Uploading defender eventlog datasets

Author: dluxtron

datasets/attack_techniques/T1562.001/defender_exclusion_defender_operational_wineventlog/defender_exclusion_defender_operational_wineventlog.yml

@@ -0,0 +1,14 @@
+author: Dean Luxton
+id: a8ccdeca-c332-4bb6-84b5-76786138925d
+date: '2025-01-08'
+description: Generated datasets for defender exclusion in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_defender_operational_wineventlog/defender_operational_wineventlog.log
+sourcetype:
+- xmlwineventlog
+source:
+- WinEventLog:Microsoft-Windows-Windows Defender/Operational
+references:
+- https://m365internals.com/2021/07/05/why-are-windows-defender-av-logs-so-important-and-how-to-monitor-them-with-azure-sentinel/
+- https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection

datasets/attack_techniques/T1562.001/defender_exclusion_defender_operational_wineventlog/defender_operational_wineventlog.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e49ea1bdb0d05ec52f1a91164edb5849c110ec4a53cdba41081ac7fc52a63145
+size 1786

datasets/attack_techniques/T1562.001/disable_defender_operational_wineventlog/disable_defender_component.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b57d92104547cd02a24b4705d6f7b5b453be9d3f71de8e759b0e69bdeb67a670
+size 10677

datasets/attack_techniques/T1562.001/disable_defender_operational_wineventlog/disable_defender_operational_wineventlog.yml

@@ -0,0 +1,15 @@
+author: Dean Luxton
+id: bc8c2a9d-8e22-4354-90b8-fcb66c6f9b2e
+date: '2025-01-08'
+description: Generated datasets for defender exclusion in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_operational_wineventlog/disable_defender_component.log
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_operational_wineventlog/disable_defender_rtm.log
+sourcetype:
+- xmlwineventlog
+source:
+- WinEventLog:Microsoft-Windows-Windows Defender/Operational
+references:
+- https://m365internals.com/2021/07/05/why-are-windows-defender-av-logs-so-important-and-how-to-monitor-them-with-azure-sentinel/
+- https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection

datasets/attack_techniques/T1562.001/disable_defender_operational_wineventlog/disable_defender_rtm.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:03c698ff69b9b7af4e42db7e4bf3e6a486f0256f68c33872f936c025ca48ca5f
+size 3040