gdrive logs

RavenTait · RavenTait · commit e31e0fabdf1d · 2025-08-01T11:28:48.000-04:00
diff --git a/datasets/attack_techniques/T1567/gdrive/gdrive.yml b/datasets/attack_techniques/T1567/gdrive/gdrive.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 9c1ebd7e-b293-4238-98ff-4ecef8444cdb
+date: '2025-08-01'
+description: Simulate usage of the gdrive binary to interact with Google Drive.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/gdrive/gdrive_windows.log
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/gdrive/gdrive_linux.log
+sourcetypes:
+- XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- Syslog:Linux-Sysmon/Operational
+references:
+- https://attack.mitre.org/techniques/T1567/
diff --git a/datasets/attack_techniques/T1567/gdrive/gdrive_linux.log b/datasets/attack_techniques/T1567/gdrive/gdrive_linux.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9d4131e5da55ad18265a03de96a248ff3f0193e56e148c8cbc38423cc41975f6
+size 5546
diff --git a/datasets/attack_techniques/T1567/gdrive/gdrive_windows.log b/datasets/attack_techniques/T1567/gdrive/gdrive_windows.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:786779dfc83f8224d97287cb497e6d44468212203b717ab41ba193aa6de5d4c3
+size 6602

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:9d4131e5da55ad18265a03de96a248ff3f0193e56e148c8cbc38423cc41975f6`
	`3`	`+size 5546`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:786779dfc83f8224d97287cb497e6d44468212203b717ab41ba193aa6de5d4c3`
	`3`	`+size 6602`