From 15345c9726569c64e552a3b01f166c821e446124 Mon Sep 17 00:00:00 2001 From: merquiag Date: Tue, 27 Oct 2026 16:17:03 +0100 Subject: [PATCH] Add WinRM spawned process attack data --- .../winrm_spawned_processes.yml | 20 +++++++++++++++++++ .../winrm_spawned_processes_security.log | 3 +++ .../winrm_spawned_processes_sysmon.log | 3 +++ 3 files changed, 26 insertions(+) create mode 100644 datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes.yml create mode 100644 datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_security.log create mode 100644 datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_sysmon.log diff --git a/datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes.yml b/datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes.yml new file mode 100644 index 000000000..097b1b722 --- /dev/null +++ b/datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes.yml @@ -0,0 +1,20 @@ +author: Maria Jose Erquiaga, Splunk +id: ad6524c3-1b06-417f-b9c2-0156ec870667 +date: '2026-10-27' +description: >- + Process-creation telemetry from authorized Attack Range WinRM tests. + Includes winrshost.exe and wsmprovhost.exe spawning selected processes. + Security and Sysmon records may describe the same process launches. +environment: attack_range +directory: winrm_spawned_processes +mitre_technique: + - T1021.006 +datasets: + - name: winrm_spawned_processes_security + path: /datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_security.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security + - name: winrm_spawned_processes_sysmon + path: /datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_security.log b/datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_security.log new file mode 100644 index 000000000..4fc6711e6 --- /dev/null +++ b/datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_security.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d0b9388261ffc18693304b8b24f3a6f35e341a3825807776c428ca5d0d0bf355 +size 3841 diff --git a/datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_sysmon.log b/datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_sysmon.log new file mode 100644 index 000000000..44425af65 --- /dev/null +++ b/datasets/attack_techniques/T1021.006/winrm_spawned_processes/winrm_spawned_processes_sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:1bf58c58377b2a1febf12fd552b660faa989f5d08b3881c69f2cd83564e47d51 +size 5995