RavenTait · Nov 3, 2026 · Nov 2, 2026 · Nov 3, 2026
diff --git a/datasets/attack_techniques/T1005/cache_smuggling/cache_smuggling.yml b/datasets/attack_techniques/T1005/cache_smuggling/cache_smuggling.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 0cb7b652-3c16-482f-a9f8-994a92fb9ed0
+date: '2026-11-02'
+description: Windows Security 4663 records for a non-browser PowerShell process reading existing Firefox and Chrome cache files.
+environment: lab
+directory: cache_smuggling
+mitre_technique:
+- T1005
+datasets:
+- name: windows-security
+  path: /datasets/attack_techniques/T1005/cache_smuggling/windows-security.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Security
diff --git a/datasets/attack_techniques/T1005/cache_smuggling/windows-security.log b/datasets/attack_techniques/T1005/cache_smuggling/windows-security.log
diff --git a/..._techniques/T1059.001/powershell_browser_cache_access/powershell_browser_cache_access.yml b/..._techniques/T1059.001/powershell_browser_cache_access/powershell_browser_cache_access.yml
@@ -0,0 +1,13 @@
+author: Raven Tait, Splunk
+id: 9303f5b8-0c6c-40a5-9df2-414ec646b3f6
+date: '2026-11-02'
+description: Captured Windows lab telemetry for PowerShell Script Block Logging that enumerates and reads Firefox and Chrome cache entries.
+environment: attack_range
+directory: powershell_browser_cache_access
+mitre_technique:
+- T1059.001
+datasets:
+- name: windows-powershell
+  path: /datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
diff --git a/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log b/datasets/attack_techniques/T1059.001/powershell_browser_cache_access/windows-powershell.log