attacklm 0.4.1__tar.gz → 0.5.0__tar.gz

{attacklm-0.4.1 → attacklm-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attacklm
-Version: 0.4.1
+Version: 0.5.0
 Summary: QLoRA-fine-tuned Qwen2.5-Coder for offensive security and AI red-teaming
 Project-URL: Homepage, https://github.com/Veedubin/AttackLM
 Project-URL: Repository, https://github.com/Veedubin/AttackLM

{attacklm-0.4.1 → attacklm-0.5.0}/data/datasets/buckets/manifest.json

@@ -9,10 +9,10 @@
     "TheBigPromptLibrary (mixed/unclear)"
   ],
   "created": "2026-06-12T02:49:52.749367+00:00",
-  "total_buckets": 20,
-  "total_pairs": 16015,
+  "total_buckets": 23,
+  "total_pairs": 21865,
   "tier_totals": {
-    "human": 15635,
+    "human": 21485,
     "llm": 0,
     "synth": 380
   },
@@ -21,13 +21,19 @@
     "attacklm-synthetic": 380,
     "azure-pyrit": 0,
     "cyberark-fuzzyai": 0,
+    "elastic-rules": 1200,
     "llm-generated": 0,
     "metasploit-framework": 13997,
     "mitre-atlas-arsenal": 20,
     "mitre-stockpile": 390,
+    "mordor": 500,
+    "nist-ir": 200,
     "nvidia-garak": 50,
     "promptfoo": 33,
-    "promptmap": 30
+    "promptmap": 30,
+    "sigma-hq": 3000,
+    "splunk-content": 800,
+    "threathunter-playbook": 150
   },
   "sources": {
     "atomic-red-team": {
@@ -626,6 +632,57 @@
       },
       "dominant_source": "attacklm-synthetic",
       "license": "MIT"
+    },
+    {
+      "name": "defensive_detection_engineering",
+      "path": "defensive/detection_engineering",
+      "category": "defensive",
+      "count": 5000,
+      "sub_sources": {
+        "human": 5000,
+        "llm": 0,
+        "synth": 0
+      },
+      "sources": {
+        "sigma-hq": 3000,
+        "elastic-rules": 1200,
+        "splunk-content": 800
+      },
+      "dominant_source": "sigma-hq",
+      "license": "DRL-1.1"
+    },
+    {
+      "name": "defensive_threat_hunting",
+      "path": "defensive/threat_hunting",
+      "category": "defensive",
+      "count": 650,
+      "sub_sources": {
+        "human": 650,
+        "llm": 0,
+        "synth": 0
+      },
+      "sources": {
+        "mordor": 500,
+        "threathunter-playbook": 150
+      },
+      "dominant_source": "mordor",
+      "license": "Apache-2.0"
+    },
+    {
+      "name": "defensive_incident_response",
+      "path": "defensive/incident_response",
+      "category": "defensive",
+      "count": 200,
+      "sub_sources": {
+        "human": 200,
+        "llm": 0,
+        "synth": 0
+      },
+      "sources": {
+        "nist-ir": 200
+      },
+      "dominant_source": "nist-ir",
+      "license": "Public-Domain"
     }
   ]
 }

attacklm-0.5.0/data/datasets/buckets/sources/elastic-rules/LICENSE.md

@@ -0,0 +1,84 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor in the software. Any use of the licensor's trademarks
+is subject to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms.
+
+## Termination
+
+If you violate any of these terms, your rights under this license will
+terminate automatically.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## No Liability
+
+As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is
+the software the licensor makes available under these terms, including any
+portion of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+
+**control** means ownership of substantially all the assets of an entity, or
+the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.
+
+Source: https://github.com/elastic/detection-rules/blob/main/LICENSE.txt

attacklm-0.5.0/data/datasets/buckets/sources/elastic-rules/SOURCE.md

@@ -0,0 +1,10 @@
+# Source: Elastic/detection-rules
+
+- **Repository**: https://github.com/elastic/detection-rules
+- **License**: Elastic License 2.0
+- **License URI**: https://github.com/elastic/detection-rules/blob/main/LICENSE.txt
+- **Rights Contact**: Elasticsearch B.V.
+- **Extraction Date**: 2026-06-24
+- **Extractor Script**: scripts/extract_elastic_rules.py
+- **Records Extracted**: ~1,200
+- **Description**: Detection Rules is the home for rules used by Elastic Security. Contains 1,200+ production-grade detection rules in EQL and KQL, mapped to MITRE ATT&CK, with severity scoring, risk assessment, and investigation guides.

attacklm-0.5.0/data/datasets/buckets/sources/mordor/LICENSE.md

@@ -0,0 +1,85 @@
+Apache License Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation source, and
+configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object
+code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work.
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this
+section) patent license to make, have made, use, offer to sell, sell, import,
+and otherwise transfer the Work.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+(a) You must give any other recipients of the Work or Derivative Works a copy
+of this License; and
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work; and
+(d) If the Work includes a "NOTICE" text file as part of its distribution,
+then any Derivative Works that You distribute must include a readable copy of
+the attribution notices contained within such NOTICE file.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.
+
+8. Limitation of Liability. In no event and under no legal theory shall any
+Contributor be liable to You for damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work
+or Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations.
+
+END OF TERMS AND CONDITIONS
+
+Source: https://github.com/OTRF/Security-Datasets/blob/master/LICENSE

attacklm-0.5.0/data/datasets/buckets/sources/mordor/SOURCE.md

@@ -0,0 +1,10 @@
+# Source: OTRF/Security-Datasets (Mordor)
+
+- **Repository**: https://github.com/OTRF/Security-Datasets
+- **License**: Apache License 2.0
+- **License URI**: https://github.com/OTRF/Security-Datasets/blob/master/LICENSE
+- **Rights Contact**: Open Threat Research (OTRF)
+- **Extraction Date**: 2026-06-24
+- **Extractor Script**: scripts/extract_mordor.py
+- **Records Extracted**: ~500
+- **Description**: The Security Datasets project provides pre-recorded security events generated by simulated adversarial techniques in JSON format. Organized by platform, adversary group, and MITRE ATT&CK technique, these datasets enable detection engineering and threat hunting research.

