MSC EvilTwin

MHaggis · MHaggis · commit fcdae82ce409 · 2025-04-17T11:24:58.000-06:00
diff --git a/datasets/attack_techniques/T1218/eviltwin/eviltwin.yml b/datasets/attack_techniques/T1218/eviltwin/eviltwin.yml
@@ -0,0 +1,11 @@
+author: Michael Haag
+id: k22b2623-abd5-11eb-926b-120zf0943f11
+date: '2024-04-17'
+description: Events related to Evil Twin msc.
+environment: attack_range
+dataset:
+- https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/eviltwin/windows-sysmon.log
+sourcetypes:
+- WinEventLog:Microsoft-Windows-Sysmon/Operational
+references:
+- https://attack.mitre.org/techniques/T1218
diff --git a/datasets/attack_techniques/T1218/eviltwin/windows-sysmon.log b/datasets/attack_techniques/T1218/eviltwin/windows-sysmon.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f8fb1dbecd032334fde0464bd96abb51ffb23968068ea29a88618567adeaafb1
+size 6147

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:f8fb1dbecd032334fde0464bd96abb51ffb23968068ea29a88618567adeaafb1`
	`3`	`+size 6147`