Merge pull request #995 from jwindley/new_macos_data

ljstella · web-flow · commit daace9fd7376 · 2025-08-15T10:31:09.000-05:00
add new macos datasets for T1016
diff --git a/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log b/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2b207c84b6b322daf28e27086831fcc0eb7090d1caa438f64c009fa5745de725
+size 8415
diff --git a/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_net_discovery.yml b/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_net_discovery.yml
@@ -0,0 +1,12 @@
+author: Jamie Windley
+id: e0c0d5e5-8c29-4db3-9d27-d42f31c552f5
+date: '2025-08-15'
+description: Generated datasets for MacOS net discovery
+environment: vm
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_network_discovery.log
+sourcetypes:
+- osquery:results
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
diff --git a/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_network_discovery.log b/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_network_discovery.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b5687df76db37a6faf7a8509e88d0cd1820c23e64fff4d92a580d74bf9c996b0
+size 5022

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:2b207c84b6b322daf28e27086831fcc0eb7090d1caa438f64c009fa5745de725`
	`3`	`+size 8415`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:b5687df76db37a6faf7a8509e88d0cd1820c23e64fff4d92a580d74bf9c996b0`
	`3`	`+size 5022`