Test datasets
Public malware samples, detection rules, packet captures, attack logs, and IOC feeds you can use to test a cyber product or build detections. Each one is curated and comes with safety notes. Click any column heading to filter by it — type a name, pick a type, format or license — click the arrows to sort, and click a row for details.
Botnet command-and-control IP blocklists, plus a matching Suricata/Snort ruleset, free to download with no key.
Open full page →A community malware sample exchange with tags, signatures and hashes; samples ship in zip archives password-protected with "infected". Free under fair use, commercial use needs a subscription.
Open full page →Community-submitted malware IOCs (domains, IPs, URLs, hashes) from the last six months, exported every five minutes. Exports need a free abuse.ch Auth-Key.
Open full page →Malicious URLs used for malware distribution, exported as CSV, JSON, host files and IDS rules. Bulk exports need a free abuse.ch Auth-Key.
Open full page →Automatically generated feeds of active command-and-control infrastructure, refreshed several times a day.
Open full page →Five days of labelled benign and attack traffic (brute force, DoS, Heartbleed, web attacks, botnet, DDoS) from UNB's Canadian Institute for Cybersecurity, as full PCAPs and 80-feature flow CSVs.
Open full page →CISA's catalogue of CVEs confirmed exploited in the wild, the list US federal agencies must patch against — git history gives it a change log the official page lacks.
Open full page →CSE and UNB's labelled intrusion dataset — seven attack scenarios against a simulated 420-machine network, as PCAPs, Windows and Ubuntu event logs, and flow CSVs.
Open full page →Thirteen labelled botnet scenarios captured at CTU Prague in 2011 — botnet PCAPs plus bidirectional NetFlows of mixed botnet, normal and background traffic. The archive also includes the malware executables used.
Open full page →Granular cloud attack techniques (AWS, Azure, GCP, Kubernetes) that detonate against a real account, producing the audit-log telemetry cloud detections are tested against.
Open full page →662 prompts labelled benign or injection, in English and German — a small benchmark for prompt-injection classifiers.
Open full page →Damn Vulnerable Web Application — a PHP/MySQL target with adjustable difficulty levels for scanner and WAF testing.
Open full page →Elastic Security's production detection rules (EQL, KQL, ES|QL) with ATT&CK mappings and unit tests.
Open full page →Windows event log captures of ATT&CK techniques, organised by tactic — standard input for testing EVTX detections.
Open full page →1.9 million real CloudTrail events (2017-2020) from players attacking the flaws.cloud CTF, anonymised — genuine attacker behaviour for testing AWS detections.
Open full page →Google's example YARA-L detection rules and dashboards for Google Security Operations (formerly Chronicle).
Open full page →Unix binaries that can be abused to escape shells, escalate privileges or move files on a misconfigured system, with the exact commands for each.
Open full page →Industrial control system protocol captures (Modbus, DNP3, S7, BACnet). Unmaintained since 2020 but still the broadest free OT set.
Open full page →A vulnerable-by-design Kubernetes cluster environment with guided scenarios, for testing container and Kubernetes security products.
Open full page →Living Off The Land Binaries, Scripts and Libraries — Microsoft-signed Windows files attackers abuse, each with the commands and ATT&CK mapping as YAML.
Open full page →A curated catalogue of vulnerable and malicious Windows drivers with hashes, Sigma/YARA detections and blocklists. The repository also holds the driver binaries themselves.
Open full page →PCAPs of real malware infections with write-ups and indicators, published continuously since 2013. Archives are password-protected.
Open full page →vx-underground's collection of malware source code across decades and platforms. Treat as live — do not build or run outside an isolated lab.
Open full page →Microsoft's official Sentinel detections, hunting queries, workbooks, playbooks and data connectors, written in KQL. A very large repository.
Open full page →NVIDIA's LLM vulnerability scanner, whose probes are a maintained corpus of prompt-injection, jailbreak and data-leakage attacks.
Open full page →completely ridiculous API — a deliberately vulnerable microservice API covering the OWASP API Security Top 10, for testing API security products.
Open full page →A deliberately insecure web application covering the OWASP Top 10 — the standard target for testing DAST and WAF products.
Open full page →A deliberately insecure Java web application with guided lessons — a long-standing target for DAST, WAF and training.
Open full page →Panther's built-in detection rules and policies, written in Python with YAML metadata and unit tests per rule.
Open full page →Payloads and bypasses for web application testing, organised by vulnerability class — standard input for testing WAFs and DAST scanners.
Open full page →The community template library behind the nuclei scanner — thousands of YAML checks for CVEs, misconfigurations and exposures, including CISA KEV coverage.
Open full page →Proofpoint's free Emerging Threats ruleset for Suricata and Snort, updated daily — the baseline IDS signatures most network sensors ship with.
Open full page →A library of small, portable attack tests mapped to ATT&CK techniques — the common way to generate real telemetry for checking EDR and SIEM detections.
Open full page →Vulnerable-by-design AWS (and Azure) scenarios deployed with Terraform, for testing CSPM, CIEM and cloud detection products.
Open full page →Wordlists, fuzzing payloads and credential lists — standard input for testing scanners, WAFs and login protections.
Open full page →Pre-recorded security event datasets from simulated adversary techniques, packaged as JSON for replay into a SIEM.
Open full page →The main open repository of generic SIEM detection rules in Sigma format, mapped to ATT&CK.
Open full page →Florian Roth's actively maintained YARA rules and IOCs used by THOR and LOKI scanners.
Open full page →Curated attack telemetry generated with Atomic Red Team and replayable into Splunk, paired with Splunk Security Content detections.
Open full page →A pre-indexed Splunk dataset of a staged multi-stage intrusion across AWS, Azure, Windows and network sources, built for the Boss of the SOC CTF. Unmaintained since 2020.
Open full page →Splunk's analytic stories and SPL detections, each tied to test data in Splunk Attack Data.
Open full page →Modular Sysmon configuration mapped to ATT&CK — the baseline many EDR and log tests start from.
Open full page →Live malware samples for research, stored as password-protected archives. Handle only inside an isolated analysis VM.
Open full page →100 GB of raw traffic with nine attack families and 2.5 million labelled flow records from UNSW Canberra. Free for academic research; commercial use needs the authors' approval.
Open full page →Hundreds of pre-built vulnerable environments, one docker-compose file per CVE — targets for testing scanners and exploit detection.
Open full page →The Wireshark project's catalogue of sample PCAPs across hundreds of protocols — the widest protocol coverage available.
Open full page →Curated Windows event log Sigma rules and config files used by Hayabusa and Velociraptor's built-in Sigma support.
Open full page →Community YARA rule collection for malware families, packers and exploit kits. Largely unmaintained since 2024 — useful as a broad baseline, not as current coverage.
Open full page →