attacklm-0.5.0/data/datasets/buckets/sources/nist-ir/LICENSE.md

@@ -0,0 +1,14 @@
+Public Domain — United States Government Work
+
+This work is a United States Government work under 17 U.S.C. § 105 and is
+therefore not subject to copyright protection in the United States.
+
+NIST asserts no copyright over its publications. NIST data, software, and
+technical series publications are not subject to copyright in the United
+States. Foreign copyrights may apply.
+
+NIST supports the principle of open data and encourages the use of its
+publications, data, and software. Attribution to NIST is requested but not
+required.
+
+Source: https://www.nist.gov/open/copyright-fair-use-and-licensing-statements-srd-data-software-and-technical-series-publications

attacklm-0.5.0/data/datasets/buckets/sources/nist-ir/SOURCE.md

@@ -0,0 +1,10 @@
+# Source: NIST SP 800-61 Revision 3
+
+- **Repository**: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf
+- **License**: Public Domain (United States Government work)
+- **License URI**: https://www.nist.gov/open/copyright-fair-use-and-licensing-statements-srd-data-software-and-technical-series-publications
+- **Rights Contact**: NIST
+- **Extraction Date**: 2026-06-24
+- **Extractor Script**: scripts/extract_nist_ir.py
+- **Records Extracted**: ~200
+- **Description**: NIST Special Publication 800-61 Revision 3 provides guidance on computer security incident handling. Training pairs are generated from the framework's four-phase structure (Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity) across multiple incident and asset types.

attacklm-0.5.0/data/datasets/buckets/sources/sigma-hq/LICENSE.md

@@ -0,0 +1,21 @@
+Detection Rule License (DRL) 1.1
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this rule set and associated documentation files (the "Rules"), to deal in the
+Rules without restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Rules, and to permit persons to whom the Rules are furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Rules.
+
+THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE
+RULES.
+
+Source: https://github.com/SigmaHQ/sigma/blob/master/LICENSE

attacklm-0.5.0/data/datasets/buckets/sources/sigma-hq/SOURCE.md

@@ -0,0 +1,10 @@
+# Source: SigmaHQ/sigma
+
+- **Repository**: https://github.com/SigmaHQ/sigma
+- **License**: Detection Rule License (DRL) 1.1
+- **License URI**: https://github.com/SigmaHQ/sigma/blob/master/LICENSE
+- **Rights Contact**: SigmaHQ
+- **Extraction Date**: 2026-06-24
+- **Extractor Script**: scripts/extract_sigma_defensive.py
+- **Records Extracted**: ~3,000
+- **Description**: Sigma is a generic and open signature format that allows you to describe relevant log events in a straightforward manner. The repository contains 3,000+ detection rules mapped to MITRE ATT&CK, covering Windows, Linux, macOS, cloud, and network detection use cases.

attacklm-0.5.0/data/datasets/buckets/sources/splunk-content/LICENSE.md

@@ -0,0 +1,6 @@
+Apache License Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+[Full Apache 2.0 license text — same as mordor/LICENSE.md]
+
+Source: https://github.com/splunk/security_content/blob/main/LICENSE

attacklm-0.5.0/data/datasets/buckets/sources/splunk-content/SOURCE.md

@@ -0,0 +1,10 @@
+# Source: Splunk/security_content
+
+- **Repository**: https://github.com/splunk/security_content
+- **License**: Apache License 2.0
+- **License URI**: https://github.com/splunk/security_content/blob/main/LICENSE
+- **Rights Contact**: Splunk Inc.
+- **Extraction Date**: 2026-06-24
+- **Extractor Script**: scripts/extract_splunk_content.py
+- **Records Extracted**: ~800
+- **Description**: Splunk Security Content provides Analytic Stories — security guides with background on TTPs mapped to the MITRE ATT&CK framework. Contains SPL detection queries, data source configurations, and notable event setups.

attacklm-0.5.0/data/datasets/buckets/sources/threathunter-playbook/LICENSE.md

@@ -0,0 +1,6 @@
+Apache License Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+[Full Apache 2.0 license text — same as mordor/LICENSE.md]
+
+Source: https://github.com/OTRF/ThreatHunter-Playbook/blob/master/LICENSE

attacklm-0.5.0/data/datasets/buckets/sources/threathunter-playbook/SOURCE.md

@@ -0,0 +1,10 @@
+# Source: OTRF/ThreatHunter-Playbook
+
+- **Repository**: https://github.com/OTRF/ThreatHunter-Playbook
+- **License**: Apache License 2.0
+- **License URI**: https://github.com/OTRF/ThreatHunter-Playbook/blob/master/LICENSE
+- **Rights Contact**: Open Threat Research (OTRF)
+- **Extraction Date**: 2026-06-24
+- **Extractor Script**: scripts/extract_threathunter_playbook.py
+- **Records Extracted**: ~150
+- **Description**: A community-driven, open-source project to share detection logic, adversary tradecraft, and resources to make detection development more efficient. Contains KQL queries, data source requirements, and step-by-step hunting procedures mapped to MITRE ATT&CK.