Skip to content

Commit 7e8bc30

Browse files
author
Patrick Bareiss
committed
fixed failed validation
1 parent b62b85f commit 7e8bc30

File tree

44 files changed

+367
-276
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+367
-276
lines changed

‎datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ id: f4e7c8fc-c534-415b-9f99-9e9419096db5
33
date: '2025-07-09'
44
description: 'Sample of ESXi syslog events showing attempts to access sensitive files on the ESXi system.'
55
environment: custom
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files.log
8-
sourcetypes:
9-
- vmw-syslog
10-
references:
11-
- https://attack.mitre.org/techniques/T1003/008
6+
directory: esxi_sensitive_files
7+
mitre_technique:
8+
- T1003.008
9+
datasets:
10+
- name: esxi_shell_enabled
11+
path: /datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files.log
12+
sourcetype: vmw-syslog
13+
source: vmw-syslog

‎datasets/attack_techniques/T1005/esxi_vm_download/esxi_vm_download.yml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
author: Raven Tait, Splunk
22
id: 6cbe3ac7-510d-49ab-983e-7ee504d6f386
33
date: '2025-07-09'
4-
description: 'Sample of ESXi syslog events showing downloading of VMs from ESXi using remote tools."
4+
description: Sample of ESXi syslog events showing downloading of VMs from ESXi using remote tools.
55
environment: custom
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1005/esxi_vm_download/esxi_vm_download.log
8-
sourcetypes:
9-
- vmw-syslog
10-
references:
11-
- https://attack.mitre.org/techniques/T1005
6+
directory: esxi_vm_download
7+
mitre_technique:
8+
- T1005
9+
datasets:
10+
- name: vmw-syslog
11+
path: /datasets/attack_techniques/T1005/esxi_vm_download/esxi_vm_download.log
12+
sourcetype: vmw-syslog
13+
source: vmw-syslog

‎datasets/attack_techniques/T1014/medusa_rootkit/medusa.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,11 @@ id: 2481e83c-b888-4383-bc61-9d292f4e03ea
33
date: '2025-08-05'
44
description: Logs from usage of the Medusa rootkit on a Linux host.
55
environment: custom
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/medusa_rootkit/sysmon_linux.log
8-
sourcetypes:
9-
- XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
10-
- Syslog:Linux-Sysmon/Operational
11-
references:
12-
- https://attack.mitre.org/techniques/T1014/
6+
directory: medusa_rootkit
7+
mitre_technique:
8+
- T1014
9+
datasets:
10+
- name: sysmon_linux
11+
path: /datasets/attack_techniques/T1014/medusa_rootkit/sysmon_linux.log
12+
sourcetype: sysmon:linux
13+
source: Syslog:Linux-Sysmon/Operational

‎datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_net_discovery.yml‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,15 @@ id: e0c0d5e5-8c29-4db3-9d27-d42f31c552f5
33
date: '2025-08-15'
44
description: Generated datasets for MacOS net discovery
55
environment: vm
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log
8-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_network_discovery.log
9-
sourcetypes:
10-
- osquery:results
11-
references:
12-
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
6+
directory: macos_net_discovery
7+
mitre_technique:
8+
- T1016
9+
datasets:
10+
- name: osquery:results
11+
path: /datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log
12+
sourcetype: osquery:results
13+
source: osquery:results
14+
- name: osquery:results
15+
path: /datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_network_discovery.log
16+
sourcetype: osquery:results
17+
source: osquery:results

‎datasets/attack_techniques/T1021.001/bmc_creation/bmc_creation.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ id: 2050c38a-6d1e-11f0-86b8-629be3538068
33
date: '2025-07-30'
44
description: Generated datasets for bmc creation in attack range.
55
environment: attack_range
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/bmc_creation/bmc_creation.log
8-
sourcetypes:
9-
- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
10-
references:
11-
- https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
6+
directory: bmc_creation
7+
mitre_technique:
8+
- T1021.001
9+
datasets:
10+
- name: windows-sysmon
11+
path: /datasets/attack_techniques/T1021.001/bmc_creation/windows-sysmon.log
12+
sourcetype: XmlWinEventLog
13+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

