Merge pull request #838 from dluxtron/master

adding datasets
splunk · Oct 12, 2023 · 3e701c4 · 3e701c4
2 parents 691a5ac + bd5069b
commit 3e701c4
Show file tree

Hide file tree

Showing 6 changed files with 15 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1014/drivers.yml b/datasets/attack_techniques/T1014/drivers.yml
@@ -6,8 +6,10 @@ environment: attack_range
 dataset:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-security.log
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-system.log
 sourcetypes:
 - XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 - WinEventLog:Security
+- XmlWinEventLog:System
 references:
 - https://attack.mitre.org/techniques/T1014
diff --git a/datasets/attack_techniques/T1014/windows-system.log b/datasets/attack_techniques/T1014/windows-system.log
diff --git a/datasets/attack_techniques/T1098/account_manipulation/account_manipulation.yml b/datasets/attack_techniques/T1098/account_manipulation/account_manipulation.yml
@@ -10,8 +10,10 @@ dataset:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/xml-windows-security.log
 sourcetypes:
 - WinEventLog:Security
 - aws:cloudtrail
+- XmlWinEventLog:Security
 references:
 - https://attack.mitre.org/techniques/T1098/
diff --git a/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log b/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
diff --git a/datasets/attack_techniques/T1136.001/atomic_red_team/atomic_red_team.yml b/datasets/attack_techniques/T1136.001/atomic_red_team/atomic_red_team.yml
@@ -12,11 +12,13 @@ dataset:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/4720.log
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/xml-windows-security.log
 sourcetypes:
 - XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 - WinEventLog:Microsoft-Windows-PowerShell/Operational
 - WinEventLog:System
 - WinEventLog:Security
+- XmlWinEventLog:Security
 references:
 - https://attack.mitre.org/techniques/T1136/001
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136.001/T1136.001.md

diff --git a/datasets/attack_techniques/T1136.001/atomic_red_team/xml-windows-security.log b/datasets/attack_techniques/T1136.001/atomic_red_team/xml-windows-security.log