Merge pull request #1065 from splunk/npm

MHaggis · web-flow · commit 5f19dcf9bc26 · 2025-11-25T08:46:52.000-07:00
supply chaining
diff --git a/datasets/attack_techniques/T1195.001/npm/npm_supply_chain.yml b/datasets/attack_techniques/T1195.001/npm/npm_supply_chain.yml
@@ -0,0 +1,21 @@
+author: Michael Haag, Splunk
+id: 0e029cfc-ce81-48c4-ba74-598afa1ddbba
+date: '2025-10-28'
+description: Dataset generated in attack range for the attack technique of npm supply chain.
+environment: attack_range
+directory: npm
+mitre_technique:
+- T1195.001
+datasets:
+- name: workflow_yml_sysmon_linux
+  path: /datasets/attack_techniques/T1195.001/npm/workflow_yml_sysmon.log
+  sourcetype: sysmon:linux
+  source: Syslog:Linux-Sysmon/Operational
+- name: shai_hulud_workflow_sysmon
+  path: /datasets/attack_techniques/T1195.001/npm/shai_hulud_workflow_sysmon.log
+  sourcetype: sysmon:linux
+  source: Syslog:Linux-Sysmon/Operational
+- name: windows_workflow_sysmon
+  path: /datasets/attack_techniques/T1195.001/npm/windows_workflow_sysmon.log
+  sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/datasets/attack_techniques/T1195.001/npm/shai_hulud_workflow_sysmon.log b/datasets/attack_techniques/T1195.001/npm/shai_hulud_workflow_sysmon.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:07d7235f1a63513ddb92fe8fb7d45e4f1afcdb90e0b5e8381aeb2f0847447980
+size 21532
diff --git a/datasets/attack_techniques/T1195.001/npm/windows_workflow_sysmon.log b/datasets/attack_techniques/T1195.001/npm/windows_workflow_sysmon.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7d97125aa89a44a943604a166b58c8852d95f44d30fa0309cb3d92f2c6c8d6ca
+size 13192
diff --git a/datasets/attack_techniques/T1195.001/npm/workflow_yml_sysmon.log b/datasets/attack_techniques/T1195.001/npm/workflow_yml_sysmon.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3a57a9a1933720890fd70c23684349f82d9182f33044ffff7009c7330b001e71
+size 22920

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:07d7235f1a63513ddb92fe8fb7d45e4f1afcdb90e0b5e8381aeb2f0847447980`
	`3`	`+size 21532`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:7d97125aa89a44a943604a166b58c8852d95f44d30fa0309cb3d92f2c6c8d6ca`
	`3`	`+size 13192`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:3a57a9a1933720890fd70c23684349f82d9182f33044ffff7009c7330b001e71`
	`3`	`+size 22920`