events across 20 scenarios
CAPTure dataset
Single-host and multi-host corpus details
CAPTure contains 200 controlled CALDERA–Procmon scenarios: 100 single-host and 100 multi-host runs. Each setting contains 20 scenarios at Mix-2, Mix-3, Mix-4, Mix-5, and Mix-6.
100 scenarios
Single-host setting
Multiple attack profiles execute concurrently on one Windows host while Procmon records the complete event stream.
CAPTure preserves the telemetry produced by the observed execution rather than assuming that every emulated action completes successfully. Some traces may therefore contain attempted, blocked, interrupted, or partially executed behaviors due to endpoint protections such as Microsoft Defender, operating-system policy, or other runtime conditions. These records are retained as part of the execution outcome and should not be interpreted as evidence that every scheduled technique completed successfully.
events across 20 scenarios
events across 20 scenarios
events across 20 scenarios
events across 20 scenarios
Single-host Mix-2 to Mix-6 summary
| Subset | Scenarios | Total events | Size (GB) | Benign events | Malicious events | Malicious ratio (%) |
|---|---|---|---|---|---|---|
| Mix-2 | 20 | 56,387,488 | 20.156 | 56,184,415 | 203,073 | 0.36 |
| Mix-3 | 20 | 74,132,852 | 26.255 | 73,887,204 | 245,648 | 0.33 |
| Mix-4 | 20 | 93,291,988 | 33.361 | 92,768,381 | 523,607 | 0.56 |
| Mix-5 | 20 | 108,500,137 | 38.206 | 107,871,661 | 628,476 | 0.58 |
| Mix-6 | 20 | 141,140,987 | 50.193 | 140,521,542 | 619,445 | 0.44 |
| Total | 100 | 473,453,452 | 168.171 | 471,233,203 | 2,220,249 | 0.47 |
Single-host per-run appendix statistics
Mix-2 — 20 runs
Loading…
Mix-3 — 20 runs
Loading…
Mix-4 — 20 runs
Loading…
Mix-5 — 20 runs
Loading…
Mix-6 — 20 runs
Loading…
100 scenarios
Multi-host setting
Participating Windows VM traces are collected separately and merged by recorded timestamps to represent coarse technique-level temporal order across hosts.
CAPTure preserves the telemetry produced by the observed execution rather than assuming that every emulated action completes successfully. Some traces may therefore contain attempted, blocked, interrupted, or partially executed behaviors due to endpoint protections such as Microsoft Defender, operating-system policy, or other runtime conditions. These records are retained as part of the execution outcome and should not be interpreted as evidence that every scheduled technique completed successfully.
events across 20 scenarios
events across 20 scenarios
events across 20 scenarios
events across 20 scenarios
events across 20 scenarios
Multi-host Mix-2 to Mix-6 summary
| Subset | Scenarios | Total events | Size (GB) | Benign events | Malicious events | Malicious ratio (%) |
|---|---|---|---|---|---|---|
| Mix-2 | 20 | 69,264,350 | 45.616 | 69,216,958 | 47,392 | 0.07 |
| Mix-3 | 20 | 72,763,238 | 48.018 | 72,676,830 | 86,408 | 0.12 |
| Mix-4 | 20 | 74,606,043 | 49.095 | 74,513,557 | 92,486 | 0.12 |
| Mix-5 | 20 | 76,663,997 | 50.130 | 76,566,035 | 97,962 | 0.13 |
| Mix-6 | 20 | 88,335,865 | 57.638 | 88,234,525 | 101,340 | 0.11 |
| Total | 100 | 381,633,493 | 250.497 | 381,207,905 | 425,588 | 0.11 |
Multi-host per-run appendix statistics
Mix-2 — 20 runs
Loading…
Mix-3 — 20 runs
Loading…
Mix-4 — 20 runs
Loading…
Mix-5 — 20 runs
Loading…
Mix-6 — 20 runs
Loading…
Complete CSV download: Download the full CAPTure dataset from Google Drive.