diff --git a/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack.yml b/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack.yml new file mode 100644 index 000000000..de806d1d9 --- /dev/null +++ b/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: d01afb53-3320-46ce-9590-31df1f5c11b4 +date: '2026-07-20' +description: Generated datasets for Linux Root execution of id in attack range. +environment: attack_range +directory: linux_root_execution_of_id +mitre_technique: +- T1033 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log diff --git a/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log b/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log new file mode 100644 index 000000000..ef65308f9 --- /dev/null +++ b/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:3ad571c5c077f4e630812cb50e28b872d632c146dc26662844d28613afe662b1 +size 18014 diff --git a/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack.yml b/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack.yml new file mode 100644 index 000000000..88bc6a27b --- /dev/null +++ b/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 60fb22bc-f310-483e-874d-a99b5f2b5499 +date: '2026-07-20' +description: Generated datasets for Linux Possible System Binary Backdoor in attack + range. +environment: attack_range +directory: linux_possible_system_binary_backdoor +mitre_technique: +- T1036 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log diff --git a/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log b/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log new file mode 100644 index 000000000..505c6d4fc --- /dev/null +++ b/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6fef0763fd7c7541254bd7e8fa8ef34e8d2b5e46fd7be47587b0b79d6fd403ae +size 1858 diff --git a/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack.yml b/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack.yml new file mode 100644 index 000000000..0aea218b3 --- /dev/null +++ b/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: ded21f8a-60f7-49eb-a468-19e98b7e480d +date: '2026-07-20' +description: Generated datasets for Linux Suspicious Staging of Alternate System Files + in attack range. +environment: attack_range +directory: linux_suspicious_staging_of_alternate_system_files +mitre_technique: +- T1036 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log diff --git a/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log b/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log new file mode 100644 index 000000000..b5ea03581 --- /dev/null +++ b/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:71482d082648599f4840a411e9885e321603f265409a13e1400b1b61aa4d1f95 +size 1928 diff --git a/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack.yml b/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack.yml new file mode 100644 index 000000000..c1e694da0 --- /dev/null +++ b/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 3c5f6d29-63da-4f5f-adca-4471b49c8c04 +date: '2026-07-20' +description: Generated datasets for Linux Persistence via System Generator in attack + range. +environment: attack_range +directory: linux_persistence_via_system_generator +mitre_technique: +- T1037.005 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log diff --git a/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log b/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log new file mode 100644 index 000000000..a467b12ae --- /dev/null +++ b/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5bb7db3a723075a49bc5718fcac9ba09705b4956b8d3cd0296e0923f386b5a25 +size 1918 diff --git a/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack.yml b/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack.yml new file mode 100644 index 000000000..b558642e2 --- /dev/null +++ b/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 24920c8a-6442-48ad-808d-49682bc3f802 +date: '2026-07-20' +description: Generated datasets for Linux Netcat Outbound Connection in attack range. +environment: attack_range +directory: linux_netcat_outbound_connection +mitre_technique: +- T1059.004 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log diff --git a/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log b/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log new file mode 100644 index 000000000..87637f669 --- /dev/null +++ b/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0b1c6400747eb6d1026980823e7f4eaa7890584bd3200f5bc9e25f210ce275f5 +size 2578 diff --git a/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack.yml b/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack.yml new file mode 100644 index 000000000..763f6dccd --- /dev/null +++ b/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 35cc06fa-17c7-42ec-83f9-22f3ad88d47b +date: '2026-07-20' +description: Generated datasets for Linux Bash Reverse Shell in attack range. +environment: attack_range +directory: linux_bash_reverse_shell +mitre_technique: +- T1059 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log diff --git a/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log b/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log new file mode 100644 index 000000000..facac2b73 --- /dev/null +++ b/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9f2fe9e8c2f3e00dc0cadbdba38c3fa791be1dfc026ca8e236682ed1916d8acf +size 3466 diff --git a/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack.yml b/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack.yml new file mode 100644 index 000000000..22f41245a --- /dev/null +++ b/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 1e8ff302-a71a-46bc-845f-9f593a8df7dd +date: '2026-07-16' +description: Generated datasets