From 27c7487eb1c1f2aa805c1b7b898a92bb15db73f2 Mon Sep 17 00:00:00 2001 From: Radka Date: Thu, 17 Sep 2026 10:24:37 +0200 Subject: [PATCH] initial commit --- .../osascript_spawns_shell_process.log | 3 +++ .../osascript_spawns_shell_process.yml | 14 ++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log create mode 100644 datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.yml diff --git a/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log b/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log new file mode 100644 index 00000000..4f53a83b --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:068fc2a08024b90e918450508854912bf36882e15767ca8fac62abcd7c10c29d +size 1999 diff --git a/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.yml b/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.yml new file mode 100644 index 00000000..1743db00 --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.yml @@ -0,0 +1,14 @@ +author: Radka Viskova +id: 2e08f2f4-d82c-4638-a82c-796dc3748448 +date: '2026-09-17' +description: Generated dataset for osascript execution of shell process with osquery and endpoint security. +environment: TalosOffensiveLab +directory: osascript +mitre_technique: +- T1059.002 +- T1059.004 +datasets: +- name: osascript_spawns_shell_process + path: /datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log + sourcetype: osquery:results + source: osquery