diff --git a/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log new file mode 100644 index 00000000..66a2dd3e --- /dev/null +++ b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ff0846f99008a3470528f1ae5fe289bfc4575ced27936620d519293aebf7cf5e +size 2060 diff --git a/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml new file mode 100644 index 00000000..74c0fcef --- /dev/null +++ b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml @@ -0,0 +1,13 @@ +author: Maria Jose Erquiaga, Splunk +id: 6f4fcbb4-3d57-4724-86d4-abad7cb3919c +date: '2026-08-27' +description: Process-execution telemetry generated by running the socat utility with a TCP listener binding a benign executable. The test used a listener argument and exec:/bin/cat to produce representative osquery process telemetry. +directory: utility_socat_listener_binding_executable +environment: attack_range +mitre_technique: + - T1059 +datasets: + - name: osquery.log + sourcetype: osquery:results + source: osquery:results + path: /datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log diff --git a/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log new file mode 100644 index 00000000..a5d07cc5 --- /dev/null +++ b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6f43db76159bbcb7604af2982a6f4a7b8d591dd7291bfc28636788a24cfa3120 +size 2045 diff --git a/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml new file mode 100644 index 00000000..7678921a --- /dev/null +++ b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml @@ -0,0 +1,13 @@ +author: Maria Jose Erquiaga +id: 27d33a85-ada2-49b4-b156-dc1ccb453ea5 +date: '2026-08-27' +description: Process-execution telemetry generated by running the socat utility with local terminal echo disabled while connecting to a remote TCP endpoint. The test produced representative osquery process telemetry containing echo=0 and a TCP address argument. +environment: attack_range +directory: utility_socat_remote_tcp_connection_with_echo_disabled +mitre_technique: + - T1059 +datasets: + - name: osquery.log + sourcetype: osquery:results + source: osqueryd.results.log + path: /datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log