crypto_c

Author: tccontre

datasets/attack_techniques/T1021.006/wirm_execute_shell/winrshost_pwh.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:548ad04f39f8ec27feb9b17c8099168c145f2e06bff0141b6dff597ece2fd093
+size 1178235

datasets/attack_techniques/T1021.006/wirm_execute_shell/wirm_execute_shell.yml

@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 805b344a-b946-11ef-8789-acde48001122
+date: '2024-12-13'
+description: Generated datasets for wirm execute shell in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/wirm_execute_shell/winrshost_pwh.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
+references:
+- https://strontic.github.io/xcyclopedia/library/winrshost.exe-6790044CEB4BA5BE6AA8161460D990FD.html

datasets/attack_techniques/T1027.013/rar_sfx_execution/rar_sfx.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0d6d47389ba99ef2ca5905e6e9a06a245cbd6e690c075dd42724dcc51c386c5c
+size 2062

datasets/attack_techniques/T1027.013/rar_sfx_execution/rar_sfx_execution.yml

@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 4c342226-b946-11ef-8789-acde48001122
+date: '2024-12-13'
+description: Generated datasets for rar sfx execution in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.013/rar_sfx_execution/rar_sfx.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
+references:
+- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html

datasets/attack_techniques/T1531/log_off_user/log_off_user.yml

@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: e2361596-b945-11ef-8789-acde48001122
+date: '2024-12-13'
+description: Generated datasets for log off user in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
+references:
+- https://devblogs.microsoft.com/scripting/automating-quser-through-powershell/

datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:61a8b4a639dde81a649321c12b886bc031a58c89fb39be50905f6572c456cca3
+size 3750