From 686a1b347d51eeb32a986d0d3b165380692e104d Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Mon, 2 Nov 2026 14:12:24 -0500 Subject: [PATCH 1/2] Clickfix cache smuggling logs --- .../powershell_browser_cache_access.yml | 13 +++++++++++++ .../windows-powershell.log | 3 +++ 2 files changed, 16 insertions(+) create mode 100644 datasets/attack_techniques/T1059.001/powershell_browser_cache_access/powershell_browser_cache_access.yml create mode 100644 datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log diff --git a/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/powershell_browser_cache_access.yml b/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/powershell_browser_cache_access.yml new file mode 100644 index 00000000..b92382ed --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/powershell_browser_cache_access.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 9303f5b8-0c6c-40a5-9df2-414ec646b3f6 +date: '2026-11-02' +description: Captured Windows lab telemetry for PowerShell Script Block Logging that enumerates and reads Firefox and Chrome cache entries. +environment: attack_range +directory: powershell_browser_cache_access +mitre_technique: +- T1059.001 +datasets: +- name: windows-powershell + path: /datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log b/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log new file mode 100644 index 00000000..9600aeb1 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5fb8370d5cf210037a875e170dbeb20980ee983c2b97a77016431351fc923a45 +size 8819 From 75768ec88f6aa1c6ab13c0cfbe0aaa273d0b9e50 Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Tue, 3 Nov 2026 10:47:16 -0500 Subject: [PATCH 2/2] Add access event logs --- .../T1005/cache_smuggling/cache_smuggling.yml | 13 +++++++++++++ .../T1005/cache_smuggling/windows-security.log | 3 +++ 2 files changed, 16 insertions(+) create mode 100644 datasets/attack_techniques/T1005/cache_smuggling/cache_smuggling.yml create mode 100644 datasets/attack_techniques/T1005/cache_smuggling/windows-security.log diff --git a/datasets/attack_techniques/T1005/cache_smuggling/cache_smuggling.yml b/datasets/attack_techniques/T1005/cache_smuggling/cache_smuggling.yml new file mode 100644 index 00000000..b17b9dc6 --- /dev/null +++ b/datasets/attack_techniques/T1005/cache_smuggling/cache_smuggling.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: 0cb7b652-3c16-482f-a9f8-994a92fb9ed0 +date: '2026-11-02' +description: Windows Security 4663 records for a non-browser PowerShell process reading existing Firefox and Chrome cache files. +environment: lab +directory: cache_smuggling +mitre_technique: +- T1005 +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1005/cache_smuggling/windows-security.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1005/cache_smuggling/windows-security.log b/datasets/attack_techniques/T1005/cache_smuggling/windows-security.log new file mode 100644 index 00000000..366a4544 --- /dev/null +++ b/datasets/attack_techniques/T1005/cache_smuggling/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4847e63277e963b028ae8310c3e3c0d1e1dca45e79884b3fb085ea11b156c490 +size 2595