Blue Cape Security provides realistic DFIR datasets and enterprise attack simulations for software vendors, enterprise security teams, research organizations, and training providers. Our offerings are organized into four categories:

• A) Windows Forensic Investigation Scenarios Single- and multi-host Windows forensic investigations focused on endpoint analysis and artifact correlation.
• B) Enterprise DFIR Investigation Scenarios Enterprise-scale investigations combining endpoint, memory, network, and centralized telemetry across realistic incident response engagements.
• C) Enterprise Attack Simulation Datasets Complete enterprise attack simulations covering modern adversary tradecraft from initial access through domain compromise and data exfiltration.
• D) Custom Scenario Development Custom-built enterprise environments, attack simulations, and investigation datasets tailored to product validation, benchmarking, and research requirements.

Our evaluation datasets are built from realistic enterprise attack scenarios designed for DFIR, threat hunting, detection engineering, and incident response validation.

Unlike CTF-style exercises or synthetic datasets, every scenario is manually developed to emulate real attacker tradecraft and investigation workflows. All attacks are executed by hand within enterprise environments to generate authentic forensic artifacts and telemetry representative of real-world enterprise investigations.

The datasets are intended for internal product validation, benchmarking, research, and product development.

Complete bundles

Each dataset includes the underlying forensic evidence together with supporting investigation material, including scenario documentation, detailed investigation timelines, and analyst reports describing the attack progression and key investigative findings. This provides complete ground truth for validating DFIR workflows and product capabilities.

Interested in learning more or discussing your validation requirements? Contact us at [email protected] and we'd be happy to discuss the available datasets or a custom scenario tailored to your needs.

A) Windows Forensic Investigation Scenarios

Source: FOR200 – Practical Windows Forensic Investigation Scenarios

A collection of realistic Windows forensic investigations focused on endpoint analysis. Each scenario is built around a realistic security incident and requires investigators to reconstruct user activity, identify malicious behavior, and establish a defensible investigative timeline using standard Windows forensic techniques.

FOR001 – Disgruntled Manager's Exodus

Scenario

Following the unexpected resignation of Terra Nova Technologies' Chief Operating Officer, concerns arise that confidential company information may have been stolen prior to departure. Investigators must determine whether sensitive documents were accessed, staged, or exfiltrated and identify any attempts to conceal those activities before the employee left the organization.