WinLOLBIN-GT: A Behavioural Ground Truth Dataset for ML-Based Detection of Windows LOLBIN Abuse

Windows Living-Off-the-Land Binary Ground Truth (WinLOLBIN-GT) is a labelled behavioural ground truth dataset developed to support machine learning-based detection of Windows Living-Off-the-Land Binary (LOLBin) abuse. The dataset was constructed using a controlled laboratory testbed, where benign administrative activity and malicious LOLBin execution patterns were generated, captured, validated, and labelled. Each event reflects realistic System Monitor (Sysmon) Event ID 1 process creation behaviour, including command-line structure, parent-child process relationships, file paths, user context, and mapped behavioural indicators.

The dataset contains 10,006,645 processed rows, consisting of 55 behavioural features and one model_text training field, alongside 10,000,000 unprocessed rows. The labelling scheme uses 0 for benign activity and 1 for malicious activity. Every malicious row is mapped to a MITRE Adversarial Tactics, Techniques, and Common Knowledge (MITRE ATT&CK) technique identifier. The dataset sources include the Living Off the Land Binaries and Scripts (LOLBAS) Project catalogue, Atomic Red Team test procedures, a Living Off the Land Libraries (libLOL) attacker command library, and publicly available threat intelligence reports.

Windows Living-Off-the-Land Binary Ground Truth (WinLOLBIN-GT) was used to train machine learning models for Windows Living-Off-the-Land Binary (LOLBin) abuse detection and was evaluated in a Security Information and Event Management (SIEM) deployment setting. The trained model correctly detected unseen Windows Living-Off-the-Land Binary (LOLBin) attack activity with 99% accuracy under the controlled testbed evaluation. The dataset generation scripts are available at: https://github.com/daniyyell-dev/WinLOLBIN-GT-dataset