Merge branch 'master' of github.com:splunk/attack_data

Patrick Bareiss · Patrick Bareiss · commit eef6683795aa · 2025-07-10T13:31:01.000+02:00
diff --git a/datasets/attack_techniques/T1190/citrix/suricata_citrixbleed2.log b/datasets/attack_techniques/T1190/citrix/suricata_citrixbleed2.log
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:b0e525f9797055d6abfcdec55af3ea5994cdb2d46a5bdbf9f366d3749f849dd2
-size 3060
+oid sha256:de886787e69eb239a23040188de48ad3cad4d4b32755c6f59ca897230f00758b
+size 3242
diff --git a/datasets/attack_techniques/T1218.003/moz_lib_loaded/moz_lib_loaded.yml b/datasets/attack_techniques/T1218.003/moz_lib_loaded/moz_lib_loaded.yml
@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: d58e0ba2-5d76-11f0-bda4-629be353806a
+date: '2025-07-10'
+description: Generated datasets for moz lib loaded in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.003/moz_lib_loaded/mozilla_lib.log
+sourcetypes:
+- 'WinEventLog:Security'
+references:
+- https://www.trendmicro.com/vinfo/nz/threat-encyclopedia/malware/trojanspy.win32.vidar.yxdftz
diff --git a/datasets/attack_techniques/T1218.003/moz_lib_loaded/mozilla_lib.log b/datasets/attack_techniques/T1218.003/moz_lib_loaded/mozilla_lib.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:59040b1f2da45ee7a761755281a29f257f3bcb9d993584e7fdc08ed366ed86a0
+size 4452
diff --git a/datasets/attack_techniques/T1552.001/file_xml_config/file_xml_config.yml b/datasets/attack_techniques/T1552.001/file_xml_config/file_xml_config.yml
@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 688a823a-5d79-11f0-bda4-629be353806a
+date: '2025-07-10'
+description: Generated datasets for file xml config in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/file_xml_config/filezilla_obj.log
+sourcetypes:
+- 'WinEventLog:Security'
+references:
+- https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
diff --git a/datasets/attack_techniques/T1552.001/file_xml_config/filezilla_obj.log b/datasets/attack_techniques/T1552.001/file_xml_config/filezilla_obj.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0d7f7f2d1093a6981441bbf3a30ae036549b060f64a150986cdc3da4ea39316c
+size 6046
diff --git a/datasets/attack_techniques/T1552.001/ie_intelliform_storage/ie_intelliform_storage.yml b/datasets/attack_techniques/T1552.001/ie_intelliform_storage/ie_intelliform_storage.yml
@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: c2e6ef24-5d75-11f0-bda4-629be353806a
+date: '2025-07-10'
+description: Generated datasets for ie intelliform storage in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/ie_intelliform_storage/storage2_sim.log
+sourcetypes:
+- 'WinEventLog:Security'
+references:
+- https://stackoverflow.com/questions/1276700/where-does-internet-explorer-stores-its-form-data-history-that-is-uses-for-auto
diff --git a/datasets/attack_techniques/T1552.001/ie_intelliform_storage/storage2_sim.log b/datasets/attack_techniques/T1552.001/ie_intelliform_storage/storage2_sim.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:044f999a446c05689259ab5505af841b60274be6489d44b7d9bd539f80eb7f50
+size 7427
diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/event_stream_events/stream_events.log b/datasets/suspicious_behaviour/crowdstrike_stream/event_stream_events/stream_events.log
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:d197c252915825f105049daec93409572e1e0b6f15d6c2a31656cd320855f02d
-size 261785
+oid sha256:2ea730acfa2e472b06208196d9e0c914ce0e192788b220f45b0d10389f449d6b
+size 253

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:59040b1f2da45ee7a761755281a29f257f3bcb9d993584e7fdc08ed366ed86a0`
	`3`	`+size 4452`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:0d7f7f2d1093a6981441bbf3a30ae036549b060f64a150986cdc3da4ea39316c`
	`3`	`+size 6046`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:044f999a446c05689259ab5505af841b60274be6489d44b7d9bd539f80eb7f50`
	`3`	`+size 7427`