medusa_ransomware

t-contreras · t-contreras · commit 52629ee1c99c · 2025-03-17T14:54:49.000+01:00
diff --git a/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/mstsc_rdp_cmd.yml b/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/mstsc_rdp_cmd.yml
@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 5886e632-0336-11f0-bf1c-629be3538069
+date: '2025-03-17'
+description: Generated datasets for mstsc rdp cmd in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/mstsc_sysmon.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
+references:
+- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
diff --git a/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/mstsc_sysmon.log b/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/mstsc_sysmon.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d892e534679ed2509cab7d305841e9dc1bff77574aee64d1ab869c227d78931e
+size 9893
diff --git a/datasets/attack_techniques/T1059.003/delete_pwh_history/delete_pwh_history.yml b/datasets/attack_techniques/T1059.003/delete_pwh_history/delete_pwh_history.yml
@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 2a10561c-0336-11f0-bf1c-629be3538069
+date: '2025-03-17'
+description: Generated datasets for delete pwh history in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/delete_pwh_history/delete_pwh_history_file.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'
+references:
+- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
diff --git a/datasets/attack_techniques/T1059.003/delete_pwh_history/delete_pwh_history_file.log b/datasets/attack_techniques/T1059.003/delete_pwh_history/delete_pwh_history_file.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:be5b6850302e520c21383885e395e59e4e5a09c64333d644a501e5f9cb9e721f
+size 1323
diff --git a/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/ConsoleHost_History_deletion.yml b/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/ConsoleHost_History_deletion.yml
@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 469bf8a8-0337-11f0-bf1c-629be3538069
+date: '2025-03-17'
+description: Generated datasets for ConsoleHost History deletion in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/delete_pwh_history_file.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
+references:
+- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
diff --git a/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/HistorySavePath_powershell.log b/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/HistorySavePath_powershell.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:75de156569359e9e1ea44508621acc910552f2cf20f562f94ba6aa72b2a7992f
+size 3825
diff --git a/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/delete_pwh_history_file.log b/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/delete_pwh_history_file.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:be5b6850302e520c21383885e395e59e4e5a09c64333d644a501e5f9cb9e721f
+size 1323

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:d892e534679ed2509cab7d305841e9dc1bff77574aee64d1ab869c227d78931e`
	`3`	`+size 9893`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:be5b6850302e520c21383885e395e59e4e5a09c64333d644a501e5f9cb9e721f`
	`3`	`+size 1323`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:75de156569359e9e1ea44508621acc910552f2cf20f562f94ba6aa72b2a7992f`
	`3`	`+size 3825`