crypto_c

Author: tccontre

datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_api_dns.yml

@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: bf9b1abe-b962-11ef-8789-acde48001122
+date: '2024-12-13'
+description: Generated datasets for telegram api dns in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
+references:
+- https://www.splunk.com/en_us/blog/security/threat-advisory-telegram-crypto-botnet-strt-ta01.html

datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:4b4cd5c56ab3a86c83fd2a1c63e572b8a1baaf0eff29d8dfce32d628ffb9092d
+size 13203

datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_inheritance.yml

@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 70aa5bf2-b95a-11ef-8789-acde48001122
+date: '2024-12-13'
+description: Generated datasets for icacls inheritance in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
+references:
+- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html

datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:85a98b1a5d74f155ad7bd9f8f8eb78bc051b899662bc2d51a39f41d6a0f9963b
+size 1346953