Merge pull request #1172 from splunk/threat_allow

tccontre · web-flow · commit 4bb043989c53 · 2026-05-19T13:39:38.000+02:00
threat_allow
diff --git a/datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_salat.log b/datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_salat.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c59e0199afa92b0713de08136b927e800ae59db2edccab3ddc0e5dc3ef2a1543
+size 5046
diff --git a/datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_switch.yml b/datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_switch.yml
@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 0014d076-5377-11f1-8a8b-629be3538068
+date: '2026-05-19'
+description: Generated datasets for threat allow switch in attack range.
+environment: attack_range
+directory: threat_allow_switch
+mitre_technique:
+- T1059.001
+datasets:
+- name: threat_allow_salat.log
+  path: /datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_salat.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:c59e0199afa92b0713de08136b927e800ae59db2edccab3ddc0e5dc3ef2a1543`
	`3`	`+size 5046`