Add socat T1059 datasets

datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.yml

@@ -0,0 +1,13 @@
+author: Maria Jose Erquiaga, Splunk
+id: 6f4fcbb4-3d57-4724-86d4-abad7cb3919c
+date: '2026-08-27'
+description: Process-execution telemetry generated by running the socat utility with a TCP listener binding a benign executable. The test used a listener argument and exec:/bin/cat to produce representative osquery process telemetry.
+directory: utility_socat_listener_binding_executable
+environment: attack_range
+mitre_technique:
+    - T1059
+datasets:
+    - name: osquery.log
+      sourcetype: osquery:results
+      source: osquery:results
+      path: /datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log

datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.yml

@@ -0,0 +1,13 @@
+author: Maria Jose Erquiaga
+id: 27d33a85-ada2-49b4-b156-dc1ccb453ea5
+date: '2026-08-27'
+description: Process-execution telemetry generated by running the socat utility with local terminal echo disabled while connecting to a remote TCP endpoint. The test produced representative osquery process telemetry containing echo=0 and a TCP address argument.
+environment: attack_range
+directory: utility_socat_remote_tcp_connection_with_echo_disabled
+mitre_technique:
+    - T1059
+datasets:
+    - name: osquery.log
+      sourcetype: osquery:results
+      source: osqueryd.results.log
+      path: /datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log