You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
This model is designed for defensive cybersecurity research, threat intelligence analysis, and authorized security operations only. By accessing this model, you confirm that you will use it solely for lawful and defensive purposes, and not to facilitate unauthorized access, attacks, or any malicious activity.
Log in or Sign Up to review the conditions and access this model content.
Mistral-Nemo-12B — MITRE ATT&CK CTI Specialist
A fine-tuned language model specialized in cyber threat intelligence, trained to identify and chain MITRE ATT&CK techniques from natural language attack scenario descriptions. Built on Mistral-Nemo-Instruct-2407 for precise instruction following and structured JSON output.
Model Overview
| Base model | unsloth/Mistral-Nemo-Instruct-2407-bnb-4bit |
| Parameters | 12B |
| Method | QLoRA 4-bit (r=16, alpha=16) |
| Context window | 128k tokens |
| Languages | English / French |
| Domain | Cybersecurity — CTI — MITRE ATT&CK v15 |
| Output format | Structured JSON |
| Selected checkpoint | checkpoint-1050 (lowest eval loss: ~1.169) |
Given a textual description of an attack scenario, this model produces a structured attack chain with MITRE ATT&CK technique IDs, names, descriptions, a confidence level, and underlying assumptions.
Usage
Prompt Format
### Instruction
Analyze the following text and identify the MITRE ATT&CK techniques involved.
Always use the most specific sub-technique available (e.g. T1566.001 not T1566).
Return strictly structured JSON. Only include techniques explicitly evidenced in the text.
### Context
{your_scenario_here}
### Response
Recommended System Prompt
You are an expert in offensive cybersecurity and cyber threat intelligence (CTI).
You analyze attack scenarios and identify MITRE ATT&CK techniques with precision,
including sub-techniques (e.g. T1059.003).
You ALWAYS respond in structured JSON with exactly these fields:
scenario_summary (causal chain, e.g. "Phishing → LSASS → PtH → DNS exfil"),
attack_chain (list of technique_id, name, description),
confidence_level (high/medium/low in lowercase),
assumptions (at least 2 contextual hypotheses).
Only include techniques explicitly evidenced in the input text.
IMPORTANT: always use the most precise sub-technique available.
Never use T1566 if T1566.001 is applicable.
Never use T1048 if T1048.003 is identifiable from context.
Example
Input:
An APT group sends a spearphishing email with an obfuscated VBA macro attachment.
The macro uses certutil.exe to decode a base64 payload. The payload establishes
an HTTPS beacon via Azure CDN domain fronting every 4 hours. Attackers dump LSASS
with Mimikatz, retrieve an NTLM hash, pivot via Pass-the-Hash, then exfiltrate
data via a DNS tunnel to their C2.
Output:
{
"scenario_summary": "Spearphishing attachment → certutil decode → domain fronting C2 → LSASS dump → PtH → DNS exfil",
"attack_chain": [
{
"technique_id": "T1566.001",
"name": "Spearphishing Attachment",
"description": "Adversaries may send spearphishing emails with a malicious attachment to gain access to victim systems."
},
{
"technique_id": "T1027",
"name": "Obfuscated Files or Information",
"description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents."
},
{
"technique_id": "T1140",
"name": "Deobfuscate/Decode Files or Information",
"description": "Base64 payload decoded on disk using certutil.exe before execution."
},
{
"technique_id": "T1090.004",
"name": "Domain Fronting",
"description": "Adversaries may take advantage of routing schemes in CDNs to obfuscate the true destination of HTTPS traffic."
},
{
"technique_id": "T1071.001",
"name": "Web Protocols",
"description": "C2 communication over HTTPS blending in with legitimate web traffic."
},
{
"technique_id": "T1003.001",
"name": "LSASS Memory",
"description": "Adversaries may attempt to access credential material stored in LSASS process memory."
},
{
"technique_id": "T1550.002",
"name": "Pass the Hash",
"description": "Adversaries may pass the hash using stolen password hashes to move laterally within an environment."
},
{
"technique_id": "T1048.003",
"name": "Exfiltration Over Unencrypted Non-C2 Protocol",
"description": "Data exfiltrated via DNS query encoding to an attacker-controlled server."
},
{
"technique_id": "T1071.004",
"name": "DNS",
"description": "Adversaries may communicate using the DNS application layer protocol to avoid detection."
}
],
"confidence_level": "high",
"assumptions": [
"No MFA on domain accounts",
"LSASS not protected by PPL",
"DNS traffic not filtered or monitored"
]
}
Python
from transformers import AutoTokenizer, AutoModelForCausalLM
import torch, json
model_id = "YOUR_USERNAME/mistral-nemo-mitre-attack"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
model_id,
torch_dtype=torch.bfloat16,
device_map="auto",
)
SYSTEM = (
"You are a CTI expert specialized in MITRE ATT&CK v15. "
"Always use the most specific sub-technique available. "
"Always respond in structured JSON with: "
"scenario_summary (causal chain), "
"attack_chain (technique_id, name, description), "
"confidence_level (high/medium/low), "
"assumptions (at least 2 hypotheses)."