‎datasets/attack_techniques/T1021.001/mstsc_admini/mstsc_admini.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ id: bf432e34-6d3b-11f0-86b8-629be3538068
33
date: '2025-07-30'
44
description: Generated datasets for mstsc admini in attack range.
55
environment: attack_range
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/mstsc_admini/mstsc_admin.log
8-
sourcetypes:
9-
- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
10-
references:
11-
- https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
6+
directory: mstsc_admini
7+
mitre_technique:
8+
- T1021.001
9+
datasets:
10+
- name: windows-sysmon
11+
path: /datasets/attack_techniques/T1021.001/mstsc_admini/windows-sysmon.log
12+
sourcetype: XmlWinEventLog
13+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

‎datasets/attack_techniques/T1021.001/rdp_creation/rdp_creation.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ id: 30e07cc0-6d25-11f0-86b8-629be3538068
33
date: '2025-07-30'
44
description: Generated datasets for rdp creation in attack range.
55
environment: attack_range
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/rdp_creation/deafault_rdp_created.log
8-
sourcetypes:
9-
- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
10-
references:
11-
- https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
6+
directory: rdp_creation
7+
mitre_technique:
8+
- T1021.001
9+
datasets:
10+
- name: windows-sysmon
11+
path: /datasets/attack_techniques/T1021.001/rdp_creation/windows-sysmon.log
12+
sourcetype: XmlWinEventLog
13+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

‎datasets/attack_techniques/T1021.001/rdp_session_established/rdp_session_established.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ id: d96eb482-6dee-11f0-b544-629be3538069
33
date: '2025-07-31'
44
description: Generated datasets for rdp session established in attack range.
55
environment: attack_range
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/rdp_session_established/4624_10_logon.log
8-
sourcetypes:
9-
- 'XmlWinEventLog:Security'
10-
references:
11-
- https://thelocalh0st.github.io/posts/rdp/
6+
directory: rdp_session_established
7+
mitre_technique:
8+
- T1021.001
9+
datasets:
10+
- name: windows-security
11+
path: /datasets/attack_techniques/T1021.001/rdp_session_established/4624_10_logon.log
12+
sourcetype: XmlWinEventLog
13+
source: XmlWinEventLog:Security

‎datasets/attack_techniques/T1021.001/terminal_server_reg_created/terminal_server_reg_created.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ id: 27f7e43a-6d3a-11f0-86b8-629be3538068
33
date: '2025-07-30'
44
description: Generated datasets for terminal server reg created in attack range.
55
environment: attack_range
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/terminal_server_reg_created/terminal_sever_client_Reg_created.log
8-
sourcetypes:
9-
- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
10-
references:
11-
- https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
6+
directory: terminal_server_reg_created
7+
mitre_technique:
8+
- T1021.001
9+
datasets:
10+
- name: windows-sysmon
11+
path: /datasets/attack_techniques/T1021.001/terminal_server_reg_created/windows-sysmon.log
12+
sourcetype: XmlWinEventLog
13+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

‎datasets/attack_techniques/T1021.001/unhide_file/unhide_file.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ id: a2d674e4-6d3c-11f0-86b8-629be3538068
33
date: '2025-07-30'
44
description: Generated datasets for unhide file in attack range.
55
environment: attack_range
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/unhide_file/unhide_file.log
8-
sourcetypes:
9-
- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
10-
references:
11-
- https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
6+
directory: unhide_file
7+
mitre_technique:
8+
- T1021.001
9+
datasets:
10+
- name: windows-sysmon
11+
path: /datasets/attack_techniques/T1021.001/unhide_file/windows-sysmon.log
12+
sourcetype: XmlWinEventLog
13+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

0 commit comments

Comments
 (0)