{"id":42168,"date":"2021-08-05T16:00:44","date_gmt":"2021-08-05T16:00:44","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=95280"},"modified":"2021-08-05T16:00:44","modified_gmt":"2021-08-05T16:00:44","slug":"sharing-the-first-simuland-dataset-to-expedite-research-and-learn-about-adversary-tradecraft","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/sharing-the-first-simuland-dataset-to-expedite-research-and-learn-about-adversary-tradecraft\/","title":{"rendered":"Sharing the first SimuLand dataset to expedite research and learn about adversary tradecraft"},"content":{"rendered":"

Last month, we introduced the SimuLand project<\/a> to help security researchers around the world deploy lab environments to reproduce well-known attack scenarios, actively test detections, and learn more about the underlying behavior and implementation of adversary techniques. Since the release of the project, we have worked on a second phase to improve the current documentation and collect the telemetry generated after running the simulation plans in the lab guides.<\/p>\n

Today, we are excited to release a dataset generated from the first simulation scenario<\/a> to provide security researchers with an option to access data mapped to attack behavior without deploying the full environment.<\/p>\n

Sharing SimuLand data to expedite research<\/h2>\n

In our previous blog post, we showed a basic threat research methodology and where the SimuLand project fits. One of the next steps after a simulation is the collection and analysis of the data generated. We believe we can help expedite the research process by sharing the security events generated during testing.<\/p>\n

\"Map<\/p>\n

Figure 1: Map of a threat research methodology emphasizing SimuLand and Security Datasets.<\/em><\/p>\n

What security events?<\/h3>\n

The data that you could collect from a SimuLand scenario depends on the adversary tradecraft simulated and the security controls in place. Based on the first simulation scenario<\/a>, these are some of the security events you can collect and map to adversary behavior:<\/p>\n

\"Adversarial<\/p>\n

Figure 2: Adversarial techniques mapped to sources of data.<\/em><\/p>\n

How are security events collected?<\/h3>\n

Security events generated during a simulation can be collected using the following APIs:<\/p>\n

Where can I download the dataset from?<\/h3>\n

Rather than creating a new GitHub repository and storing all the security events generated, we are contributing every single dataset to the GitHub repository<\/a> of the Security Datasets project<\/a>. This is a community-driven effort developed to share pre-recorded datasets with the Information Security (InfoSec) community to expedite data analysis and threat research. This is another open-source initiative created and maintained by the Open Threat Research<\/a> community.<\/p>\n

You can find our first dataset here<\/a>.<\/p>\n

What can you do with the dataset?<\/h3>\n

Besides empowering security researchers to understand the underlying behavior of attack techniques, sharing a dataset also helps to:<\/p>\n