From 371eecfa4aee361fbde28f418828fe056c37e637 Mon Sep 17 00:00:00 2001 From: Radka Date: Thu, 17 Sep 2026 10:53:35 +0200 Subject: [PATCH 1/3] initial commit --- ...pt_JavaScript_command_execution_Objective-C.log | 3 +++ ...pt_JavaScript_command_execution_Objective-C.yml | 14 ++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log create mode 100644 datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.yml diff --git a/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log new file mode 100644 index 00000000..1df5a662 --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b76b07011b47c545e5a9cd9b8a0e0375301a7bcc051ea8799d06f75d855d6a9b +size 2122 diff --git a/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.yml b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.yml new file mode 100644 index 00000000..a93e4268 --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.yml @@ -0,0 +1,14 @@ +author: Radka Viskova +id: c3d39ccd-29c3-4a71-9e26-986f9218af2d +date: '2026-09-17' +description: Generated dataset for osascript execution of JavaScript code containing Objective-C references with osquery and endpoint security. +environment: TalosOffensiveLab +directory: osascript +mitre_technique: +- T1059.002 +- T1059.007 +datasets: +- name: osascript_JavaScript_command_execution_Objective-C + path: /datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log + sourcetype: osquery:results + source: osquery From d47071cf833e3ee96c4b7602c48a39310669f45e Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 18 Sep 2026 12:27:34 +0200 Subject: [PATCH 2/3] fixed name to follow convention --- ...pt_JavaScript_command_execution_Objective_C.log | 3 +++ ...pt_JavaScript_command_execution_Objective_C.yml | 14 ++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log create mode 100644 datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.yml diff --git a/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log new file mode 100644 index 00000000..1df5a662 --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b76b07011b47c545e5a9cd9b8a0e0375301a7bcc051ea8799d06f75d855d6a9b +size 2122 diff --git a/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.yml b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.yml new file mode 100644 index 00000000..3c97cf05 --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.yml @@ -0,0 +1,14 @@ +author: Radka Viskova +id: c3d39ccd-29c3-4a71-9e26-986f9218af2d +date: '2026-09-17' +description: Generated dataset for osascript execution of JavaScript code containing Objective-C references with osquery and endpoint security. +environment: TalosOffensiveLab +directory: osascript +mitre_technique: +- T1059.002 +- T1059.007 +datasets: +- name: osascript_JavaScript_command_execution_Objective_C + path: /datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log + sourcetype: osquery:results + source: osquery \ No newline at end of file From aedb8571827577bd6cbb61088ad928b11fd95f3d Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 18 Sep 2026 12:32:03 +0200 Subject: [PATCH 3/3] removed files renamed to follow convention --- ...pt_JavaScript_command_execution_Objective-C.log | 3 --- ...pt_JavaScript_command_execution_Objective-C.yml | 14 -------------- 2 files changed, 17 deletions(-) delete mode 100644 datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log delete mode 100644 datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.yml diff --git a/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log deleted file mode 100644 index 1df5a662..00000000 --- a/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:b76b07011b47c545e5a9cd9b8a0e0375301a7bcc051ea8799d06f75d855d6a9b -size 2122 diff --git a/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.yml b/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.yml deleted file mode 100644 index a93e4268..00000000 --- a/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.yml +++ /dev/null @@ -1,14 +0,0 @@ -author: Radka Viskova -id: c3d39ccd-29c3-4a71-9e26-986f9218af2d -date: '2026-09-17' -description: Generated dataset for osascript execution of JavaScript code containing Objective-C references with osquery and endpoint security. -environment: TalosOffensiveLab -directory: osascript -mitre_technique: -- T1059.002 -- T1059.007 -datasets: -- name: osascript_JavaScript_command_execution_Objective-C - path: /datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective-C/osascript_JavaScript_command_execution_Objective-C.log - sourcetype: osquery:results - source: osquery