Merge pull request #1088 from splunk/netsupport

P4T12ICK · web-flow · commit 194a902a3ec5 · 2025-11-17T10:15:57.000+01:00
netsupport
diff --git a/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/masquerading_executable_as_non_exec_file_type.yml b/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/masquerading_executable_as_non_exec_file_type.yml
@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 0f2d6b50-c15e-11f0-8cf9-629be353806a
+date: '2025-11-14'
+description: Generated datasets for masquerading executable as non exec file type in attack range.
+environment: attack_range
+directory: masquerading_executable_as_non_exec_file_type
+mitre_technique:
+- T1036.008
+datasets:
+- name: non_exec_ext_but_exec_detected.log
+  path: /datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/non_exec_ext_but_exec_detected.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
diff --git a/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/non_exec_ext_but_exec_detected.log b/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/non_exec_ext_but_exec_detected.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:eca1f193a3e5a521550ee6def74a333423ecba0e0666632971d64c7e6fb25ceb
+size 11937
diff --git a/datasets/attack_techniques/T1036/netsupport_modules/net_support_module.log b/datasets/attack_techniques/T1036/netsupport_modules/net_support_module.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8dfcc5222a610c12eebbbd305ef33779f6e454b3e5c7d4ed30f078b1389ff9bc
+size 7793
diff --git a/datasets/attack_techniques/T1036/netsupport_modules/netsupport_modules.yml b/datasets/attack_techniques/T1036/netsupport_modules/netsupport_modules.yml
@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: ddd747f6-c15d-11f0-8cf9-629be353806a
+date: '2025-11-14'
+description: Generated datasets for netsupport modules in attack range.
+environment: attack_range
+directory: netsupport_modules
+mitre_technique:
+- T1036
+datasets:
+- name: net_support_module.log
+  path: /datasets/attack_techniques/T1036/netsupport_modules/net_support_module.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
diff --git a/datasets/attack_techniques/T1112/delete_runmru_reg/delete_runmru_reg.yml b/datasets/attack_techniques/T1112/delete_runmru_reg/delete_runmru_reg.yml
@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 24e060c4-c15e-11f0-8cf9-629be353806a
+date: '2025-11-14'
+description: Generated datasets for delete runmru reg in attack range.
+environment: attack_range
+directory: delete_runmru_reg
+mitre_technique:
+- T1112
+datasets:
+- name: runmru_deletion.log
+  path: /datasets/attack_techniques/T1112/delete_runmru_reg/runmru_deletion.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
diff --git a/datasets/attack_techniques/T1112/delete_runmru_reg/runmru_deletion.log b/datasets/attack_techniques/T1112/delete_runmru_reg/runmru_deletion.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:32fb866c1e62fd57d01a78ecb6a2114f8327e6bfcbc06d132e980e046efe6e4d
+size 13237

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:eca1f193a3e5a521550ee6def74a333423ecba0e0666632971d64c7e6fb25ceb`
	`3`	`+size 11937`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:8dfcc5222a610c12eebbbd305ef33779f6e454b3e5c7d4ed30f078b1389ff9bc`
	`3`	`+size 7793`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:32fb866c1e62fd57d01a78ecb6a2114f8327e6bfcbc06d132e980e046efe6e4d`
	`3`	`+size 13237`