spus_proc_path

tccontre · tccontre · commit e4488c2477e4 · 2025-01-27T11:13:12.000+01:00
diff --git a/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log b/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e5d9dd394138305b60b75452ce71c2bcc508b8797e7e073267a1d431b141156b
+size 2014
diff --git a/datasets/attack_techniques/T1036/suspicious_process_path/suspicious_process_path.yml b/datasets/attack_techniques/T1036/suspicious_process_path/suspicious_process_path.yml
@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 2fa5d1b2-dc97-11ef-8b8c-acde48001122
+date: '2025-01-27'
+description: Generated datasets for suspicious process path in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log
+sourcetypes:
+- 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:e5d9dd394138305b60b75452ce71c2bcc508b8797e7e073267a1d431b141156b`
	`3`	`+size 2014`