From d9f47272cd8756e38a8951eda06f1fdec0d218cd Mon Sep 17 00:00:00 2001
From: vahid malekmohammadi <46035912+vahidmalekk@users.noreply.github.com>
Date: Sat, 31 Oct 2026 13:11:35 +0330
Subject: [PATCH] Add linux auditd eBPF program load dataset (T1556.003)

Real auditd SYSCALL (syscall=bpf, a0=BPF_PROG_LOAD), PROCTITLE and native
BPF (op=LOAD) records captured from pamspy loading an eBPF program and
attaching a uprobe to pam_get_authtok in libpam. Supports the Linux Auditd
eBPF Program Load detection.
---
 .../linux_auditd_ebpf/linux_auditd_ebpf.log         |  3 +++
 .../linux_auditd_ebpf/linux_auditd_ebpf.yml         | 13 +++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 datasets/attack_techniques/T1556.003/linux_auditd_ebpf/linux_auditd_ebpf.log
 create mode 100644 datasets/attack_techniques/T1556.003/linux_auditd_ebpf/linux_auditd_ebpf.yml

diff --git a/datasets/attack_techniques/T1556.003/linux_auditd_ebpf/linux_auditd_ebpf.log b/datasets/attack_techniques/T1556.003/linux_auditd_ebpf/linux_auditd_ebpf.log
new file mode 100644
index 00000000..b854fc01
--- /dev/null
+++ b/datasets/attack_techniques/T1556.003/linux_auditd_ebpf/linux_auditd_ebpf.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:139e2933ee638a3162b4217080bff6a3bcc4ce5b85c6dcc9c7025b5e8ffbfb7d
+size 7365
diff --git a/datasets/attack_techniques/T1556.003/linux_auditd_ebpf/linux_auditd_ebpf.yml b/datasets/attack_techniques/T1556.003/linux_auditd_ebpf/linux_auditd_ebpf.yml
new file mode 100644
index 00000000..dfa0b334
--- /dev/null
+++ b/datasets/attack_techniques/T1556.003/linux_auditd_ebpf/linux_auditd_ebpf.yml
@@ -0,0 +1,13 @@
+author: vahid malekmohammadi
+id: b48789c4-6557-4c1b-a8a2-0bd4f03b353e
+date: '2026-10-31'
+description: Generated dataset for Linux auditd eBPF program load. Captured from a host where pamspy loads an eBPF program and attaches a uprobe to pam_get_authtok in libpam to steal credentials during PAM authentication. Contains SYSCALL (syscall=bpf, a0=BPF_PROG_LOAD), PROCTITLE and native BPF (op=LOAD) records. Supports the Linux Auditd eBPF Program Load detection.
+environment: attack_range
+directory: linux_auditd_ebpf
+mitre_technique:
+- T1556.003
+datasets:
+- name: linux_auditd_ebpf
+  path: /datasets/attack_techniques/T1556.003/linux_auditd_ebpf/linux_auditd_ebpf.log
+  sourcetype: auditd
+  source: auditd