From f2de9bd482173a0cc5532bb1866088356f8b8804 Mon Sep 17 00:00:00 2001
From: P4T12ICK <patrickbareiss1989@gmail.com>
Date: Fri, 24 Oct 2025 15:34:49 +0200
Subject: [PATCH 1/2] Add YAML metadata for T1003

---
 .../attack_techniques/T1003/test5/test5.yml         | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 attack_data/datasets/attack_techniques/T1003/test5/test5.yml

diff --git a/attack_data/datasets/attack_techniques/T1003/test5/test5.yml b/attack_data/datasets/attack_techniques/T1003/test5/test5.yml
new file mode 100644
index 00000000..d0a7fc6f
--- /dev/null
+++ b/attack_data/datasets/attack_techniques/T1003/test5/test5.yml
@@ -0,0 +1,13 @@
+author: PB
+id: 5d94372f-9eaa-49c3-a83a-ad479fbc7ddc
+date: '2025-10-24'
+description: Attack data for technique T1003
+environment: attack_range
+directory: test5
+mitre_technique:
+- T1003
+datasets:
+- name: sysmon
+  path: attack_data/datasets/attack_techniques/T1003/test5/sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

From 920aa0673b887e11fc81e8388958a53ce87a7e96 Mon Sep 17 00:00:00 2001
From: P4T12ICK <patrickbareiss1989@gmail.com>
Date: Fri, 24 Oct 2025 15:34:50 +0200
Subject: [PATCH 2/2] Add attack data for T1003

---
 .../datasets/attack_techniques/T1003/test5/sysmon.log  | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 attack_data/datasets/attack_techniques/T1003/test5/sysmon.log

diff --git a/attack_data/datasets/attack_techniques/T1003/test5/sysmon.log b/attack_data/datasets/attack_techniques/T1003/test5/sysmon.log
new file mode 100644
index 00000000..5313f41f
--- /dev/null
+++ b/attack_data/datasets/attack_techniques/T1003/test5/sysmon.log
@@ -0,0 +1,10 @@
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:51.847254300Z'/><EventRecordID>83332</EventRecordID><Correlation/><Execution ProcessID='2480' ThreadID='3748'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>ar-win-1</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2025-10-24 13:33:51.845</Data><Data Name='ProcessGuid'>{2d9b1c52-803f-68fb-241c-010000006903}</Data><Data Name='ProcessId'>2360</Data><Data Name='Image'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe</Data><Data Name='FileVersion'>9.3.0</Data><Data Name='Description'>Network monitor</Data><Data Name='Product'>Splunk Application</Data><Data Name='Company'>Splunk Inc.</Data><Data Name='OriginalFileName'>splunk-netmon.exe</Data><Data Name='CommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{2d9b1c52-0eab-68f1-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>MD5=E30CB50BE9EC2FB49497F136DC71448F,SHA256=7835B39374396001E12637509AE0D22FCB7E2A89F6143DED03186B500276E537,IMPHASH=D30C8E545B1C24DE4E0DC100EF70F2D0</Data><Data Name='ParentProcessGuid'>{2d9b1c52-0eb0-68f1-3b00-000000006903}</Data><Data Name='ParentProcessId'>2452</Data><Data Name='ParentImage'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='ParentCommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:51.845594200Z'/><EventRecordID>246063</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='3980'/><Channel>Security</Channel><Computer>ar-win-1</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>AR-WIN-1$</Data><Data Name='SubjectDomainName'>WORKGROUP</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='NewProcessId'>0x938</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x994</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>NULL SID</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>Mandatory Label\System Mandatory Level</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:50.784095900Z'/><EventRecordID>246062</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='1096'/><Channel>Security</Channel><Computer>ar-win-1</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>AR-WIN-1$</Data><Data Name='SubjectDomainName'>WORKGROUP</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='NewProcessId'>0xf34</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x994</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>NULL SID</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>Mandatory Label\System Mandatory Level</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>22</EventID><Version>5</Version><Level>4</Level><Task>22</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:50.879891100Z'/><EventRecordID>83331</EventRecordID><Correlation/><Execution ProcessID='2480' ThreadID='3776'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>ar-win-1</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2025-10-24 13:33:45.204</Data><Data Name='ProcessGuid'>{2d9b1c52-803c-68fb-201c-010000006903}</Data><Data Name='ProcessId'>2040</Data><Data Name='QueryName'>_ldap._tcp.dc._msdcs.WORKGROUP</Data><Data Name='QueryStatus'>9003</Data><Data Name='QueryResults'>-</Data><Data Name='Image'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:50.785727000Z'/><EventRecordID>83330</EventRecordID><Correlation/><Execution ProcessID='2480' ThreadID='3748'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>ar-win-1</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2025-10-24 13:33:50.783</Data><Data Name='ProcessGuid'>{2d9b1c52-803e-68fb-231c-010000006903}</Data><Data Name='ProcessId'>3892</Data><Data Name='Image'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe</Data><Data Name='FileVersion'>9.3.0</Data><Data Name='Description'>Registry monitor</Data><Data Name='Product'>splunk Application</Data><Data Name='Company'>Splunk Inc.</Data><Data Name='OriginalFileName'>splunk-regmon.exe</Data><Data Name='CommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{2d9b1c52-0eab-68f1-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>MD5=F1B469DA7803AFE04870B4871CC0F695,SHA256=8198111A755A6918B5559B548574061A41EF5AACAE706DD154936CFEC6E6432E,IMPHASH=AEB21630574EF01A3A5116CB58C5AC56</Data><Data Name='ParentProcessGuid'>{2d9b1c52-0eb0-68f1-3b00-000000006903}</Data><Data Name='ParentProcessId'>2452</Data><Data Name='ParentImage'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='ParentCommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:50.142516100Z'/><EventRecordID>246061</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='1096'/><Channel>Security</Channel><Computer>ar-win-1</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>AR-WIN-1$</Data><Data Name='SubjectDomainName'>WORKGROUP</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='NewProcessId'>0x112c</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x994</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>NULL SID</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>Mandatory Label\System Mandatory Level</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:50.143850600Z'/><EventRecordID>83329</EventRecordID><Correlation/><Execution ProcessID='2480' ThreadID='3748'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>ar-win-1</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2025-10-24 13:33:50.142</Data><Data Name='ProcessGuid'>{2d9b1c52-803e-68fb-221c-010000006903}</Data><Data Name='ProcessId'>4396</Data><Data Name='Image'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe</Data><Data Name='FileVersion'>-</Data><Data Name='Description'>-</Data><Data Name='Product'>-</Data><Data Name='Company'>-</Data><Data Name='OriginalFileName'>-</Data><Data Name='CommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{2d9b1c52-0eab-68f1-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>MD5=FCB0604926A81A7A7746B7066B286DC8,SHA256=211CC17F7C47B5CCF2B980A2091D392C73C9ABADDB1061CE419C5357DD5545C2,IMPHASH=44A0061B15025B4FBD3C0D7BCF7E24E9</Data><Data Name='ParentProcessGuid'>{2d9b1c52-0eb0-68f1-3b00-000000006903}</Data><Data Name='ParentProcessId'>2452</Data><Data Name='ParentImage'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='ParentCommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:49.400449900Z'/><EventRecordID>246060</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='4484'/><Channel>Security</Channel><Computer>ar-win-1</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>AR-WIN-1$</Data><Data Name='SubjectDomainName'>WORKGROUP</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='NewProcessId'>0x8b0</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x994</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>NULL SID</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>Mandatory Label\System Mandatory Level</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:49.402872600Z'/><EventRecordID>83328</EventRecordID><Correlation/><Execution ProcessID='2480' ThreadID='3748'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>ar-win-1</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2025-10-24 13:33:49.400</Data><Data Name='ProcessGuid'>{2d9b1c52-803d-68fb-211c-010000006903}</Data><Data Name='ProcessId'>2224</Data><Data Name='Image'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe</Data><Data Name='FileVersion'>10.0.10011.16384</Data><Data Name='Description'>SplunkMonNoHandle Control Program</Data><Data Name='Product'>Windows (R) Win 7 DDK driver</Data><Data Name='Company'>Windows (R) Win 7 DDK provider</Data><Data Name='OriginalFileName'>SplunkMonNoHandle.exe</Data><Data Name='CommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{2d9b1c52-0eab-68f1-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>MD5=509F459BAA92E3C3D2B8AF2ABEE90640,SHA256=12576AFDC3B84FA47162F3FE31DC926B5B1F82EC1B4A4721A656274275CB7B20,IMPHASH=AA49C0FBBD591DE7932A03B49B088142</Data><Data Name='ParentProcessGuid'>{2d9b1c52-0eb0-68f1-3b00-000000006903}</Data><Data Name='ParentProcessId'>2452</Data><Data Name='ParentImage'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='ParentCommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2025-10-24T13:33:48.651574100Z'/><EventRecordID>83327</EventRecordID><Correlation/><Execution ProcessID='2480' ThreadID='3748'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>ar-win-1</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2025-10-24 13:33:48.650</Data><Data Name='ProcessGuid'>{2d9b1c52-803c-68fb-201c-010000006903}</Data><Data Name='ProcessId'>2040</Data><Data Name='Image'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe</Data><Data Name='FileVersion'>9.3.0</Data><Data Name='Description'>Active Directory monitor</Data><Data Name='Product'>splunk Application</Data><Data Name='Company'>Splunk Inc.</Data><Data Name='OriginalFileName'>splunk-admon.exe</Data><Data Name='CommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{2d9b1c52-0eab-68f1-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>MD5=DBFD61F6BB7B564B6D2E8C43BDCFA36B,SHA256=CE85AA468CE40D8463CE0B8E5320637BD87C9A0702F8B0BD35A40F93D146E80B,IMPHASH=623F6CD6D62EAC500E2DDE74F881F752</Data><Data Name='ParentProcessGuid'>{2d9b1c52-0eb0-68f1-3b00-000000006903}</Data><Data Name='ParentProcessId'>2452</Data><Data Name='ParentImage'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='ParentCommandLine'>"C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe" service</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>