Dataset of APT Persistence Techniques on Windows Platforms Mapped to the MITRE ATT&CK Framework

Securing against intrusions is a crucial aspect of cybersecurity defense. As systems become more complex and new technologies are introduced, new threats are constantly emerging, putting all aspects of information systems at risk. To detect these threats and put in place effective response strategies, security professionals must test their solutions on real-world data. This underscores the importance of datasets to provide a simulation of attack scenarios. Advanced Persistent Threats (APT) carry out multi-stage attacks on an organization’s network, often spanning extended periods. Existing datasets on APT mainly focus on the different kill chain stages such as initial intrusion, privilege escalation, lateral movements, and command and control. However, the persistence phase, which is crucial for the sustainability of attacks, is often neglected [10]. In this work, we propose a dataset specifically dedicated to the persistence techniques employed by the threat actor targeting the Windows platform. Our work offers a detailed analysis of persistence mechanisms, relying on realistic virtualized environments and attack simulation tools, based on MITRE ATT&CK TTP (Tactics, Techniques, and Procedures) used by known APT groups. Publicly available at [26], the datasets include detailed instructions for access and use, ensuring reproducibility and usability for researchers and cybersecurity practitioners.