From 80b27818a91ebc6905449b9b091515b8c6d5518d Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Mon, 28 Sep 2026 14:24:12 -0400 Subject: [PATCH] kerberloss data --- .../T1562.010/kerberloss/kerberloss.yml | 13 +++++++++++++ .../T1562.010/kerberloss/windows-xml.log | 3 +++ 2 files changed, 16 insertions(+) create mode 100644 datasets/attack_techniques/T1562.010/kerberloss/kerberloss.yml create mode 100644 datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log diff --git a/datasets/attack_techniques/T1562.010/kerberloss/kerberloss.yml b/datasets/attack_techniques/T1562.010/kerberloss/kerberloss.yml new file mode 100644 index 00000000..3d5a2207 --- /dev/null +++ b/datasets/attack_techniques/T1562.010/kerberloss/kerberloss.yml @@ -0,0 +1,13 @@ +author: Raven Tait +id: 6665fa29-d77d-4752-9f95-38a45d6f96e0 +date: '2026-09-28' +description: KerberLoss (CVE-2026-25177) attack data - user account modifying computer object SPNs and injecting invisible Unicode characters into SPN values via Windows Security Event 5136 +environment: attack_range +directory: kerberloss +mitre_technique: +- T1562.010 +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log b/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log new file mode 100644 index 00000000..f52915fa --- /dev/null +++ b/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4d31d4efb282a413ac90da31323b2a7bffbe32a069c7bac5580c4a6a98dda947 +size 5878