splunk · RavenTait · Jul 20, 2026 · Jul 20, 2026
diff --git a/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack.yml b/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: d01afb53-3320-46ce-9590-31df1f5c11b4
+date: '2026-07-20'
+description: Generated datasets for Linux Root execution of id in attack range.
+environment: attack_range
+directory: linux_root_execution_of_id
+mitre_technique:
+- T1033
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log b/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack.yml b/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 60fb22bc-f310-483e-874d-a99b5f2b5499
+date: '2026-07-20'
+description: Generated datasets for Linux Possible System Binary Backdoor in attack
+    range.
+environment: attack_range
+directory: linux_possible_system_binary_backdoor
+mitre_technique:
+- T1036
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log b/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log
diff --git a/...attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack.yml b/...attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: ded21f8a-60f7-49eb-a468-19e98b7e480d
+date: '2026-07-20'
+description: Generated datasets for Linux Suspicious Staging of Alternate System Files
+    in attack range.
+environment: attack_range
+directory: linux_suspicious_staging_of_alternate_system_files
+mitre_technique:
+- T1036
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log
diff --git a/..._techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log b/..._techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack.yml b/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 3c5f6d29-63da-4f5f-adca-4471b49c8c04
+date: '2026-07-20'
+description: Generated datasets for Linux Persistence via System Generator in attack
+    range.
+environment: attack_range
+directory: linux_persistence_via_system_generator
+mitre_technique:
+- T1037.005
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log
diff --git a/...s/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log b/...s/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack.yml b/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 24920c8a-6442-48ad-808d-49682bc3f802
+date: '2026-07-20'
+description: Generated datasets for Linux Netcat Outbound Connection in attack range.
+environment: attack_range
+directory: linux_netcat_outbound_connection
+mitre_technique:
+- T1059.004
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log b/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack.yml b/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 35cc06fa-17c7-42ec-83f9-22f3ad88d47b
+date: '2026-07-20'
+description: Generated datasets for Linux Bash Reverse Shell in attack range.
+environment: attack_range
+directory: linux_bash_reverse_shell
+mitre_technique:
+- T1059
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log b/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log
diff --git a/...attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack.yml b/...attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 1e8ff302-a71a-46bc-845f-9f593a8df7dd
+date: '2026-07-16'
+description: Generated datasets for Linux Binary Executed from Shared Memory Directory
+    in attack range.
+environment: attack_range
+directory: linux_binary_executed_from_shared_memory_directory
+mitre_technique:
+- T1059
+datasets:
+-   name: snapattack
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log
diff --git a/..._techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log b/..._techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log
diff --git a/...sets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack.yml b/...sets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 9b5ca1df-dff4-40c7-8188-b7bf48500a3e
+date: '2026-07-20'
+description: Generated datasets for Linux Possible Linux GSM Privilege Escalation
+    in attack range.
+environment: attack_range
+directory: linux_possible_linux_gsm_privilege_escalation
+mitre_technique:
+- T1068
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log
diff --git a/...ttack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log b/...ttack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack.yml b/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 61442f32-cabb-4650-ae52-f1753836f19f
+date: '2026-07-20'
+description: Generated datasets for Linux Possible Nimbuspwn Directory Traversal in
+    attack range.
+environment: attack_range
+directory: linux_possible_nimbuspwn_directory_traversal
+mitre_technique:
+- T1068
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log
diff --git a/...attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log b/...attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log
diff --git a/...attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack.yml b/...attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 5e0368ba-7c51-4df2-862f-9a6e8743f36f
+date: '2026-07-20'
+description: Generated datasets for Linux Possible Privilege Escalation via PYTHONPATH
+    in attack range.
+environment: attack_range
+directory: linux_possible_privilege_escalation_via_pythonpath
+mitre_technique:
+- T1068
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log
diff --git a/..._techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log b/..._techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack.yml b/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 5bf5a40c-86a8-470e-b356-e7978edb8b0b
+date: '2026-07-20'
+description: Generated datasets for Linux Usermod Root UID Set in attack range.
