From 7ec53d20c526399c6763ac9962bf3826bf010065 Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Tue, 10 Nov 2026 13:36:54 -0500 Subject: [PATCH] SSHhole data --- datasets/emerging_threats/sshhole/audit.log | 3 +++ datasets/emerging_threats/sshhole/sshhole.yml | 17 +++++++++++++++++ datasets/emerging_threats/sshhole/syslog.log | 3 +++ 3 files changed, 23 insertions(+) create mode 100644 datasets/emerging_threats/sshhole/audit.log create mode 100644 datasets/emerging_threats/sshhole/sshhole.yml create mode 100644 datasets/emerging_threats/sshhole/syslog.log diff --git a/datasets/emerging_threats/sshhole/audit.log b/datasets/emerging_threats/sshhole/audit.log new file mode 100644 index 00000000..032865a9 --- /dev/null +++ b/datasets/emerging_threats/sshhole/audit.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:7962aa93f499dd086949d992d610a28bb0dda80e73c36132e1b3a5f44b357686 +size 1087 diff --git a/datasets/emerging_threats/sshhole/sshhole.yml b/datasets/emerging_threats/sshhole/sshhole.yml new file mode 100644 index 00000000..1738549b --- /dev/null +++ b/datasets/emerging_threats/sshhole/sshhole.yml @@ -0,0 +1,17 @@ +author: Raven Tait, Splunk +id: 3a478d9e-9c1f-4cde-a32f-c6a991b621e4 +date: '2026-11-09' +description: Linux syslog and auditd datasets for sshhole SSH authentication bypass. +environment: attack_range +directory: sshhole +mitre_technique: + - T1078.003 +datasets: + - name: syslog + path: /datasets/emerging_threats/sshhole/syslog.log + sourcetype: linux_messages_syslog + source: /var/log/messages + - name: audit + path: /datasets/emerging_threats/sshhole/audit.log + sourcetype: auditd + source: auditd diff --git a/datasets/emerging_threats/sshhole/syslog.log b/datasets/emerging_threats/sshhole/syslog.log new file mode 100644 index 00000000..8440197e --- /dev/null +++ b/datasets/emerging_threats/sshhole/syslog.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:61ed48173a6280af7ccf7217b7465d722477961cc456297a9ad9a480f375a0d3 +size 346