splunk · RavenTait · Jul 30, 2026 · Jul 30, 2026 · Jul 30, 2026
diff --git a/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack.yml b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: de939340-39b2-49e7-8a81-f632c2913150
+date: '2026-07-22'
+description: Generated datasets for Windows Network Sniffing Tools in attack range.
+environment: attack_range
+directory: windows_network_sniffing_tools
+mitre_technique:
+- T1040
+datasets:
+-   name: snapattack
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Security
+    path: /datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log
diff --git a/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log b/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log
diff --git a/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack.yml b/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 04ab08ee-0036-4f26-ab04-46cabe550937
+date: '2026-07-22'
+description: Generated datasets for Windows Suspicious Child of Consent.exe in attack
+    range.
+environment: attack_range
+directory: windows_suspicious_child_of_consent.exe
+mitre_technique:
+- T1068
+datasets:
+-   name: snapattack
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    path: /datasets/attack_techniques/T1068/windows_suspicious_child_of_consent.exe/snapattack_windows.log
diff --git a/...ts/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack_windows.log b/...ts/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack_windows.log
diff --git a/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack.yml b/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 5dbb38a0-78c3-45fc-882b-7cc4b4773fc6
+date: '2026-07-22'
+description: Generated datasets for Windows Powershell Commands from DNS TXT in attack
+    range.
+environment: attack_range
+directory: windows_powershell_commands_from_dns_txt
+mitre_technique:
+- T1071.004
+datasets:
+-   name: snapattack
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    path: /datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log
diff --git a/...tack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log b/...tack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log
diff --git a/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack.yml b/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 05e75f48-1434-46a1-9581-f0a9728098d5
+date: '2026-07-22'
+description: Generated datasets for Windows Dir Piped to Findstr Activity in attack
+    range.
+environment: attack_range
+directory: windows_dir_piped_to_findstr_activity
+mitre_technique:
+- T1119
+datasets:
+-   name: snapattack
+    sourcetype: XmlWinEventLog
+    source: XmlWinEventLog:Security
+    path: /datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log
diff --git a/...sets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log b/...sets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log