From 0899c22115f3c0d6eed40ab9f92bca28c15886f0 Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Thu, 12 Nov 2026 17:23:53 +0100 Subject: [PATCH] New Datasets Covering Recent Clickfix Campaigns --- .../windows_cmd_encoded_chars.log | 3 +++ .../windows_cmd_encoded_chars.yml | 13 +++++++++++++ .../windows_cmd_evasive_commands.log | 3 +++ .../windows_cmd_evasive_commands.yml | 13 +++++++++++++ .../windows_superscript_obfuscation.log | 3 +++ .../windows_superscript_obfuscation.yml | 13 +++++++++++++ .../windows_self_persistence.log | 3 +++ .../windows_self_persistence.yml | 13 +++++++++++++ 8 files changed, 64 insertions(+) create mode 100644 datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.log create mode 100644 datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.yml create mode 100644 datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.log create mode 100644 datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.yml create mode 100644 datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.log create mode 100644 datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.yml create mode 100644 datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.log create mode 100644 datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.yml diff --git a/datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.log b/datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.log new file mode 100644 index 00000000..82828306 --- /dev/null +++ b/datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:17ae9d8009975dc43634a7df79f68ab4efbd98bf4efe7f4e8757d7849fefb81a +size 2372 diff --git a/datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.yml b/datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.yml new file mode 100644 index 00000000..bc83984e --- /dev/null +++ b/datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: 2fc43c6e-bb86-473c-b670-e3af0744a830 +date: '2026-11-12' +description: Generated datasets covering the encoded char sequences using cmd.exe. +environment: attack_range +directory: windows_cmd_encoded_chars +mitre_technique: +- T1027.010 +datasets: +- name: windows_cmd_encoded_chars.log + path: /datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.log + sourcetype: XmlWinEventLog + source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' diff --git a/datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.log b/datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.log new file mode 100644 index 00000000..0b1d83a4 --- /dev/null +++ b/datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9ff49fbf3e7679198a433c889d10457382142085ba88b4c6783d110d7e094778 +size 14562 diff --git a/datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.yml b/datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.yml new file mode 100644 index 00000000..a0a53018 --- /dev/null +++ b/datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: d6fbe80b-2b8b-4047-a93e-c841e7463d1c +date: '2026-11-12' +description: Generated datasets covering the evasive commands using cmd.exe. +environment: attack_range +directory: windows_cmd_evasive_commands +mitre_technique: +- T1027.010 +datasets: +- name: windows_cmd_evasive_commands.log + path: /datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.log + sourcetype: XmlWinEventLog + source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' diff --git a/datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.log b/datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.log new file mode 100644 index 00000000..76c16f44 --- /dev/null +++ b/datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:95b6d15f92b8580571d2827dd782c57293416707e52f3f9a06388efb8734f946 +size 4210 diff --git a/datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.yml b/datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.yml new file mode 100644 index 00000000..f48a3e5c --- /dev/null +++ b/datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: d9ea883a-27cb-4db8-8e98-622f949763f4 +date: '2026-11-12' +description: Generated datasets covering the superscript obfuscation using Windows. +environment: attack_range +directory: windows_superscript_obfuscation +mitre_technique: +- T1027.010 +datasets: +- name: windows_superscript_obfuscation.log + path: /datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.log + sourcetype: XmlWinEventLog + source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' diff --git a/datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.log b/datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.log new file mode 100644 index 00000000..bc92efae --- /dev/null +++ b/datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f676658cdb74526aaa20e110c80032d403c78b5935ed5ef069b0c12eff80fe48 +size 1164 diff --git a/datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.yml b/datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.yml new file mode 100644 index 00000000..a1a81a86 --- /dev/null +++ b/datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.yml @@ -0,0 +1,13 @@ +author: Onur Mustafa Erdogan, Splunk +id: a8fe1960-d687-4436-b8ce-0eb778150570 +date: '2026-11-12' +description: Generated datasets covering the self-persistence using Windows registry. +environment: attack_range +directory: windows_self_persistence +mitre_technique: +- T1547.001 +datasets: +- name: windows_self_persistence.log + path: /datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.log + sourcetype: XmlWinEventLog + source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'