crypto_c

tccontre · tccontre · commit 443d4db9f4b3 · 2024-12-17T15:17:03.000+01:00
diff --git a/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_log_process_tree.yml b/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_log_process_tree.yml
@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 844d92ee-bc81-11ef-82f7-acde48001122
+date: '2024-12-17'
+description: Generated datasets for powershell log process tree in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
+references:
+- https://devblogs.microsoft.com/scripting/automating-quser-through-powershell/
diff --git a/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff.log b/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:23b545c90a61d5712c6a815a3bf45257eebfd8404b35affca5ace71ee548f2f8
+size 12255

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:23b545c90a61d5712c6a815a3bf45257eebfd8404b35affca5ace71ee548f2f8`
	`3`	`+size 12255`