for Linux Binary Executed from Shared Memory Directory + in attack range. +environment: attack_range +directory: linux_binary_executed_from_shared_memory_directory +mitre_technique: +- T1059 +datasets: +- name: snapattack + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log diff --git a/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log b/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log new file mode 100644 index 000000000..13b541bc7 --- /dev/null +++ b/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d4ab099e33e4f958497e3e28a331995d5f3a46a0be8a1227199a523ca49650bc +size 1601 diff --git a/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack.yml b/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack.yml new file mode 100644 index 000000000..3c557b702 --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 9b5ca1df-dff4-40c7-8188-b7bf48500a3e +date: '2026-07-20' +description: Generated datasets for Linux Possible Linux GSM Privilege Escalation + in attack range. +environment: attack_range +directory: linux_possible_linux_gsm_privilege_escalation +mitre_technique: +- T1068 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log diff --git a/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log b/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log new file mode 100644 index 000000000..062f5befb --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6d090629ef64a3597747bed092d3aa7a5f3af594bd93a51c38769edbfde4b9ec +size 3578 diff --git a/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack.yml b/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack.yml new file mode 100644 index 000000000..1da457824 --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 61442f32-cabb-4650-ae52-f1753836f19f +date: '2026-07-20' +description: Generated datasets for Linux Possible Nimbuspwn Directory Traversal in + attack range. +environment: attack_range +directory: linux_possible_nimbuspwn_directory_traversal +mitre_technique: +- T1068 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log diff --git a/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log b/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log new file mode 100644 index 000000000..2de818adc --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c1078491f99f62431c8d4cf2b21e2d822594b4cff247a0a1c59d6012070bbca5 +size 3158 diff --git a/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack.yml b/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack.yml new file mode 100644 index 000000000..5d3b2b76d --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 5e0368ba-7c51-4df2-862f-9a6e8743f36f +date: '2026-07-20' +description: Generated datasets for Linux Possible Privilege Escalation via PYTHONPATH + in attack range. +environment: attack_range +directory: linux_possible_privilege_escalation_via_pythonpath +mitre_technique: +- T1068 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log diff --git a/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log b/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log new file mode 100644 index 000000000..7773a8343 --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:111319a79dcce9198d98d87468bad5fcfc15a59f8c66d0d6f1144ad9e76871f3 +size 1950 diff --git a/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack.yml b/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack.yml new file mode 100644 index 000000000..dd71942ab --- /dev/null +++ b/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 5bf5a40c-86a8-470e-b356-e7978edb8b0b +date: '2026-07-20' +description: Generated datasets for Linux Usermod Root UID Set in attack range. +environment: attack_range +directory: linux_usermod_root_uid_set +mitre_technique: +- T1098 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log diff --git a/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log b/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log new file mode 100644 index 000000000..bb172e754 --- /dev/null +++ b/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:bc2b87aea9677484478daa258e96d9e4bf72ac1b8ed421e0f942343fab8c3648 +size 3308 diff --git a/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack.yml b/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack.yml new file mode 100644 index 000000000..3f49200bc --- /dev/null +++ b/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 49235d80-cc53-4caf-820d-4ed94aed55a6 +date: '2026-07-20' +description: Generated datasets for Linux Suspicious GCC Invocation Building Init + Shared Object in attack range. +environment: attack_range +directory: linux_suspicious_gcc_invocation_building_init_shared_object +mitre_technique: +- T1129 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log diff --git a/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log b/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log new file mode 100644 index 000000000..59409df07 --- /dev/null +++ b/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2ea82cd8aad8734c231670da4b38884c3b47707c4e4cbf26f1b0dede7100d6ed +size 3478 diff --git a/datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack.yml b/datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack.yml new file mode 100644 index 000000000..d9267e262 --- /dev/null +++ b/datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: ad3461e4-a241-4153-aee5-28e741552489 +date: '2026-07-20' +description: Generated datasets for Linux CVE-2023-33246 RocketMQ Exploitation in + attack range. +environment: attack_range +directory: linux_cve-2023-33246_rocketmq_exploitation +mitre_technique: +- T1190 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack_linux.log diff --git a/datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack_linux.log b/datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack_linux.log new file mode 100644 index 000000000..86406913a --- /dev/null +++ b/datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:71f4ee71a3cc72d9c70801594f1137593b15c3ba6f4a8678645da5367d9e02bb +size 3408 diff --git a/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack.yml b/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack.yml new file mode 100644 index 000000000..c6e46c521 --- /dev/null +++ b/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: d2e18574-c000-4c63-8478-a59656f3a4f9 +date: '2026-07-08' +description: Generated datasets for Linux Suspicious Child of Postgresql in + attack range. +environment: attack_range +directory: linux_suspicious_child_of_postgresql +mitre_technique: +- T1190 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log diff --git a/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log b/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log new file mode 100644 index 000000000..0e4efaf65 --- /dev/null +++ b/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4f1548f6626cf538a57e182b9e5d73d9ba2704c800cc3764616f31eed58405f7 +size 1577 diff --git a/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack.yml b/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack.yml new file mode 100644 index 000000000..1c75f1a3c --- /dev/null +++ b/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 386fb25e-e190-45c3-9fa6-20256500cfa3 +date: '2026-07-20' +description: Generated datasets for Linux Ghostscript Exploitation in attack range. +environment: attack_range +directory: linux_ghostscript_exploitation +mitre_technique: +- T1204.002 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log diff --git a/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log b/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log new file mode 100644 index 000000000..1fb2dde5a --- /dev/null +++ b/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6ca8a06804e5ee5e6367ece8032f3d2347b29de6f4827c4bec428b661daccfd0 +size 3336 diff --git a/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack.yml b/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack.yml new file mode 100644 index 000000000..02dbebd23 --- /dev/null +++ b/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 2b3a7fcf-68ad-447c-a9a5-bb2f5e1a6402 +date: '2026-07-20' +description: Generated datasets for Linux Suspicious Redis Activity in attack range. +environment: attack_range +directory: linux_suspicious_redis_activity +mitre_technique: +- T1505 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log diff --git a/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log b/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log new file mode 100644 index 000000000..b7351a984 --- /dev/null +++ b/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:98c2a3afcd59286dd14d279f09859a1ec25d2ea2bc0a36454f20344260215bb2 +size 3122 diff --git a/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack.yml b/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack.yml new file mode 100644 index 000000000..5c55f701c --- /dev/null +++ b/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 13cfdf60-6b72-4b55-a27a-09700bbf2dee +date: '2026-07-20' +description: Generated datasets for Linux EFI Bootloader File Deletion in attack range. +environment: attack_range +directory: linux_efi_bootloader_file_deletion +mitre_technique: +- T1542 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log diff --git a/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log b/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log new file mode 100644 index 000000000..12c0707cc --- /dev/null +++ b/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ebafe8bc7fafd9dc0b120d8c33c35c6df5600e486ea96cb5ba35c12ac05e031e +size 1952 diff --git a/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack.yml b/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack.yml new file mode 100644 index 000000000..f22b0342b --- /dev/null +++ b/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 4e6790d2-7bf8-4bf0-9322-96e0f196d46f +date: '2026-07-20' +description: Generated datasets for Linux Possible Bootloader Modifications in attack + range. +environment: attack_range +directory: linux_possible_bootloader_modifications +mitre_technique: +- T1542 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log diff --git a/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log b/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log new file mode 100644 index 000000000..bf25ee87f --- /dev/null +++ b/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:329ae08af8e9cf143f0f810cf81d512855aa3bb69331e380eb203e08c8e3eeda +size 3244 diff --git a/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack.yml b/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack.yml new file mode 100644 index 000000000..bf44150c7 --- /dev/null +++ b/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 977050e9-44e9-4075-a4c8-58235394aac6 +date: '2026-07-20' +description: Generated datasets for Linux MOTD Script Added in attack range. +environment: attack_range +directory: linux_motd_script_added +mitre_technique: +- T1547 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log diff --git a/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log b/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log new file mode 100644 index 000000000..05f3f5982 --- /dev/null +++ b/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:a2a456e881fe30dd4da31ff922c3bf7dca11cff361f395dca13bd7d3ea845dbb +size 1912 diff --git a/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack.yml