027",
    "mitigation_name": "账户管理",
    "mitigation_description": "实施最小权限原则、定期审计账户权限、强制多因素认证（MFA）、禁用默认账户、实施密码轮换策略和PAM方案。"
  },
  "procedure_example": {
    "example_command": "net user backdoor_admin P@ssw0rd!2024 /add && net localgroup Administrators backdoor_admin /add",
    "example_tool": "Windows net command / PowerShell",
    "procedure_description": "创建名为backdoor_admin的本地账户并将其加入Administrators组，用于长期持久化访问。"
  },
  "pcap_info": {
    "pcap_file": "T1078_rogue_account_rdp_20240311.pcap",
    "pcap_md5": "c5129f84e703b2d16a85740c218e3f91",
    "pcap_size": "567890",
    "flow_signature": "RDP登录（TCP 3389）+ 新账户首次认证 + 非工作时间登录模式"
  },
  "answer": {
    "is_attack": true,
    "attack_type": "账户滥用",
    "attck_phase": "Persistence / Privilege Escalation",
    "true_positive_rate": 0.95
  }
}