PleoMorph
/

ctem-enterprise-models

+{
+  "timestamp": "2025-11-26T10:59:07.631773",
+  "device": "mps",
+  "num_samples": 11104,
+  "num_classes": 164,
+  "input_dim": 384,
+  "red_team_agent": {
+    "parameters": 1292862,
+    "best_val_acc": 96.57657742500305,
+    "test_acc": 96.82063460350037,
+    "num_tactics": 14,
+    "num_techniques": 164,
+    "execution_modes": [
+      "sandbox",
+      "production",
+      "simulation"
+    ]
+  },
+  "vulnerability_agent": {
+    "parameters": 670122,
+    "best_val_acc": 96.57657742500305,
+    "test_acc": 96.94060683250427,
+    "num_vuln_types": 164,
+    "num_severity": 4
+  },
+  "label_mapping": {
+    "0": "ANONYMITY_EXPLOITATION",
+    "1": "All of these services use similar components under the hood,...",
+    "2": "Attackers use reconnaissance to identify organizational stru...",
+    "3": "Business Email Compromise",
+    "4": "By measuring these timing differences, attackers can infer w...",
+    "5": "COLLECTION",
+    "6": "CREDENTIAL_ACCESS",
+    "7": "CREDENTIAL_HARVESTING",
+    "8": "CRYPTOGRAPHIC_EXPLOITATION",
+    "9": "Cache Attacks In Computing Environments",
+    "10": "Chinese Hackers use Visual Studio Code to Target Asian Governments",
+    "11": "Common attack vectors include supplier payment redirection, ...",
+    "12": "Common vulnerability patterns include hardcoded credentials,...",
+    "13": "DATA_EXFILTRATION",
+    "14": "DEFENSE_EVASION",
+    "15": "EXPLOITING VULNERABLE EMAIL CLIENTS\n========================...",
+    "16": "EXTRACTED PATTERNS SUMMARY:\n===========================\nCVEs...",
+    "17": "Email clients represent a significant attack surface due to ...",
+    "18": "Exploiting Vulnerable Email Clients",
+    "19": "FIRMWARE_EXPLOITATION",
+    "20": "For this, we exploit a container escape vulnerability using ...",
+    "21": "HARDWARE_EXPLOITATION",
+    "22": "Here's how the attack works: We craft a malicious SavedModel...",
+    "23": "ICS_EXPLOITATION",
+    "24": "INITIAL_ACCESS",
+    "25": "IOT_EXPLOITATION",
+    "26": "In conclusion, AI/ML infrastructure is the new attack surfac...",
+    "27": "Initial access: exploit the MLflow SQL injection",
+    "28": "IoT devices present a massive attack surface with generally ...",
+    "29": "Iot Security And Bug Hunting",
+    "30": "KERBEROS DELEGATION ATTACKS\n===========================",
+    "31": "Kerberos Delegation Attacks",
+    "32": "LARGEST SUPPLY CHAIN HACK IN HISTORY ZOMG!!!!111",
+    "33": "LATERAL_MOVEMENT",
+    "34": "Let me demonstrate the exploit chain",
+    "35": "Let's start with the attack surface",
+    "36": "Let's talk about the tools we're using. Metasploit has modul",
+    "37": "MEMORY_CORRUPTION",
+    "38": "NETWORK_EXPLOITATION",
+    "39": "Our attack demonstrations show how compromising IoT devices ...",
+    "40": "Our exploit chain begins with a crafted email containing a m...",
+    "41": "Our first vulnerability is CVE-2024-8901 in TensorFlow Servi...",
+    "42": "PERSISTENCE",
+    "43": "Ransomware In Action MedusaLocker ReadText34",
+    "44": "Secret Handshakes Over Bluetooth Low Energy",
+    "45": "Secure your AI infrastructure before it becomes your biggest...",
+    "46": "Security Unit Testing And Automation",
+    "47": "The CUDA runtime can be exploited to escape container bounda...",
+    "48": "The Gremlin Stealer Malware",
+    "49": "The attack requires the victim to import a USB device, but c...",
+    "50": "The attack surface is determined by SPNs (Service Principal ...",
+    "51": "The attacks combine technical elements like domain spoofing ...",
+    "52": "The second vulnerability, CVE-2024-8902, affects PyTorch's m...",
+    "53": "The vulnerability exists in the way certain email clients ha...",
+    "54": "The vulnerability occurs when parsing USB packet headers - t...",
+    "55": "These attacks are particularly dangerous in cloud environmen...",
+    "56": "Today we'll discuss cache attacks and their implications acr...",
