Merge pull request #1022 from splunk/notdoor

Add NotDoor logs

Author: RavenTait

datasets/malware/notdoor/disable_dialogs/disable_dialogs.yml

@@ -0,0 +1,11 @@
+author: Raven Tait, Splunk
+id: 1e606a99-47d9-4f89-8aab-a00bc7c38e63
+date: '2025-09-09'
+description: logs from NotDoor malware execution
+environment: attack_range
+directory: disable_dialogs
+datasets:
+- name: windows-sysmon
+  path: /datasets/malware/notdoor/disable_dialogs/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

datasets/malware/notdoor/disable_dialogs/windows-sysmon.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:cc9a6bb62770ced26341092729f79f256b5a1a16d85b3fea2dd5c992fc0d190f
+size 3633

datasets/malware/notdoor/loadmacroprovideronboot/loadmacroprovideronboot.yml

@@ -0,0 +1,11 @@
+author: Raven Tait, Splunk
+id: f67a778d-f7a5-4352-941b-daf2a5919167
+date: '2025-09-09'
+description: logs from NotDoor malware execution
+environment: attack_range
+directory: loadmacroprovideronboot
+datasets:
+- name: windows-sysmon
+  path: /datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1b47a4814f43b986d8f53e525f1adfb759cb8b67e80df57a691bd6f3ae60b678
+size 1417

datasets/malware/notdoor/macro_security_level/macro_security_level.yml

@@ -0,0 +1,11 @@
+author: Raven Tait, Splunk
+id: 0cd14ec6-4fcb-437c-aeee-0f04007c55fa
+date: '2025-09-09'
+description: logs from NotDoor malware execution
+environment: attack_range
+directory: macro_security_level
+datasets:
+- name: windows-sysmon
+  path: /datasets/malware/notdoor/macro_security_level/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

datasets/malware/notdoor/macro_security_level/windows-sysmon.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:77cf15b3359975a879ce8e890884d36728907abbbdc2f0be9b48e747ce1a1fd4
+size 1408

datasets/malware/notdoor/outlook_macro/outlook_macro.yml

@@ -0,0 +1,11 @@
+author: Raven Tait, Splunk
+id: 62f29b0e-692f-4dca-a17a-98809d1a40fe
+date: '2025-09-09'
+description: logs from NotDoor malware execution
+environment: attack_range
+directory: outlook_macro
+datasets:
+- name: windows-sysmon
+  path: /datasets/malware/notdoor/outlook_macro/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

datasets/malware/notdoor/outlook_macro/windows-sysmon.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b77d784369294d71581012bc729013271ca23ad5a39f7509676ba9bd12e75094
+size 1376