Merge pull request #1044 from splunk/new-dataset-oct25

add new datasets for ip scanner, pstools and defender

Author: nasbench

datasets/attack_techniques/T1046/advanced_ip_port_scanner/advanced_ip_port_scanner.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3a4fb67d7aa2e86c0ecedb60c9d02c9b4a178a7a8fdf228c0535a965ce7dad6c
+size 59641

datasets/attack_techniques/T1046/advanced_ip_port_scanner/advanced_ip_port_scanner.yml

@@ -0,0 +1,13 @@
+author: Nasreddine Bencherchali, Splunk
+id: a846253e-7b37-4713-8a78-da3c058658cc
+date: '2025-10-13'
+description: Generated datasets covering the execution of Advanced IP / Port Scanner in attack range.
+environment: attack_range
+directory: advanced_ip_port_scanner
+mitre_technique:
+- T1046
+datasets:
+- name: advanced_ip_port_scanner.log
+  path: /datasets/attack_techniques/T1046/advanced_ip_port_scanner/advanced_ip_port_scanner.log
+  sourcetype: XmlWinEventLog
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1082/sysinternals_pstools/sysinternals_pstools.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ceeb24d90b3d08428440a0c50427e12c5fea1d15a6172e5bed25eda46384cd29
+size 35818

datasets/attack_techniques/T1082/sysinternals_pstools/sysinternals_pstools.yml

@@ -0,0 +1,13 @@
+author: Nasreddine Bencherchali, Splunk
+id: cb4024aa-8397-4739-adeb-7e2e2e14ef30
+date: '2025-10-15'
+description: Generated datasets covering the execution of different tools of the PsTools Sysinternals suit in attack range.
+environment: attack_range
+directory: sysinternals_pstools
+mitre_technique:
+- T1046
+datasets:
+- name: sysinternals_pstools.log
+  path: /datasets/attack_techniques/T1082/sysinternals_pstools/sysinternals_pstools.log
+  sourcetype: XmlWinEventLog
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/disable_defender_asr_or_threats.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ba24768e57d593f7fb188ddbd9612a54709e72562d084f60f50359497ba04ab3
+size 10743

datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/disable_defender_asr_or_threats.yml

@@ -0,0 +1,13 @@
+author: Nasreddine Bencherchali, Splunk
+id: 179da367-87f4-413d-b0c9-b8c13e01d489
+date: '2025-10-13'
+description: Generated datasets for disabling or allowing certain ASR rule or threat IDs respectively in attack range.
+environment: attack_range
+directory: disable_defender_asr_or_threats
+mitre_technique:
+- T1562.001
+datasets:
+- name: disable_defender_asr_or_threats.log
+  path: /datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/disable_defender_asr_or_threats.log
+  sourcetype: XmlWinEventLog
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'