diff --git a/datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.log b/datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.log new file mode 100644 index 000000000..32ae8ecec --- /dev/null +++ b/datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:49ae5741c73c977da5b1523a651b72fb25b38eed06e26b2718b4a2a9c1c073d7 +size 1999 diff --git a/datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.yml b/datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.yml new file mode 100644 index 000000000..9d3f5605e --- /dev/null +++ b/datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: 0d4fde14-e346-4159-b596-0a99e65c4daa +date: '2026-09-16' +description: Dataset generated in attack range for the attack technique of executing commands in a for loop using cmd.exe. +environment: attack_range +directory: cmd_for_loop +mitre_technique: +- T1059.003 +datasets: +- name: cmd_for_loop + path: /datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.log b/datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.log new file mode 100644 index 000000000..848dbe936 --- /dev/null +++ b/datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0003b303288f2949682a95125871c21bf7ea1e8205987125ee55f546152b47d6 +size 14285 diff --git a/datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.yml b/datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.yml new file mode 100644 index 000000000..aafde82ea --- /dev/null +++ b/datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: c7976c6a-dca8-4cb1-aab2-1b5ae9b23c4c +date: '2026-09-16' +description: Dataset generated in attack range for the attack technique of executing JavaScript scripts using Node.js. +environment: attack_range +directory: node_execute_js_script +mitre_technique: +- T1059.007 +datasets: +- name: node_execute_js_script + path: /datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.log b/datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.log new file mode 100644 index 000000000..73f62384e --- /dev/null +++ b/datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:87748425b33f587badd8c1e10305ca32ad843b9e59063beb18037c6ef3bec4f3 +size 33895 diff --git a/datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.yml b/datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.yml new file mode 100644 index 000000000..a1c74da3f --- /dev/null +++ b/datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: e8114076-32b2-49c0-8874-9ee2bbb8ff3f +date: '2026-09-16' +description: Dataset generated in attack range for the attack technique of communicating with a remote host using the finger protocol. +environment: attack_range +directory: finger_remote_host +mitre_technique: +- T1071 +datasets: +- name: finger_remote_host + path: /datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.log b/datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.log new file mode 100644 index 000000000..a4a5fb926 --- /dev/null +++ b/datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ab6f5f1ff33682e764a019c4fd81b852021ef0f4762cb282286b44585dcf7a56 +size 3552 diff --git a/datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.yml b/datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.yml new file mode 100644 index 000000000..0769bcdfd --- /dev/null +++ b/datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: ad1bad42-77f0-41e6-a3f5-7c9508638440 +date: '2026-09-16' +description: Dataset generated in attack range for the attack technique of accessing IronLanguages repository. +environment: attack_range +directory: ironlanguage_download +mitre_technique: +- T1105 +datasets: +- name: ironlanguage_download + path: /datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational