splunk · RavenTait · Sep 9, 2025 · Sep 9, 2025
diff --git a/datasets/malware/notdoor/disable_dialogs/disable_dialogs.yml b/datasets/malware/notdoor/disable_dialogs/disable_dialogs.yml
@@ -0,0 +1,11 @@
+author: Raven Tait, Splunk
+id: 1e606a99-47d9-4f89-8aab-a00bc7c38e63
+date: '2025-09-09'
+description: logs from NotDoor malware execution
+environment: attack_range
+directory: disable_dialogs
+datasets:
+- name: windows-sysmon
+  path: /datasets/malware/notdoor/disable_dialogs/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/datasets/malware/notdoor/disable_dialogs/windows-sysmon.log b/datasets/malware/notdoor/disable_dialogs/windows-sysmon.log
diff --git a/datasets/malware/notdoor/loadmacroprovideronboot/loadmacroprovideronboot.yml b/datasets/malware/notdoor/loadmacroprovideronboot/loadmacroprovideronboot.yml
@@ -0,0 +1,11 @@
+author: Raven Tait, Splunk
+id: f67a778d-f7a5-4352-941b-daf2a5919167
+date: '2025-09-09'
+description: logs from NotDoor malware execution
+environment: attack_range
+directory: loadmacroprovideronboot
+datasets:
+- name: windows-sysmon
+  path: /datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon.log b/datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon.log
diff --git a/datasets/malware/notdoor/macro_security_level/macro_security_level.yml b/datasets/malware/notdoor/macro_security_level/macro_security_level.yml
@@ -0,0 +1,11 @@
+author: Raven Tait, Splunk
+id: 0cd14ec6-4fcb-437c-aeee-0f04007c55fa
+date: '2025-09-09'
+description: logs from NotDoor malware execution
+environment: attack_range
+directory: macro_security_level
+datasets:
+- name: windows-sysmon
+  path: /datasets/malware/notdoor/macro_security_level/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/datasets/malware/notdoor/macro_security_level/windows-sysmon.log b/datasets/malware/notdoor/macro_security_level/windows-sysmon.log
diff --git a/datasets/malware/notdoor/outlook_macro/outlook_macro.yml b/datasets/malware/notdoor/outlook_macro/outlook_macro.yml
@@ -0,0 +1,11 @@
+author: Raven Tait, Splunk
+id: 62f29b0e-692f-4dca-a17a-98809d1a40fe
+date: '2025-09-09'
+description: logs from NotDoor malware execution
+environment: attack_range
+directory: outlook_macro
+datasets:
+- name: windows-sysmon
+  path: /datasets/malware/notdoor/outlook_macro/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/datasets/malware/notdoor/outlook_macro/windows-sysmon.log b/datasets/malware/notdoor/outlook_macro/windows-sysmon.log