+    "57": "Traditional security testing tools focus on exploitation rat...",
+    "58": "Usb Over Ip Vulnerabilities",
+    "59": "We demonstrate how attackers use lookalike domains and email...",
+    "60": "We demonstrate how compromising a service account with deleg...",
+    "61": "We propose security unit testing that focuses on flaws rathe...",
+    "62": "We're using MITRE ATT&CK technique T1190 for initial access ...",
+    "63": "We've identified several attack vectors: Flush+Reload, Prime...",
+    "64": "We've tested these exploits against Fortune 500 companies' M...",
+    "65": "active_directory",
+    "66": "alternative_path",
+    "67": "api_exploitation",
+    "68": "apt_dns_profiling",
+    "69": "asrep_roasting",
+    "70": "attack",
+    "71": "attack_chain",
+    "72": "attack_flow",
+    "73": "attack_method",
+    "74": "attack_pattern",
+    "75": "attack_technique",
+    "76": "authentication_bypass",
+    "77": "automated_reconnaissance",
+    "78": "bgp",
+    "79": "big_data_exploitation",
+    "80": "bitcoin_transaction_malleability",
+    "81": "browser_exploitation",
+    "82": "civil_cyber",
+    "83": "cloudflare.bat",
+    "84": "comprehensive_attack_flow",
+    "85": "critical_dependency",
+    "86": "critical_point",
+    "87": "cross_account_service_manipulation",
+    "88": "cross_technique_vulnerability",
+    "89": "cve",
+    "90": "deleted files log",
+    "91": "dotnet",
+    "92": "exploitation_pathway",
+    "93": "fixed cve model",
+    "94": "fraud_detection_system",
+    "95": "golden_ticket",
+    "96": "hardware",
+    "97": "hardware_exploitation",
+    "98": "how hackers hide (Intro to Beacon Object Files - with Empire C2!)",
+    "99": "industrial_control_exploitation",
+    "100": "initial_access",
+    "101": "ios_forensics",
+    "102": "iot_exploitation",
+    "103": "javascript_exploitation",
+    "104": "kerberoasting",
+    "105": "kerberos_attack",
+    "106": "kernel",
+    "107": "mass_internet_reconnaissance",
+    "108": "memory_corruption",
+    "109": "mitre_technique",
+    "110": "mpc_wallets",
+    "111": "multiple blackhat transcripts",
+    "112": "nation_state_threat_attribution",
+    "113": "network_authentication_fuzzing",
+    "114": "network_infrastructure_exploitation",
+    "115": "network_protocol_evasion",
+    "116": "network_protocol_exploitation",
+    "117": "old files",
+    "118": "organized_financial_crime",
+    "119": "pass_the_hash",
+    "120": "pass_the_hash_detection",
+    "121": "pass_the_ticket",
+    "122": "permutation",
+    "123": "phishing",
+    "124": "platform_node",
+    "125": "pos_exploitation",
+    "126": "powershell_memory_analysis",
+    "127": "privilege_escalation",
+    "128": "proprietary_protocol_exploitation",
+    "129": "pylingual_attack",
+    "130": "pylingual_attack_flow",
+    "131": "pylingual_component",
+    "132": "python_opcode",
+    "133": "python_version_permutation",
+    "134": "python_version_variant",
+    "135": "requirements-realtime-attack-paths",
+    "136": "sample blackhat transcript",
+    "137": "scenario",
+    "138": "side_channel_attack",
+    "139": "silver_ticket",
+    "140": "social_engineering",
+    "141": "social_engineering_technical",
+    "142": "storage_infrastructure_exploitation",
+    "143": "strategic_threat_analysis",
+    "144": "supply_chain",
+    "145": "tech_permutation",
+    "146": "technical_permutation",
+    "147": "technique",
+    "148": "technique_specialization",
+    "149": "telecommunications_fraud",
+    "150": "threat_actor",
+    "151": "tool",
+    "152": "transcript embeddings validation report",
+    "153": "unknown",
+    "154": "verilog_hardware_exploitation",
+    "155": "voip_infrastructure_exploitation",
+    "156": "vulnerability",
+    "157": "vulnerability_chain",
+    "158": "vulnerability_cluster",
+    "159": "vulnerability_detail",
+    "160": "vulnerability_exploitation",
+    "161": "wearable_authentication",
+    "162": "web_exploitation",
+    "163": "wireless_protocol_attack"
+  }
+}