Skip to content

Conversation

@AAtashGar
Copy link
Contributor

Adds simulated attack data for the novel BitLocker COM Hijacking technique (first public detection).

Related security_content PR: splunk/security_content#3801

@AAtashGar
Copy link
Contributor Author

Dear @nasbench,

I quickly implemented the changes you suggested, the datasets are now xml and I also updated the yml file.

Updated the BitLocker COM Hijacking dataset YAML file to streamline the structure and remove redundant entries.
@nasbench
Copy link
Contributor

@AAtashGar stop using AI to fix things. As this will lead to closing this PR :)
I fixed the yaml, but you have to push the fix for the logs - Here is an example how they should look like https://media.githubusercontent.com/media/splunk/attack_data/5f19dcf9bc26db70a83fd4ef9e14fedbd3a45535/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2.log

Just do an export raw from Splunk without additional formatting

@AAtashGar
Copy link
Contributor Author

Dear @nasbench,
The problem with the raw log has been fixed, I hope there will be no more problems
Thanks for your help and guidance

@nasbench
Copy link
Contributor

nasbench commented Dec 1, 2025

Validation is passing.

image

Error is due to lack of permissions from forks.

@nasbench nasbench merged commit d5b2f93 into splunk:master Dec 1, 2025
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants