diff --git a/datasets/attack_techniques/T1053.005/scheduled_task_on_console/scheduled_task_on_console.log b/datasets/attack_techniques/T1053.005/scheduled_task_on_console/scheduled_task_on_console.log new file mode 100644 index 000000000..202082320 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/scheduled_task_on_console/scheduled_task_on_console.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ddae693ab57a5a81cc71a6161c88f3729e90d6da42a9109a68b780fdb230bd81 +size 3176 diff --git a/datasets/attack_techniques/T1053.005/scheduled_task_on_console/scheduled_task_on_console.yml b/datasets/attack_techniques/T1053.005/scheduled_task_on_console/scheduled_task_on_console.yml new file mode 100644 index 000000000..b7761a58a --- /dev/null +++ b/datasets/attack_techniques/T1053.005/scheduled_task_on_console/scheduled_task_on_console.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan +id: 5d1452e4-1480-42cc-b4e2-56fa0c029c6b +date: '2026-10-19' +description: Attack Range dataset for scheduled task XML built via console echo technique +environment: attack_range +directory: scheduled_task_on_console +mitre_technique: +- T1053.005 +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1053.005/scheduled_task_on_console/scheduled_task_on_console.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1176.001/chromium_restore_suppressed/chromium_restore_suppressed.log b/datasets/attack_techniques/T1176.001/chromium_restore_suppressed/chromium_restore_suppressed.log new file mode 100644 index 000000000..d33a4760f --- /dev/null +++ b/datasets/attack_techniques/T1176.001/chromium_restore_suppressed/chromium_restore_suppressed.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9434f6f1015dca6a6e11e38c2b09645ae592afcd25a42ee5f4b675bace98205b +size 2035 diff --git a/datasets/attack_techniques/T1176.001/chromium_restore_suppressed/chromium_restore_suppressed.yml b/datasets/attack_techniques/T1176.001/chromium_restore_suppressed/chromium_restore_suppressed.yml new file mode 100644 index 000000000..8ca3c817e --- /dev/null +++ b/datasets/attack_techniques/T1176.001/chromium_restore_suppressed/chromium_restore_suppressed.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan +id: 86426950-f723-4434-9fc0-05845d4a940c +date: '2026-10-19' +description: Attack Range dataset for Chromium session restored with crash bubble suppressed technique +environment: attack_range +directory: chromium_restore_suppressed +mitre_technique: +- T1176.001 +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1176.001/chromium_restore_suppressed/chromium_restore_suppressed.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1685/user_binary_terminated_taskkill/user_binary_terminated_taskkill.log b/datasets/attack_techniques/T1685/user_binary_terminated_taskkill/user_binary_terminated_taskkill.log new file mode 100644 index 000000000..4914ccfa6 --- /dev/null +++ b/datasets/attack_techniques/T1685/user_binary_terminated_taskkill/user_binary_terminated_taskkill.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b21771f75598a2ef37eaf0ad823bf9a789013febefbea561bfc7f14abd69d104 +size 1995 diff --git a/datasets/attack_techniques/T1685/user_binary_terminated_taskkill/user_binary_terminated_taskkill.yml b/datasets/attack_techniques/T1685/user_binary_terminated_taskkill/user_binary_terminated_taskkill.yml new file mode 100644 index 000000000..563e44bcc --- /dev/null +++ b/datasets/attack_techniques/T1685/user_binary_terminated_taskkill/user_binary_terminated_taskkill.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan +id: d69b86e3-1c39-4446-918d-fbdd6f78de7d +date: '2026-10-19' +description: Attack Range dataset for user binary terminated via taskkill technique +environment: attack_range +directory: user_binary_terminated_taskkill +mitre_technique: +- T1685 +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1685/user_binary_terminated_taskkill/user_binary_terminated_taskkill.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational