From 8889f8afd12523fa65bc16ca652b583069e65c22 Mon Sep 17 00:00:00 2001 From: merquiag Date: Thu, 3 Sep 2026 11:21:01 +0200 Subject: [PATCH 1/3] Add macos_browser_spawned_script_external_network_connection attack data --- .../nvm_flowdata.log | 3 +++ .../nvm_flowdata.yml | 13 +++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log create mode 100644 datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml diff --git a/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log new file mode 100644 index 00000000..00867d2b --- /dev/null +++ b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4d990849f651dea10df286d51673b1d09dc536b03a82df3f9e113b4e8c9ce13c +size 1069 diff --git a/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml new file mode 100644 index 00000000..746ca46e --- /dev/null +++ b/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml @@ -0,0 +1,13 @@ +author: Maria Jose Erquiaga +id: 436d5044-ae22-475d-9e19-dfc8a2f4e94f +date: '2026-09-02' +description: Generated datasets for Cisco Network Visibility Module Flow Data EventType. +environment: custom +directory: macos_browser_spawned_script_external_network_connection +mitre_technique: + - T1059 +datasets: + - name: nvm_flowdata + sourcetype: cisco:nvm:flowdata:v2 + source: not_applicable + path: /datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log From 2286d44f42ed7af74b864931dfceaf741c0f86bd Mon Sep 17 00:00:00 2001 From: merquiag Date: Mon, 21 Sep 2026 18:18:31 +0200 Subject: [PATCH 2/3] Add AWS CloudWatch Logs high volume retrieval dataset --- ...ws_cloudwatch_logs_high_volume_retrieval.json | 3 +++ ...aws_cloudwatch_logs_high_volume_retrieval.yml | 16 ++++++++++++++++ 2 files changed, 19 insertions(+) create mode 100644 datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json create mode 100644 datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml diff --git a/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json new file mode 100644 index 00000000..17726c40 --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2bfe4a3caa9c5fbd12515328f0c2c842f4dc939179f3102e8c04f9c88737429e +size 1145400 diff --git a/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml new file mode 100644 index 00000000..c306b518 --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml @@ -0,0 +1,16 @@ +author: Maria Jose Erquiaga +id: 64a58b0f-ef34-44e6-bda0-f10457e9cbc0 +date: '2026-09-21' +description: >- + Dataset containing AWS CloudTrail events generated by more than 500 Amazon + CloudWatch Logs GetLogEvents operations performed by the same principal and + AWS account within a five-minute period. +environment: attack_range +directory: aws_cloudwatch_logs_high_volume_retrieval +mitre_technique: + - T1530 +datasets: + - name: aws_cloudwatch_logs_high_volume_retrieval-json + path: /datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail From 65d2df01cb5cd66e371f4905ba8759f6ad79886e Mon Sep 17 00:00:00 2001 From: merquiag Date: Tue, 29 Sep 2026 12:14:48 +0200 Subject: [PATCH 3/3] Add AWS EC2 Instance Connect key upload attack data --- ...ec2_multiple_ssh_public_keys_uploaded.json | 3 +++ ..._ec2_multiple_ssh_public_keys_uploaded.yml | 22 +++++++++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json create mode 100644 datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.yml diff --git a/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json b/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json new file mode 100644 index 00000000..6c45688f --- /dev/null +++ b/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0d20787d8db59111b0e07ecbf35092c18e68a0909f531e3d8474ccf573092052 +size 19944 diff --git a/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.yml b/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.yml new file mode 100644 index 00000000..26a2397d --- /dev/null +++ b/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.yml @@ -0,0 +1,22 @@ +author: Maria Jose Erquiaga +id: ee72185e-b511-41e9-afb9-91ae723a07f5 +date: '2026-09-29' +description: >- + AWS CloudTrail events generated by an AWS identity making 12 successful + EC2 Instance Connect SendSSHPublicKey API calls against an EC2 instance + within approximately 14 seconds. EC2 Instance Connect uses the AWS control + plane to make an ephemeral SSH public key available to an operating-system + user, enabling direct SSH access to the virtual machine. A burst of these + events may indicate automated access attempts or lateral movement using + compromised AWS credentials. Sensitive account, identity, instance, + network, public-key, and region values were replaced with synthetic values. +environment: attack_range +directory: aws_ec2_multiple_ssh_public_keys_uploaded +mitre_technique: +- T1021.004 +- T1021.008 +datasets: +- name: aws_ec2_multiple_ssh_public_keys_uploaded-json + path: /datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail