From 0cbfa31b8ea403a8e86af32e0946fadc6cfe2a19 Mon Sep 17 00:00:00 2001 From: nasbench Date: Mon, 27 Jul 2026 11:08:56 +0200 Subject: [PATCH] add reg appcertdlls abuse --- datasets/attack_techniques/T1546.009/snapattack/registry.log | 3 +++ .../attack_techniques/T1546.009/snapattack/snapattack.yml | 4 ++++ 2 files changed, 7 insertions(+) create mode 100644 datasets/attack_techniques/T1546.009/snapattack/registry.log diff --git a/datasets/attack_techniques/T1546.009/snapattack/registry.log b/datasets/attack_techniques/T1546.009/snapattack/registry.log new file mode 100644 index 000000000..e11c1741e --- /dev/null +++ b/datasets/attack_techniques/T1546.009/snapattack/registry.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c2a7035032f50f1bd172bcec991430ac84ba9cb1c3c87c82f99c81ef5762fed8 +size 1109 diff --git a/datasets/attack_techniques/T1546.009/snapattack/snapattack.yml b/datasets/attack_techniques/T1546.009/snapattack/snapattack.yml index 059fc0baa..ed6ad44e0 100644 --- a/datasets/attack_techniques/T1546.009/snapattack/snapattack.yml +++ b/datasets/attack_techniques/T1546.009/snapattack/snapattack.yml @@ -11,3 +11,7 @@ datasets: sourcetype: XmlWinEventLog source: XmlWinEventLog:Security path: /datasets/attack_techniques/T1546.009/snapattack/snaattack.log +- name: registry_entry + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + path: /datasets/attack_techniques/T1546.009/snapattack/registry.log