)
scenario = """
An attacker exploits an SQL injection on a public web application
to drop a PHP webshell. Via the webshell, they steal IAM credentials
from the EC2 metadata service and create a persistent IAM account.
Data is then exfiltrated to an S3-compatible cloud storage service.
"""
messages = [
{"role": "system", "content": SYSTEM},
{"role": "user", "content": f"### Instruction\nAnalyze the following attack scenario.\n\n### Context\n{scenario.strip()}\n\n### Response"},
]
inputs = tokenizer.apply_chat_template(
messages,
tokenize=True,
add_generation_prompt=True,
return_tensors="pt",
).to(model.device)
outputs = model.generate(
inputs,
max_new_tokens=1024,
temperature=0.1,
do_sample=True,
)
response = tokenizer.decode(outputs[0][inputs.shape[1]:], skip_special_tokens=True)
print(json.dumps(json.loads(response), indent=2))
llama.cpp / Ollama (GGUF Q4_K_M)
# llama-server
./llama-server \
-m mistral_nemo_mitre_Q4_K_M.gguf \
--port 10002 \
--host 0.0.0.0 \
-ngl 99 \
-c 8192 \
-ctk q8_0 \
-ctv q8_0 \
--flash-attn \
--temp 0.1
# Ollama
ollama create mitre-nemo -f Modelfile
ollama run mitre-nemo
Training
Dataset
The training dataset was purpose-built for this model with three major improvements over prior versions:
- ID↔name anchor entries — ~720 entries explicitly repeating technique ID / name / description associations to prevent dissociation hallucinations
- 30 causal kill chains — full APT scenarios with logical technique sequencing (APT29, Lazarus, SolarWinds-style, ransomware, BEC, OT/SCADA…)
- Contrastive pairs — explicit examples distinguishing commonly confused techniques: T1566.001 vs T1566.002, T1048.003 vs T1567.002, T1003.001 vs T1003.006, T1558.003 vs T1558.001, T1027 vs T1620
- Coherence validation — entries where
scenario_summaryandattack_chainare inconsistent are automatically rejected
Split: 80% train / 10% val / 10% test
Hyperparameters
base_model: unsloth/Mistral-Nemo-Instruct-2407-bnb-4bit
method: QLoRA
quantization: 4-bit (bitsandbytes)
lora_r: 16
lora_alpha: 16
lora_dropout: 0
target_modules: [q_proj, k_proj, v_proj, o_proj,
gate_proj, up_proj, down_proj]
gradient_checkpointing: unsloth
per_device_train_batch_size: 2
gradient_accumulation_steps: 8
effective_batch_size: 16
num_train_epochs: 3
learning_rate: 2.0e-4
lr_scheduler_type: cosine
warmup_ratio: 0.05
optimizer: adamw_8bit
max_seq_length: 2048
bf16: true
Training Metrics
| Metric | Value |
|---|---|
| Training Loss (final) | 0.1462 |
| Training Loss (checkpoint-1050) | 0.1196 |
| Eval Loss (minimum, ~step 1300) | ~1.169 |
| Total steps | 4530 (3 epochs) |
| Tokens processed | 11 624 802 |
Performance
Evaluated on a reference multi-step APT scenario (spearphishing → LSASS → PtH → Kerberoasting → DNS exfil):
| Version | Base model | Correct techniques / expected |
|---|---|---|
| (this model) | Mistral-Nemo-12B | 7 / 12 |
Key improvements over previous versions: sub-technique precision (T1566.001 vs T1566, T1003.001 vs T1003), structured JSON consistency, name and description fields systematically populated, assumptions always present.
Hardware Requirements
| Format | Size | Min VRAM |
|---|---|---|
| GGUF Q4_K_M | ~7.0 GB | 10 GB |
| GGUF Q5_K_M | ~8.1 GB | 12 GB |
| BF16 merged | ~24 GB | 2× GPU or CPU offload |
Ethical Use
This model is intended for defensive cybersecurity purposes only — threat intelligence analysis, SOC operations, red team exercises within authorized engagements, and security research.
Any use of this model to facilitate unauthorized access, attacks, or malicious activities is strictly prohibited.
Citation
@misc{mistral-nemo-mitre-attack-2026,
title = {Mistral-Nemo-12B MITRE ATT{\&}CK CTI Specialist},
author = {Chris E.},
year = {2026},
publisher = {Hugging Face},
url = {https://huggingface.co/chrisbst48/mistral-nemo-mitre-attack}
}
License
Apache 2.0 — inherited from the Mistral-Nemo-Instruct-2407 base model.
- Downloads last month
- -
Hardware compatibility
Log In to add your hardware
4-bit
Model tree for chrisbst48/MITRE_ATTCK_CTI_Specialist_V1.0
Base model
unsloth/Mistral-Nemo-Instruct-2407-bnb-4bit