From 8889f8afd12523fa65bc16ca652b583069e65c22 Mon Sep 17 00:00:00 2001 From: merquiag Date: Thu, 3 Sep 2026 11:21:01 +0200 Subject: [PATCH 1/2] Add macos_browser_spawned_script_external_network_connection attack data --- .../nvm_flowdata.log | 3 +++ .../nvm_flowdata.yml | 13 +++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log create mode 100644 datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml diff --git a/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log new file mode 100644 index 00000000..00867d2b --- /dev/null +++ b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4d990849f651dea10df286d51673b1d09dc536b03a82df3f9e113b4e8c9ce13c +size 1069 diff --git a/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml new file mode 100644 index 00000000..746ca46e --- /dev/null +++ b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml @@ -0,0 +1,13 @@ +author: Maria Jose Erquiaga +id: 436d5044-ae22-475d-9e19-dfc8a2f4e94f +date: '2026-09-02' +description: Generated datasets for Cisco Network Visibility Module Flow Data EventType. +environment: custom +directory: macos_browser_spawned_script_external_network_connection +mitre_technique: + - T1059 +datasets: + - name: nvm_flowdata + sourcetype: cisco:nvm:flowdata:v2 + source: not_applicable + path: /datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log From 2286d44f42ed7af74b864931dfceaf741c0f86bd Mon Sep 17 00:00:00 2001 From: merquiag Date: Mon, 21 Sep 2026 18:18:31 +0200 Subject: [PATCH 2/2] Add AWS CloudWatch Logs high volume retrieval dataset --- ...ws_cloudwatch_logs_high_volume_retrieval.json | 3 +++ ...aws_cloudwatch_logs_high_volume_retrieval.yml | 16 ++++++++++++++++ 2 files changed, 19 insertions(+) create mode 100644 datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json create mode 100644 datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml diff --git a/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json new file mode 100644 index 00000000..17726c40 --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2bfe4a3caa9c5fbd12515328f0c2c842f4dc939179f3102e8c04f9c88737429e +size 1145400 diff --git a/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml new file mode 100644 index 00000000..c306b518 --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml @@ -0,0 +1,16 @@ +author: Maria Jose Erquiaga +id: 64a58b0f-ef34-44e6-bda0-f10457e9cbc0 +date: '2026-09-21' +description: >- + Dataset containing AWS CloudTrail events generated by more than 500 Amazon + CloudWatch Logs GetLogEvents operations performed by the same principal and + AWS account within a five-minute period. +environment: attack_range +directory: aws_cloudwatch_logs_high_volume_retrieval +mitre_technique: + - T1530 +datasets: + - name: aws_cloudwatch_logs_high_volume_retrieval-json + path: /datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail