diff --git a/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack.yml b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack.yml new file mode 100644 index 000000000..060c28c61 --- /dev/null +++ b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: de939340-39b2-49e7-8a81-f632c2913150 +date: '2026-07-22' +description: Generated datasets for Windows Network Sniffing Tools in attack range. +environment: attack_range +directory: windows_network_sniffing_tools +mitre_technique: +- T1040 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security + path: /datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log diff --git a/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log new file mode 100644 index 000000000..0da7d1672 --- /dev/null +++ b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c83a52e523bbae925a7dfca3f6e10b421bec5baa7d0461471864c770f15f8386 +size 1515 diff --git a/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack.yml b/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack.yml new file mode 100644 index 000000000..54982614a --- /dev/null +++ b/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 04ab08ee-0036-4f26-ab04-46cabe550937 +date: '2026-07-22' +description: Generated datasets for Windows Suspicious Child of Consent.exe in attack + range. +environment: attack_range +directory: windows_suspicious_child_of_consent.exe +mitre_technique: +- T1068 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + path: /datasets/attack_techniques/T1068/windows_suspicious_child_of_consent.exe/snapattack_windows.log diff --git a/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack_windows.log b/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack_windows.log new file mode 100644 index 000000000..f21e13e0b --- /dev/null +++ b/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack_windows.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f9132cda2bbdb3d564355a8c3ebfca6e1cbe4fa4c67c6574cc31413e19cd9eb5 +size 2189 diff --git a/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack.yml b/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack.yml new file mode 100644 index 000000000..c8cc102d4 --- /dev/null +++ b/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 5dbb38a0-78c3-45fc-882b-7cc4b4773fc6 +date: '2026-07-22' +description: Generated datasets for Windows Powershell Commands from DNS TXT in attack + range. +environment: attack_range +directory: windows_powershell_commands_from_dns_txt +mitre_technique: +- T1071.004 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + path: /datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log diff --git a/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log b/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log new file mode 100644 index 000000000..75d6c0444 --- /dev/null +++ b/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:fe06dd683cbce9ef0b6b7d9d3c3fd6f6cbd2b7918d9364226e889a51d41f6af9 +size 1334 diff --git a/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack.yml b/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack.yml new file mode 100644 index 000000000..dea9caa8e --- /dev/null +++ b/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 05e75f48-1434-46a1-9581-f0a9728098d5 +date: '2026-07-22' +description: Generated datasets for Windows Dir Piped to Findstr Activity in attack + range. +environment: attack_range +directory: windows_dir_piped_to_findstr_activity +mitre_technique: +- T1119 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security + path: /datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log diff --git a/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log b/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log new file mode 100644 index 000000000..0376fd5cb --- /dev/null +++ b/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:7bf8c6b753d5aafaf99899421b96a7b0e377a2e2c75d1f7cbaaa167beb027ea6 +size 1632