Aws ec2 multiple ssh public keys uploaded

datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.yml

@@ -0,0 +1,22 @@
+author: Maria Jose Erquiaga
+id: ee72185e-b511-41e9-afb9-91ae723a07f5
+date: '2026-09-29'
+description: >-
+  AWS CloudTrail events generated by an AWS identity making 12 successful
+  EC2 Instance Connect SendSSHPublicKey API calls against an EC2 instance
+  within approximately 14 seconds. EC2 Instance Connect uses the AWS control
+  plane to make an ephemeral SSH public key available to an operating-system
+  user, enabling direct SSH access to the virtual machine. A burst of these
+  events may indicate automated access attempts or lateral movement using
+  compromised AWS credentials. Sensitive account, identity, instance,
+  network, public-key, and region values were replaced with synthetic values.
+environment: attack_range
+directory: aws_ec2_multiple_ssh_public_keys_uploaded
+mitre_technique:
+- T1021.004
+- T1021.008
+datasets:
+- name: aws_ec2_multiple_ssh_public_keys_uploaded-json
+  path: /datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json
+  sourcetype: aws:cloudtrail
+  source: aws_cloudtrail

datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.yml

@@ -0,0 +1,13 @@
+author: Maria Jose Erquiaga
+id: 436d5044-ae22-475d-9e19-dfc8a2f4e94f
+date: '2026-09-02'
+description: Generated datasets for Cisco Network Visibility Module Flow Data EventType.
+environment: custom
+directory: macos_browser_spawned_script_external_network_connection
+mitre_technique:
+    - T1059
+datasets:
+    - name: nvm_flowdata
+      sourcetype: cisco:nvm:flowdata:v2
+      source: not_applicable
+      path: /datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log

datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.yml

@@ -0,0 +1,16 @@
+author: Maria Jose Erquiaga
+id: 64a58b0f-ef34-44e6-bda0-f10457e9cbc0
+date: '2026-09-21'
+description: >-
+  Dataset containing AWS CloudTrail events generated by more than 500 Amazon
+  CloudWatch Logs GetLogEvents operations performed by the same principal and
+  AWS account within a five-minute period.
+environment: attack_range
+directory: aws_cloudwatch_logs_high_volume_retrieval
+mitre_technique:
+  - T1530
+datasets:
+  - name: aws_cloudwatch_logs_high_volume_retrieval-json
+    path: /datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail