bug fixes

Author: Patrick Bareiss

datasets/attack_techniques/T1059.001/msix_powershell/msix_powershell.yml

@@ -3,11 +3,11 @@ id: 3f9b2623-abd5-11eb-926b-120zf0943f11
 date: '2023-06-22'
 description: PowerShell execution from MSIX packages and WindowsApps directory
 environment: attack_range
-dataset:
-- https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon.log
-sourcetypes:
-- XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-references:
-- https://attack.mitre.org/techniques/T1059/001
-- https://redcanary.com/blog/threat-intelligence/msix-installers/
-- https://redcanary.com/threat-detection-report/techniques/installer-packages/
+directory: msix_powershell
+mitre_technique:
+- T1059.001
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

datasets/attack_techniques/T1218/msix_ai_stubs/msix_ai_stubs.yml

@@ -3,10 +3,11 @@ id: kk9b2623-abd5-11eb-926b-120zf0943f11
 date: '2023-05-15'
 description: MSIX AI_STUBS execution detection for malicious installer packages
 environment: attack_range
-dataset:
-- https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1218/msix_ai_stubs/windows_sysmon.log
-sourcetypes:
-- XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-references:
-- https://attack.mitre.org/techniques/T1218
-- https://redcanary.com/threat-detection-report/techniques/installer-packages/
+directory: msix_ai_stubs
+mitre_technique:
+- T1218
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1218/msix_ai_stubs/windows_sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

datasets/attack_techniques/T1553.005/msix_unsigned/msix_unsigned.yml

@@ -3,11 +3,11 @@ id: 4f9b2623-abd5-11eb-926b-120zf0943f22
 date: '2023-06-22'
 description: Detection of unsigned MSIX package installation using PowerShell
 environment: attack_range
-dataset:
-- https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1553.005/msix_unsigned/windows-powershell.log
-sourcetypes:
-- XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-references:
-- https://attack.mitre.org/techniques/T1553/005
-- https://redcanary.com/blog/threat-intelligence/msix-installers/
-- https://redcanary.com/threat-detection-report/techniques/installer-packages/
+directory: msix_unsigned
+mitre_technique:
+- T1553.005
+datasets:
+- name: windows-powershell
+  path: /datasets/attack_techniques/T1553.005/msix_unsigned/windows-powershell.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational