Merge pull request #1105 from splunk/sesameop

tccontre · web-flow · commit fbb1d0b61eca · 2025-12-09T11:21:22.000+01:00
sesameop
diff --git a/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack.log b/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8580367d05e70eebe9742b2010d5a849fa645ad875b5bc7d2db1a8f057cbc33b
+size 6110
diff --git a/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack_artifacts.yml b/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack_artifacts.yml
@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 5125e5e0-d046-11f0-8a26-629be3538068
+date: '2025-12-03'
+description: Generated datasets for appdomain hijack artifacts in attack range.
+environment: attack_range
+directory: appdomain_hijack_artifacts
+mitre_technique:
+- T1574.014
+datasets:
+- name: appdomain_hijack.log
+  path: /datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:8580367d05e70eebe9742b2010d5a849fa645ad875b5bc7d2db1a8f057cbc33b`
	`3`	`+size 6110`