diff --git a/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log b/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log new file mode 100644 index 00000000..58d7b90a --- /dev/null +++ b/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:59e15788b109473544e4679c4a6e40f34365f5dbaa49ab1a2efd4253b28c6334 +size 2418 diff --git a/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/zeek_http_encoded_post.yml b/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/zeek_http_encoded_post.yml new file mode 100644 index 00000000..dfea6780 --- /dev/null +++ b/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/zeek_http_encoded_post.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 5902ed5d-4532-42fe-8dc7-cf2d364e6e55 +date: '2026-10-08' +description: Zeek HTTP logs containing POST requests with base64-encoded post bodies indicative of C2 beaconing activity. +environment: custom +directory: zeek_http_encoded_post +mitre_technique: +- T1071.001 +datasets: +- name: http + path: /datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log + sourcetype: zeek:http + source: http.log diff --git a/datasets/attack_techniques/T1071/zeek_http_unusual_method/http.log b/datasets/attack_techniques/T1071/zeek_http_unusual_method/http.log new file mode 100644 index 00000000..5b923c8d --- /dev/null +++ b/datasets/attack_techniques/T1071/zeek_http_unusual_method/http.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6dd64408aea9fb84abb49c903264c5bb98e461fab6595197a99091897399769d +size 940 diff --git a/datasets/attack_techniques/T1071/zeek_http_unusual_method/zeek_http_unusual_method.yml b/datasets/attack_techniques/T1071/zeek_http_unusual_method/zeek_http_unusual_method.yml new file mode 100644 index 00000000..181769df --- /dev/null +++ b/datasets/attack_techniques/T1071/zeek_http_unusual_method/zeek_http_unusual_method.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: c086ad2b-a747-4c61-9c90-d6ffdcaefbe8 +date: '2026-10-07' +description: Zeek HTTP logs containing non-standard HTTP methods that do not appear in common allowlists. +environment: custom +directory: zeek_http_unusual_method +mitre_technique: +- T1071 +datasets: +- name: http + path: /datasets/attack_techniques/T1071/zeek_http_unusual_method/http.log + sourcetype: zeek:http + source: http.log diff --git a/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log b/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log new file mode 100644 index 00000000..d8f34105 --- /dev/null +++ b/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f265f3c25fb7af77f4508d2f083531a0cc7c0265caef325e07cd9a452346cc56 +size 1547 diff --git a/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/zeek_ssh_unusual_client.yml b/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/zeek_ssh_unusual_client.yml new file mode 100644 index 00000000..e575e884 --- /dev/null +++ b/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/zeek_ssh_unusual_client.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: d1843345-5256-4242-bfab-2dfa60027573 +date: '2026-10-06' +description: Zeek SSH logs containing unusual client banners not present in common SSH client allowlists. +environment: custom +directory: zeek_ssh_unusual_client +mitre_technique: +- T1572 +datasets: +- name: ssh + path: /datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log + sourcetype: zeek:ssh + source: ssh.log