quasar

Author: t-contreras

datasets/attack_techniques/T1218.003/moz_lib_loaded/moz_lib_loaded.yml

@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: d58e0ba2-5d76-11f0-bda4-629be353806a
+date: '2025-07-10'
+description: Generated datasets for moz lib loaded in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.003/moz_lib_loaded/mozilla_lib.log
+sourcetypes:
+- 'WinEventLog:Security'
+references:
+- https://www.trendmicro.com/vinfo/nz/threat-encyclopedia/malware/trojanspy.win32.vidar.yxdftz

datasets/attack_techniques/T1218.003/moz_lib_loaded/mozilla_lib.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:59040b1f2da45ee7a761755281a29f257f3bcb9d993584e7fdc08ed366ed86a0
+size 4452

datasets/attack_techniques/T1552.001/file_xml_config/file_xml_config.yml

@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: 688a823a-5d79-11f0-bda4-629be353806a
+date: '2025-07-10'
+description: Generated datasets for file xml config in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/file_xml_config/filezilla_obj.log
+sourcetypes:
+- 'WinEventLog:Security'
+references:
+- https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html

datasets/attack_techniques/T1552.001/file_xml_config/filezilla_obj.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0d7f7f2d1093a6981441bbf3a30ae036549b060f64a150986cdc3da4ea39316c
+size 6046

datasets/attack_techniques/T1552.001/ie_intelliform_storage/ie_intelliform_storage.yml

@@ -0,0 +1,11 @@
+author: Teoderick Contreras, Splunk
+id: c2e6ef24-5d75-11f0-bda4-629be353806a
+date: '2025-07-10'
+description: Generated datasets for ie intelliform storage in attack range.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/ie_intelliform_storage/storage2_sim.log
+sourcetypes:
+- 'WinEventLog:Security'
+references:
+- https://stackoverflow.com/questions/1276700/where-does-internet-explorer-stores-its-form-data-history-that-is-uses-for-auto

datasets/attack_techniques/T1552.001/ie_intelliform_storage/storage2_sim.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:044f999a446c05689259ab5505af841b60274be6489d44b7d9bd539f80eb7f50
+size 7427