New Datasets Covering Recent Clickfix Campaigns

datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: 2fc43c6e-bb86-473c-b670-e3af0744a830
+date: '2026-11-12'
+description: Generated datasets covering the encoded char sequences using cmd.exe.
+environment: attack_range
+directory: windows_cmd_encoded_chars
+mitre_technique:
+- T1027.010
+datasets:
+- name: windows_cmd_encoded_chars.log
+  path: /datasets/attack_techniques/T1027.010/windows_cmd_encoded_chars/windows_cmd_encoded_chars.log
+  sourcetype: XmlWinEventLog
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: d6fbe80b-2b8b-4047-a93e-c841e7463d1c
+date: '2026-11-12'
+description: Generated datasets covering the evasive commands using cmd.exe.
+environment: attack_range
+directory: windows_cmd_evasive_commands
+mitre_technique:
+- T1027.010
+datasets:
+- name: windows_cmd_evasive_commands.log
+  path: /datasets/attack_techniques/T1027.010/windows_cmd_evasive_commands/windows_cmd_evasive_commands.log
+  sourcetype: XmlWinEventLog
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: d9ea883a-27cb-4db8-8e98-622f949763f4
+date: '2026-11-12'
+description: Generated datasets covering the superscript obfuscation using Windows.
+environment: attack_range
+directory: windows_superscript_obfuscation
+mitre_technique:
+- T1027.010
+datasets:
+- name: windows_superscript_obfuscation.log
+  path: /datasets/attack_techniques/T1027.010/windows_superscript_obfuscation/windows_superscript_obfuscation.log
+  sourcetype: XmlWinEventLog
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: a8fe1960-d687-4436-b8ce-0eb778150570
+date: '2026-11-12'
+description: Generated datasets covering the self-persistence using Windows registry.
+environment: attack_range
+directory: windows_self_persistence
+mitre_technique:
+- T1547.001
+datasets:
+- name: windows_self_persistence.log
+  path: /datasets/attack_techniques/T1547.001/windows_self_persistence/windows_self_persistence.log
+  sourcetype: XmlWinEventLog
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'