From 8657342531b82bde3d65b25eea47284d99ff5e1c Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Wed, 23 Sep 2026 13:36:57 -0400 Subject: [PATCH 1/2] add resetnightmare log --- .../T1078.002/resetnightmare/resetnightmare.yml | 13 +++++++++++++ .../T1078.002/resetnightmare/windows-xml.log | 3 +++ 2 files changed, 16 insertions(+) create mode 100644 datasets/attack_techniques/T1078.002/resetnightmare/resetnightmare.yml create mode 100644 datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log diff --git a/datasets/attack_techniques/T1078.002/resetnightmare/resetnightmare.yml b/datasets/attack_techniques/T1078.002/resetnightmare/resetnightmare.yml new file mode 100644 index 000000000..37d851dfb --- /dev/null +++ b/datasets/attack_techniques/T1078.002/resetnightmare/resetnightmare.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: d65ac1ca-85be-4a33-82d0-944222f374b6 +date: '2026-09-23' +description: Manual exploitation of CVE-2026-27912 using a public exploit. +environment: attack_range +directory: resetnightmare +mitre_technique: +- T1078.002 +datasets: +- name: windows-xml + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security + path: /datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log diff --git a/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log b/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log new file mode 100644 index 000000000..521692750 --- /dev/null +++ b/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:cb9de8417d1b40b0c7629795bbe84e040da70ccb44a12d5e869f8a9a141d80d8 +size 1958 From a812ad71506550f8003de8bf6fd4713f0a9ebb47 Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Wed, 23 Sep 2026 14:25:40 -0400 Subject: [PATCH 2/2] flattened log --- .../T1078.002/resetnightmare/windows-xml.log | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log b/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log index 521692750..82624e9b0 100644 --- a/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log +++ b/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:cb9de8417d1b40b0c7629795bbe84e040da70ccb44a12d5e869f8a9a141d80d8 -size 1958 +oid sha256:bcc0c1da4dbb79b04e5e905a854226ad33ab050e3480589317c0d0c37189aab4 +size 1714