netsupport

datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/masquerading_executable_as_non_exec_file_type.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 0f2d6b50-c15e-11f0-8cf9-629be353806a
+date: '2025-11-14'
+description: Generated datasets for masquerading executable as non exec file type in attack range.
+environment: attack_range
+directory: masquerading_executable_as_non_exec_file_type
+mitre_technique:
+- T1036.008
+datasets:
+- name: non_exec_ext_but_exec_detected.log
+  path: /datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/non_exec_ext_but_exec_detected.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1036/netsupport_modules/netsupport_modules.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: ddd747f6-c15d-11f0-8cf9-629be353806a
+date: '2025-11-14'
+description: Generated datasets for netsupport modules in attack range.
+environment: attack_range
+directory: netsupport_modules
+mitre_technique:
+- T1036
+datasets:
+- name: net_support_module.log
+  path: /datasets/attack_techniques/T1036/netsupport_modules/net_support_module.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1112/delete_runmru_reg/delete_runmru_reg.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 24e060c4-c15e-11f0-8cf9-629be353806a
+date: '2025-11-14'
+description: Generated datasets for delete runmru reg in attack range.
+environment: attack_range
+directory: delete_runmru_reg
+mitre_technique:
+- T1112
+datasets:
+- name: runmru_deletion.log
+  path: /datasets/attack_techniques/T1112/delete_runmru_reg/runmru_deletion.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'