From 0687fdd117bd9a17bfc83bd32cf23f1a95247440 Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 7 Aug 2026 11:18:29 +0200 Subject: [PATCH 1/3] Add osascript dataset for T1059.00 --- .../osascript/osascript_prompts_user.log | 3 +++ .../osascript/osascript_prompts_user.yml | 17 +++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log create mode 100644 datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log new file mode 100644 index 000000000..cd62a206e --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:8d9a4664b4659024da715b6686e50c86cfd95ca6f6616f1652ade5134cb4aaa2 +size 2853 diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml new file mode 100644 index 000000000..de9c7e2b4 --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml @@ -0,0 +1,17 @@ +author: Radka Viskova +id: 67d286c1-1f42-47c1-806a-eb976bb9c542 +date: '2026-08-07' +description: Generated dataset for osascript execution prompting for user interaction with osquery and endpoint security +environment: TalosOffensiveLab +directory: osascript +mitre_technique: +- T1059.002 +dataset: +- name: osascript_prompts_user + path: /datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log + sourcetype: osquery:results + source: osquery +references: +- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +- https://attack.mitre.org/techniques/T1059/002/ +- https://attack.mitre.org/techniques/T1056/002/ \ No newline at end of file From d8079ec386ca07c13fffe1b771c9494af55beb12 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Thu, 27 Aug 2026 18:46:34 +0200 Subject: [PATCH 2/3] Update osascript_prompts_user.yml --- .../T1059.002/osascript/osascript_prompts_user.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml index de9c7e2b4..294bf74e8 100644 --- a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml @@ -6,12 +6,8 @@ environment: TalosOffensiveLab directory: osascript mitre_technique: - T1059.002 -dataset: -- name: osascript_prompts_user +datasets: +- name: osascript_prompts_user.log path: /datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log sourcetype: osquery:results source: osquery -references: -- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ -- https://attack.mitre.org/techniques/T1059/002/ -- https://attack.mitre.org/techniques/T1056/002/ \ No newline at end of file From d1f4b0c779132b52f10f212fa642f2f3b1e46d68 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 27 Aug 2026 21:26:09 +0200 Subject: [PATCH 3/3] Apply suggestion from @nasbench --- .../T1059.002/osascript/osascript_prompts_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml index 294bf74e8..41d395248 100644 --- a/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml +++ b/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.yml @@ -7,7 +7,7 @@ directory: osascript mitre_technique: - T1059.002 datasets: -- name: osascript_prompts_user.log +- name: osascript_prompts_user path: /datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log sourcetype: osquery:results source: osquery