diff --git a/datasets/attack_techniques/T1005/cache_smuggling/cache_smuggling.yml b/datasets/attack_techniques/T1005/cache_smuggling/cache_smuggling.yml new file mode 100644 index 000000000..b17b9dc67 --- /dev/null +++ b/datasets/attack_techniques/T1005/cache_smuggling/cache_smuggling.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 0cb7b652-3c16-482f-a9f8-994a92fb9ed0 +date: '2026-11-02' +description: Windows Security 4663 records for a non-browser PowerShell process reading existing Firefox and Chrome cache files. +environment: lab +directory: cache_smuggling +mitre_technique: +- T1005 +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1005/cache_smuggling/windows-security.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1005/cache_smuggling/windows-security.log b/datasets/attack_techniques/T1005/cache_smuggling/windows-security.log new file mode 100644 index 000000000..366a45449 --- /dev/null +++ b/datasets/attack_techniques/T1005/cache_smuggling/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4847e63277e963b028ae8310c3e3c0d1e1dca45e79884b3fb085ea11b156c490 +size 2595 diff --git a/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/powershell_browser_cache_access.yml b/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/powershell_browser_cache_access.yml new file mode 100644 index 000000000..b92382ed5 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/powershell_browser_cache_access.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 9303f5b8-0c6c-40a5-9df2-414ec646b3f6 +date: '2026-11-02' +description: Captured Windows lab telemetry for PowerShell Script Block Logging that enumerates and reads Firefox and Chrome cache entries. +environment: attack_range +directory: powershell_browser_cache_access +mitre_technique: +- T1059.001 +datasets: +- name: windows-powershell + path: /datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log b/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log new file mode 100644 index 000000000..9600aeb1c --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5fb8370d5cf210037a875e170dbeb20980ee983c2b97a77016431351fc923a45 +size 8819