Added powerview xml log

splunk · Jun 10, 2024 · 756d073 · 756d073
1 parent 54ae2a5
commit 756d073
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/datasets/attack_techniques/T1069.002/AD_discovery/AD_discovery.yml b/datasets/attack_techniques/T1069.002/AD_discovery/AD_discovery.yml
@@ -5,11 +5,12 @@ description: 'Simulated test Attack range dataset for AD discovery techniques us
 environment: attack_range
 dataset: 
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview.log
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-security.log
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/ldifde_4688_windows-security.log
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/ldifde_windows-sysmon.log
 sourcetypes:
 - XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 - WinEventLog:Microsoft-Windows-PowerShell/Operational
-- WinEventLog:Security
+- WinEventLog:Security
diff --git a/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview.log b/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview.log