fix_cwd_path_detections

datasets/attack_techniques/T1053.003/auditd_path_cron/auditd_path_cron.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: ebb93346-cab0-11f0-9d54-629be353806a
+date: '2025-11-26'
+description: Generated datasets for auditd path cron in attack range.
+environment: attack_range
+directory: auditd_path_cron
+mitre_technique:
+- T1053.003
+datasets:
+- name: path_cron.log
+  path: /datasets/attack_techniques/T1053.003/auditd_path_cron/path_cron.log
+  sourcetype: 'auditd'
+  source: 'auditd'

datasets/attack_techniques/T1098.004/auditd_path_ssh_config/auditd_path_ssh_config.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 30034558-caa9-11f0-9d54-629be353806a
+date: '2025-11-26'
+description: Generated datasets for auditd path ssh config in attack range.
+environment: attack_range
+directory: auditd_path_ssh_config
+mitre_technique:
+- T1098.004
+datasets:
+- name: path_ssh_config.log
+  path: /datasets/attack_techniques/T1098.004/auditd_path_ssh_config/path_ssh_config.log
+  sourcetype: 'auditd'
+  source: 'auditd'

datasets/attack_techniques/T1529/auditd_path_sysrq/auditd_path_sysrq.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: f685a614-cab1-11f0-9d54-629be353806a
+date: '2025-11-26'
+description: Generated datasets for auditd path sysrq in attack range.
+environment: attack_range
+directory: auditd_path_sysrq
+mitre_technique:
+- T1529
+datasets:
+- name: path_sysrq.log
+  path: /datasets/attack_techniques/T1529/auditd_path_sysrq/path_sysrq.log
+  sourcetype: 'auditd'
+  source: 'auditd'

datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/auditd_path_cwd_doas_conf.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: af16a08e-caa8-11f0-9d54-629be353806a
+date: '2025-11-26'
+description: Generated datasets for auditd path cwd doas conf in attack range.
+environment: attack_range
+directory: auditd_path_cwd_doas_conf
+mitre_technique:
+- T1548.003
+datasets:
+- name: path_doas.log
+  path: /datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/path_doas.log
+  sourcetype: 'auditd'
+  source: 'auditd'

datasets/attack_techniques/T1548.003/auditd_path_sudoers/auditd_path_sudoers.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 982cabce-caa9-11f0-9d54-629be353806a
+date: '2025-11-26'
+description: Generated datasets for auditd path sudoers in attack range.
+environment: attack_range
+directory: auditd_path_sudoers
+mitre_technique:
+- T1548.003
+datasets:
+- name: path_sudoers.log
+  path: /datasets/attack_techniques/T1548.003/auditd_path_sudoers/path_sudoers.log
+  sourcetype: 'auditd'
+  source: 'auditd'

datasets/attack_techniques/T1574.006/auditd_path_preload_file/auditd_path_preload_file.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 371a046e-cab1-11f0-9d54-629be353806a
+date: '2025-11-26'
+description: Generated datasets for auditd path preload file in attack range.
+environment: attack_range
+directory: auditd_path_preload_file
+mitre_technique:
+- T1574.006
+datasets:
+- name: path_preload.log
+  path: /datasets/attack_techniques/T1574.006/auditd_path_preload_file/path_preload.log
+  sourcetype: 'auditd'
+  source: 'auditd'