We introduce the Command Level Annotated Ransomware (CLEAR) dataset, a command-labeled large-scale collection of storage devices’ stream data, and show its effectiveness by using it to train models outperforming the current SotA