+environment: attack_range
+directory: linux_usermod_root_uid_set
+mitre_technique:
+- T1098
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log b/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log
diff --git a/...chniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack.yml b/...chniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 49235d80-cc53-4caf-820d-4ed94aed55a6
+date: '2026-07-20'
+description: Generated datasets for Linux Suspicious GCC Invocation Building Init
+    Shared Object in attack range.
+environment: attack_range
+directory: linux_suspicious_gcc_invocation_building_init_shared_object
+mitre_technique:
+- T1129
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log
diff --git a/...es/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log b/...es/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack.yml b/datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: ad3461e4-a241-4153-aee5-28e741552489
+date: '2026-07-20'
+description: Generated datasets for Linux CVE-2023-33246 RocketMQ Exploitation in
+    attack range.
+environment: attack_range
+directory: linux_cve-2023-33246_rocketmq_exploitation
+mitre_technique:
+- T1190
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack_linux.log
diff --git a/...s/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack_linux.log b/...s/attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack.yml b/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: d2e18574-c000-4c63-8478-a59656f3a4f9 
+date: '2026-07-08'
+description: Generated datasets for Linux Suspicious Child of Postgresql in
+    attack range.
+environment: attack_range
+directory: linux_suspicious_child_of_postgresql
+mitre_technique:
+- T1190
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log b/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack.yml b/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 386fb25e-e190-45c3-9fa6-20256500cfa3
+date: '2026-07-20'
+description: Generated datasets for Linux Ghostscript Exploitation in attack range.
+environment: attack_range
+directory: linux_ghostscript_exploitation
+mitre_technique:
+- T1204.002
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log b/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack.yml b/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 2b3a7fcf-68ad-447c-a9a5-bb2f5e1a6402
+date: '2026-07-20'
+description: Generated datasets for Linux Suspicious Redis Activity in attack range.
+environment: attack_range
+directory: linux_suspicious_redis_activity
+mitre_technique:
+- T1505
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log b/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack.yml b/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 13cfdf60-6b72-4b55-a27a-09700bbf2dee
+date: '2026-07-20'
+description: Generated datasets for Linux EFI Bootloader File Deletion in attack range.
+environment: attack_range
+directory: linux_efi_bootloader_file_deletion
+mitre_technique:
+- T1542
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log b/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack.yml b/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: 4e6790d2-7bf8-4bf0-9322-96e0f196d46f
+date: '2026-07-20'
+description: Generated datasets for Linux Possible Bootloader Modifications in attack
+    range.
+environment: attack_range
+directory: linux_possible_bootloader_modifications
+mitre_technique:
+- T1542
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log
diff --git a/...sets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log b/...sets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack.yml b/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 977050e9-44e9-4075-a4c8-58235394aac6
+date: '2026-07-20'
+description: Generated datasets for Linux MOTD Script Added in attack range.
+environment: attack_range
+directory: linux_motd_script_added
+mitre_technique:
+- T1547
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log b/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack.yml b/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 8aef6445-a594-44ce-901c-805a59c803c9
+date: '2026-07-20'
+description: Generated datasets for Linux Suspicious XDG Autostart in attack range.
+environment: attack_range
+directory: linux_suspicious_xdg_autostart
+mitre_technique:
+- T1547
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log b/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack.yml b/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: d9e280e9-4036-4db9-8ab3-2d5d0741f0b5
+date: '2026-07-20'
+description: Generated datasets for Linux UDEV Rule Created in attack range.
+environment: attack_range
+directory: linux_udev_rule_created
+mitre_technique:
+- T1547
+datasets:
+-   name: snapattack_linux
+    sourcetype: sysmon:linux
+    source: Syslog:Linux-Sysmon/Operational
+    path: /datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log
diff --git a/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log b/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log