From 79583194a29a99532b524af6e30cdd054d4be2ea Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Tue, 25 Aug 2026 13:23:17 -0400 Subject: [PATCH] SCCM CVE Data --- .../builtin_account_rename.yml | 13 +++++++++++++ .../builtin_account_rename/windows_security.log | 3 +++ .../sccm_adsource_dll/sccm_adsource_dll.yml | 13 +++++++++++++ .../T1574.002/sccm_adsource_dll/sysmon.log | 3 +++ 4 files changed, 32 insertions(+) create mode 100644 datasets/attack_techniques/T1078.003/builtin_account_rename/builtin_account_rename.yml create mode 100644 datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log create mode 100644 datasets/attack_techniques/T1574.002/sccm_adsource_dll/sccm_adsource_dll.yml create mode 100644 datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log diff --git a/datasets/attack_techniques/T1078.003/builtin_account_rename/builtin_account_rename.yml b/datasets/attack_techniques/T1078.003/builtin_account_rename/builtin_account_rename.yml new file mode 100644 index 00000000..b1aed48c --- /dev/null +++ b/datasets/attack_techniques/T1078.003/builtin_account_rename/builtin_account_rename.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 947b2dd5-1604-4ef3-a06d-e67a72162018 +date: '2026-08-24' +description: Generated datasets for Windows Builtin Account rename in attack range. +environment: attack_range +directory: builtin_account_rename +mitre_technique: +- T1078.003 +datasets: +- name: windows_security + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security + path: /datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log diff --git a/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log b/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log new file mode 100644 index 00000000..09a5863e --- /dev/null +++ b/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f7343354746642516ba6dba392b469d4867fa0aa031ebc7c85b2846e498f166f +size 1213 diff --git a/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sccm_adsource_dll.yml b/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sccm_adsource_dll.yml new file mode 100644 index 00000000..fa306cb8 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sccm_adsource_dll.yml @@ -0,0 +1,13 @@ +author: Raven Tait +id: 4f55b07b-7aeb-47f4-a234-b222a902276b +date: '2026-08-20' +description: Sysmon file creation telemetry capturing adsource.dll staging in the SCCM SMS Provider bin\X64 directory, consistent with CVE-2026-47301 DLL side-loading exploitation. +environment: attack_range +directory: sccm_adsource_dll +mitre_technique: +- T1574.002 +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log b/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log new file mode 100644 index 00000000..241bb8fb --- /dev/null +++ b/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0fa93b4ba34395651bc7f10eb789e6dd82af28278ed53619a01fabba651f0579 +size 2654