RavenTait · Nov 10, 2026 · Nov 10, 2026
diff --git a/datasets/emerging_threats/sshhole/audit.log b/datasets/emerging_threats/sshhole/audit.log
diff --git a/datasets/emerging_threats/sshhole/sshhole.yml b/datasets/emerging_threats/sshhole/sshhole.yml
@@ -0,0 +1,17 @@
+author: Raven Tait, Splunk
+id: 3a478d9e-9c1f-4cde-a32f-c6a991b621e4
+date: '2026-11-09'
+description: Linux syslog and auditd datasets for sshhole SSH authentication bypass.
+environment: attack_range
+directory: sshhole
+mitre_technique:
+    - T1078.003
+datasets:
+    - name: syslog
+      path: /datasets/emerging_threats/sshhole/syslog.log
+      sourcetype: linux_messages_syslog
+      source: /var/log/messages
+    - name: audit
+      path: /datasets/emerging_threats/sshhole/audit.log
+      sourcetype: auditd
+      source: auditd
diff --git a/datasets/emerging_threats/sshhole/syslog.log b/datasets/emerging_threats/sshhole/syslog.log