b/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack.yml new file mode 100644 index 000000000..7dea5f173 --- /dev/null +++ b/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 8aef6445-a594-44ce-901c-805a59c803c9 +date: '2026-07-20' +description: Generated datasets for Linux Suspicious XDG Autostart in attack range. +environment: attack_range +directory: linux_suspicious_xdg_autostart +mitre_technique: +- T1547 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log diff --git a/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log b/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log new file mode 100644 index 000000000..452966eb0 --- /dev/null +++ b/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b4f8a463e196a84136cb32a7db915024f7928d22bb0ea48e5b47b33831c44515 +size 1918 diff --git a/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack.yml b/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack.yml new file mode 100644 index 000000000..31c4b9ba2 --- /dev/null +++ b/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: d9e280e9-4036-4db9-8ab3-2d5d0741f0b5 +date: '2026-07-20' +description: Generated datasets for Linux UDEV Rule Created in attack range. +environment: attack_range +directory: linux_udev_rule_created +mitre_technique: +- T1547 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log diff --git a/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log b/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log new file mode 100644 index 000000000..6cdf4c51e --- /dev/null +++ b/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:db5f1d98fbed41193d8b2b2a1e38be9e8d04a1a752d4dece1931bb40f7e61cf6 +size 1910 diff --git a/datasets/attack_techniques/T1548.003/linux_suspicious_sudo_parameter/snapattack.yml b/datasets/attack_techniques/T1548.003/linux_suspicious_sudo_parameter/snapattack.yml new file mode 100644 index 000000000..4d10985fa --- /dev/null +++ b/datasets/attack_techniques/T1548.003/linux_suspicious_sudo_parameter/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 96ea331d-e379-4d05-96fc-d382f3f84629 +date: '2026-07-20' +description: Generated datasets for Linux Suspicious Sudo Parameter in attack range. +environment: attack_range +directory: linux_suspicious_sudo_parameter +mitre_technique: +- T1548.003 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1548.003/linux_suspicious_sudo_parameter/snapattack_linux.log diff --git a/datasets/attack_techniques/T1548.003/linux_suspicious_sudo_parameter/snapattack_linux.log b/datasets/attack_techniques/T1548.003/linux_suspicious_sudo_parameter/snapattack_linux.log new file mode 100644 index 000000000..bc56c1178 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/linux_suspicious_sudo_parameter/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:959580310d7220f653de11545e5fa60db2a910166e28ac5fbcfc3d1a72e74a24 +size 3350 diff --git a/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack.yml b/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack.yml new file mode 100644 index 000000000..999f55582 --- /dev/null +++ b/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 7ea799bb-873d-4dc8-bfb6-6789ee050ed5 +date: '2026-07-20' +description: Generated datasets for Linux Bash History Access in attack range. +environment: attack_range +directory: linux_bash_history_access +mitre_technique: +- T1552.003 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log diff --git a/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log b/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log new file mode 100644 index 000000000..8bc75ac01 --- /dev/null +++ b/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0762034007680176d8a7c7eec2f2f01515f39d6ee4a76cddb92b6537fb521225 +size 3064 diff --git a/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack.yml b/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack.yml new file mode 100644 index 000000000..11e4dd81a --- /dev/null +++ b/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: b8a175cd-92ff-4eed-a52b-f837ad40a0b4 +date: '2026-07-20' +description: Generated datasets for Linux Suspicious Docker Build in attack range. +environment: attack_range +directory: linux_suspicious_docker_build +mitre_technique: +- T1610 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack_linux.log diff --git a/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack_linux.log b/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack_linux.log new file mode 100644 index 000000000..405d07323 --- /dev/null +++ b/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:e168bd6b2c18612eb56dfb3a7869e1ac3c94ff602cf421e573af86e143829452 +size 3350 diff --git a/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack.yml b/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack.yml new file mode 100644 index 000000000..d6237d38e --- /dev/null +++ b/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 963ad8fb-60b5-4db2-a5e7-0f97e2d29bc6 +date: '2026-07-20' +description: Generated datasets for Linux Suspicious Privileged Container in attack + range. +environment: attack_range +directory: linux_suspicious_privileged_container +mitre_technique: +- T1610 +datasets: +- name: snapattack_linux + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational + path: /datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack_linux.log diff --git a/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack_linux.log b/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack_linux.log new file mode 100644 index 000000000..c9672b35b --- /dev/null +++ b/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:34d84bcb0efd8b99a55d9985f6e4b10c67239861056ad3f2b21b519fcde51c4f +size 3408