GitHub Repo

Data1

Date: 2025-08-12 ID: dd0f91c3-d962-4e76-bea8-994f108b924b Author: Generated by dataset_analyzer.py Environment: attack_range Directory: data1

Description

Automatically categorized datasets in directory data1

MITRE ATT&CK Techniques

No MITRE techniques specified for this dataset.

Environment Details

Field Value
Environment attack_range
Directory data1
Test Date 2025-08-12

Datasets

The following datasets were collected during this attack simulation:

Windows-Sysmon

  • Path: /datasets/malware/ransomware_ttp/data1/windows-sysmon.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

The following detections in our security content repository use this attack data for testing:

Detection Name Type Source MITRE ATT&CK Analytic Story
Disable Logs Using WevtUtil TTP Endpoint T1070.001 Ransomware, CISA AA23-347A, Rhysida Ransomware
Windows Registry Modification for Safe Mode Persistence TTP Endpoint T1547.001 Ransomware, Windows Registry Abuse, Windows Drivers
Permission Modification using Takeown App Anomaly Endpoint T1222 Sandworm Tools, Ransomware, Crypto Stealer, Scattered Lapsus$ Hunters
Prevent Automatic Repair Mode using Bcdedit TTP Endpoint T1490 Ransomware, Chaos Ransomware
Allow Operation with Consent Admin TTP Endpoint T1548 Ransomware, Windows Registry Abuse, Azorult, MoonPeak
Clear Unallocated Sector Using Cipher App TTP Endpoint T1070.004 Ransomware, Compromised Windows Host, Scattered Spider

Usage Instructions

Replay with Splunk Attack Data

Replay attack data with replay.py from Splunk Attack Data.

1python replay.py --dataset /datasets/malware/ransomware_ttp/data1/windows-sysmon.log --index attack_data

Manual Import

  1. Download the dataset files from the paths listed above
  2. Configure your Splunk instance with the appropriate sourcetypes
  3. Import the logs using the Splunk Add Data wizard

Related Content

Find more detections and analytics for this attack technique in our security content repository.

Source: GitHub | Version: 1.0