From ffa351ba9a99d5a44146530065927887d4cb2ee7 Mon Sep 17 00:00:00 2001
From: vahidmalekk <46035912+vahidmalekk@users.noreply.github.com>
Date: Sat, 31 Oct 2026 15:10:04 +0330
Subject: [PATCH] Add Linux auditd enumeration dataset (T1082)

EXECVE auditd dataset captured from a real LinEnum run on an authorized
lab host, for the Linux Auditd Enumeration Script Activity detection in
security_content. ~95 execve events in one window crossing the analytic
thresholds (exec>=50, distinct>=15, distinct recon tools>=8).
---
 .../linux_auditd_enumeration/linux_auditd_enumeration.log      | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 datasets/attack_techniques/T1082/linux_auditd_enumeration/linux_auditd_enumeration.log

diff --git a/datasets/attack_techniques/T1082/linux_auditd_enumeration/linux_auditd_enumeration.log b/datasets/attack_techniques/T1082/linux_auditd_enumeration/linux_auditd_enumeration.log
new file mode 100644
index 00000000..27c1e4e6
--- /dev/null
+++ b/datasets/attack_techniques/T1082/linux_auditd_enumeration/linux_auditd_enumeration.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:cec290c561d3d9727ad9a9f817f2dc2088694a1298048011f3042a7bab37ac8e
+size 9155