Merge pull request #1045 from splunk/wbadmin-rec

nasbench · web-flow · commit b7ac1243ed73 · 2025-10-15T17:41:45.000+02:00
add wbadmin rec dataset
diff --git a/datasets/attack_techniques/T1565.001/wbadmin_recovery/wbadmin_recovery.log b/datasets/attack_techniques/T1565.001/wbadmin_recovery/wbadmin_recovery.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8147c4ae0b83ec0155e64a69df1d59189f307054824085c6c32eb8940f131693
+size 2161
diff --git a/datasets/attack_techniques/T1565.001/wbadmin_recovery/wbadmin_recovery.yml b/datasets/attack_techniques/T1565.001/wbadmin_recovery/wbadmin_recovery.yml
@@ -0,0 +1,13 @@
+author: Nasreddine Bencherchali, Splunk
+id: 0232e68d-338f-4963-8602-614357458534
+date: '2025-10-15'
+description: Generated datasets covering the execution of wbadmin for recovery in attack range.
+environment: attack_range
+directory: wbadmin_recovery
+mitre_technique:
+- T1046
+datasets:
+- name: wbadmin_recovery.log
+  path: /datasets/attack_techniques/T1565.001/wbadmin_recovery/wbadmin_recovery.log
+  sourcetype: XmlWinEventLog
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:8147c4ae0b83ec0155e64a69df1d59189f307054824085c6c32eb8940f131693`
	`3`	`+size 2161`