Merge pull request #847 from dluxtron/master

Adding Portscan Datasets
splunk · Oct 20, 2023 · 29f52ac · 29f52ac
2 parents bb4dbb3 + 2ba0727
commit 29f52ac
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 1 deletion.
diff --git a/datasets/attack_techniques/T1046/nmap/horizontal.log b/datasets/attack_techniques/T1046/nmap/horizontal.log
diff --git a/datasets/attack_techniques/T1046/nmap/nmap.yml b/datasets/attack_techniques/T1046/nmap/nmap.yml
@@ -0,0 +1,11 @@
+author: Dean Luxton
+id: 62c7bcd1-3eea-4ca7-9e73-d286b375d543 
+date: '2023-10-20'
+description: Manual generation of nmap portscanning activity within attack range. 
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/vertical.log
+sourcetypes:
+- aws:cloudwatchlogs:vpcflow
+
diff --git a/datasets/attack_techniques/T1046/nmap/vertical.log b/datasets/attack_techniques/T1046/nmap/vertical.log
diff --git a/datasets/attack_techniques/T1098/account_manipulation/account_manipulation.yml b/datasets/attack_techniques/T1098/account_manipulation/account_manipulation.yml
@@ -10,7 +10,7 @@ dataset:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/xml-windows-security.log
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
 sourcetypes:
 - WinEventLog:Security
 - aws:cloudtrail