From fe946f314b7cc17efe703ec3912b61cfb827e70b Mon Sep 17 00:00:00 2001 From: merquiag Date: Fri, 28 Aug 2026 17:37:33 +0200 Subject: [PATCH 1/3] Add socat T1059 socat datasets --- .../osquery.log | 3 +++ .../osquery.yml | 13 +++++++++++++ .../osquery.log | 3 +++ .../osquery.yml | 13 +++++++++++++ 4 files changed, 32 insertions(+) create mode 100644 datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log create mode 100644 datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml create mode 100644 datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log create mode 100644 datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml diff --git a/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log new file mode 100644 index 00000000..66a2dd3e --- /dev/null +++ b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ff0846f99008a3470528f1ae5fe289bfc4575ced27936620d519293aebf7cf5e +size 2060 diff --git a/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml new file mode 100644 index 00000000..3f9db154 --- /dev/null +++ b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml @@ -0,0 +1,13 @@ +author: Maria Jose Erquiaga +id: 6F4FCBB4-3D57-4724-86D4-ABAD7CB3919C +date: '2026-08-27' +description: Process-execution telemetry generated by running the socat utility with a TCP listener binding a benign executable. The test used a listener argument and exec:/bin/cat to produce representative osquery process telemetry. +directory: utility_socat_listener_binding_executable +environment: attack_range +mitre_technique: + - T1059 +datasets: + - name: osquery.log + sourcetype: osquery:results + source: osquery:results + path: /datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log diff --git a/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log new file mode 100644 index 00000000..a5d07cc5 --- /dev/null +++ b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6f43db76159bbcb7604af2982a6f4a7b8d591dd7291bfc28636788a24cfa3120 +size 2045 diff --git a/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml new file mode 100644 index 00000000..efed3812 --- /dev/null +++ b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml @@ -0,0 +1,13 @@ +author: , Splunk +id: +date: '2026-08-27' +description: Process-execution telemetry generated by running the socat utility with local terminal echo disabled while connecting to a remote TCP endpoint. The test produced representative osquery process telemetry containing echo=0 and a TCP address argument. +environment: attack_range +directory: utility_socat_remote_tcp_connection_with_echo_disabled +mitre_technique: + - T1059 +datasets: + - name: osquery.log + path: /datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log + source: osqueryd.results.log + sourcetype: osquery:results From 9afa507c8784f030a65932c6a4b3af204d1e26ea Mon Sep 17 00:00:00 2001 From: merquiag Date: Fri, 28 Aug 2026 18:24:18 +0200 Subject: [PATCH 2/3] Fix socat dataset UUID --- .../osquery.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml index efed3812..7678921a 100644 --- a/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml +++ b/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml @@ -1,5 +1,5 @@ -author: , Splunk -id: +author: Maria Jose Erquiaga +id: 27d33a85-ada2-49b4-b156-dc1ccb453ea5 date: '2026-08-27' description: Process-execution telemetry generated by running the socat utility with local terminal echo disabled while connecting to a remote TCP endpoint. The test produced representative osquery process telemetry containing echo=0 and a TCP address argument. environment: attack_range @@ -8,6 +8,6 @@ mitre_technique: - T1059 datasets: - name: osquery.log - path: /datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log - source: osqueryd.results.log sourcetype: osquery:results + source: osqueryd.results.log + path: /datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log From 13262206d4b0a8c25c73465a161a3bb86a2d32dc Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Fri, 28 Aug 2026 18:26:02 +0200 Subject: [PATCH 3/3] Apply batched suggestions from code review Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- .../utility_socat_listener_binding_executable/osquery.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml index 3f9db154..74c0fcef 100644 --- a/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml +++ b/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml @@ -1,5 +1,5 @@ -author: Maria Jose Erquiaga -id: 6F4FCBB4-3D57-4724-86D4-ABAD7CB3919C +author: Maria Jose Erquiaga, Splunk +id: 6f4fcbb4-3d57-4724-86d4-abad7cb3919c date: '2026-08-27' description: Process-execution telemetry generated by running the socat utility with a TCP listener binding a benign executable. The test used a listener argument and exec:/bin/cat to produce representative osquery process telemetry. directory: utility_socat_listener_binding_executable