lamehug

datasets/malware/T1007/net_start/net_start.yml → datasets/malware/lamehug/T1007/net_start/net_start.yml

@@ -8,6 +8,6 @@ mitre_technique:
 - T1007
 datasets:
 - name: net_start.log
-  path: /datasets/malware/T1007/net_start/net_start.log
+  path: /datasets/malware/lamehug/T1007/net_start/net_start.log
   sourcetype: 'XmlWinEventLog'
   source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/malware/T1071.004/hugging_face/hugging_face.yml → datasets/malware/lamehug/T1071.004/hugging_face/hugging_face.yml

@@ -8,6 +8,6 @@ mitre_technique:
 - T1071.004
 datasets:
 - name: huggingface.log
-  path: /datasets/malware/T1071.004/hugging_face/huggingface.log
+  path: /datasets/malware/lamehug/T1071.004/hugging_face/huggingface.log
   sourcetype: 'XmlWinEventLog'
   source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/malware/T1082/wmic_cmd/wmic_cmd.yml → datasets/malware/lamehug/T1082/wmic_cmd/wmic_cmd.yml

@@ -8,6 +8,6 @@ mitre_technique:
 - T1082
 datasets:
 - name: wmic_cmd.log
-  path: /datasets/malware/T1082/wmic_cmd/wmic_cmd.log
+  path: /datasets/malware/lamehug/T1082/wmic_cmd/wmic_cmd.log
   sourcetype: 'XmlWinEventLog'
   source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/malware/lamehug/T1119/doc_collection/doc_collection.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 4db3d658-826f-11f0-b7e4-629be3538068
+date: '2025-08-26'
+description: Generated datasets for doc collection in attack range.
+environment: attack_range
+directory: doc_collection
+mitre_technique:
+- T1119
+datasets:
+- name: xcopy_event.log
+  path: /datasets/malware/lamehug/T1119/doc_collection/xcopy_event.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'