WASP: Adversarial Process-Injection Snapshots from Trusted Windows Binaries

Adversarial activity was simulated using Cobalt Strike C2, NimPlant C2, AsyncRAT and QuasarRAT across nine process-injection procedures. Each snapshot records process resources, CPU and I/O activity, executable-memory structure, modules, network state, thread context, image provenance and available ETW/kernel-audit measurements. The release includes explicit missingness indicators, grouping keys, feature definitions, experimental coverage records and integrity checksums.

Snapshot rows are repeated runtime measurements rather than independent attacks. Analyses should therefore preserve launch and experiment grouping. The release contains sanitised numerical telemetry only; it excludes Windows executables, malware binaries, payloads, injectors, credentials, IP addresses, raw memory and operational C2 configurations. - Folder Structure data/ ├── longitudinal_benign_dataset/ │ ├── windows10.csv │ ├── win2016_dc.csv │ └── win11_x64.csv │ └── controlled_paired_dataset/ ├── controlled_clean_snapshots.csv └── injection_labelled_snapshots.csv