Compromised Windows Server 2022 (simulation)

Simulated network intrusion as part of research to develop artificial intelligence / machine learning for post-breach triage. All information contained within the image (including but not limited to usernames and IP addresses) is synthetic.Simulated UK-based small office network running from Sept 2023 to Feb 2024. The administrator opened RDP to facilitate working from home. As part of the scenario, on 12th Feb 2024 discovered the server was no longer responding with 'Red Petya' ransomware displayed on the screen. Forensic experts were engaged, the disk decrypted and a forensic image taken in EnCase E01 format (also known as Expert Witness Format).Many thanks to my PhD supervisors, Prof Adrian Hopgood, Dr Patrick Wong and Dr Ian Kennedy. Thanks also to CMU Ghosts, VirtualBox, generatedata.com, Kali Linux, GreyNoise.io and many more.For further information, see the README.TXT file. To request ground truth for research purposes, please contact Benjamin Donnachie using [e-mail]

本数据集为开发用于入侵后分诊的人工智能/机器学习模型所构建的模拟网络入侵场景。数据集内所有图像包含的信息（包括但不限于用户名与IP地址）均为合成数据。
本数据集模拟了2023年9月至2024年2月期间运行的英国小型办公网络。该网络管理员开放了远程桌面协议（Remote Desktop Protocol, RDP）以支持居家办公。在此场景中，研究人员于2024年2月12日发现服务器无响应，屏幕上显示‘Red Petya’勒索软件提示。随后取证专家介入，对磁盘完成解密，并采用EnCase E01格式（亦称为专家见证格式）生成取证镜像。
特别感谢我的博士导师Adrian Hopgood教授、Patrick Wong博士与Ian Kennedy博士。同时感谢CMU Ghosts、VirtualBox、generatedata.com、Kali Linux、GreyNoise.io等机构与平台的支持。
如需获取更多详细信息，请查看README.TXT文件。若因研究用途需要申请获取基准真值（ground truth），请通过邮箱[e-mail]联系Benjamin Donnachie。