diff --git a/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json b/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json new file mode 100644 index 000000000..6c45688f3 --- /dev/null +++ b/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0d20787d8db59111b0e07ecbf35092c18e68a0909f531e3d8474ccf573092052 +size 19944 diff --git a/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.yml b/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.yml new file mode 100644 index 000000000..26a2397da --- /dev/null +++ b/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.yml @@ -0,0 +1,22 @@ +author: Maria Jose Erquiaga +id: ee72185e-b511-41e9-afb9-91ae723a07f5 +date: '2026-09-29' +description: >- + AWS CloudTrail events generated by an AWS identity making 12 successful + EC2 Instance Connect SendSSHPublicKey API calls against an EC2 instance + within approximately 14 seconds. EC2 Instance Connect uses the AWS control + plane to make an ephemeral SSH public key available to an operating-system + user, enabling direct SSH access to the virtual machine. A burst of these + events may indicate automated access attempts or lateral movement using + compromised AWS credentials. Sensitive account, identity, instance, + network, public-key, and region values were replaced with synthetic values. +environment: attack_range +directory: aws_ec2_multiple_ssh_public_keys_uploaded +mitre_technique: +- T1021.004 +- T1021.008 +datasets: +- name: aws_ec2_multiple_ssh_public_keys_uploaded-json + path: /datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log new file mode 100644 index 000000000..00867d2b7 --- /dev/null +++ b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4d990849f651dea10df286d51673b1d09dc536b03a82df3f9e113b4e8c9ce13c +size 1069 diff --git a/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml new file mode 100644 index 000000000..746ca46ea --- /dev/null +++ b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml @@ -0,0 +1,13 @@ +author: Maria Jose Erquiaga +id: 436d5044-ae22-475d-9e19-dfc8a2f4e94f +date: '2026-09-02' +description: Generated datasets for Cisco Network Visibility Module Flow Data EventType. +environment: custom +directory: macos_browser_spawned_script_external_network_connection +mitre_technique: + - T1059 +datasets: + - name: nvm_flowdata + sourcetype: cisco:nvm:flowdata:v2 + source: not_applicable + path: /datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log diff --git a/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json new file mode 100644 index 000000000..17726c40b --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2bfe4a3caa9c5fbd12515328f0c2c842f4dc939179f3102e8c04f9c88737429e +size 1145400 diff --git a/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml new file mode 100644 index 000000000..c306b5188 --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml @@ -0,0 +1,16 @@ +author: Maria Jose Erquiaga +id: 64a58b0f-ef34-44e6-bda0-f10457e9cbc0 +date: '2026-09-21' +description: >- + Dataset containing AWS CloudTrail events generated by more than 500 Amazon + CloudWatch Logs GetLogEvents operations performed by the same principal and + AWS account within a five-minute period. +environment: attack_range +directory: aws_cloudwatch_logs_high_volume_retrieval +mitre_technique: + - T1530 +datasets: + - name: aws_cloudwatch_logs_high_volume_retrieval-json + path: /datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail