😉💜

We shared a dataset that contains the core behavior 🍻 You can add more context around it! (i.e. Service creation & execution) @OTR_Community 😈 Data: mordordatasets.com/notebooks… 🛡️@sigma_hq rules: 1⃣ github.com/SigmaHQ/sigma/blo… 2⃣ github.com/SigmaHQ/sigma/blo… How Do I use the data? ⏬

@Cyb3rPandaH @DebugPrivilege @OTR_Community

😈 Endpoint dataset: built-in & Sysmon telemetry 🛡️ Doc: mordordatasets.com/notebooks… ✅ Web shell created ✅ Unexpected compiled ASPX files created by w3wp in Temporary ASP[.]NET Files directory ✅ OabVirtualDirectory ExternalUrl set to <script> ✅ w3wp child process & more

Looking for ways to validate detection rules for that specific behavior? A small sample of data and a few rules! Thank you @rbmaslen @domchell @tifkin_ @OTR_Community 😈 Dataset: mordordatasets.com/notebooks… 🏹 @sigma_hq: 1) github.com/OTRF/sigma/blob/m… 2) github.com/OTRF/sigma/blob/m…

If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s ! 😈 mordordatasets.com/notebooks…

😈 Adding more Windows datasets after using @redcanary Atomic Red Team and @mvelazco PurpleSharp 💜 Thank you all for everything you share with the Infosec Community 🌎 Courtesy of the @OTR_Community ! Commit: github.com/OTRF/mordor/commi…

🚨 Datasets are ready 💥 Host (Win Events) & Network (PCAPs) 🌎 @HunterPlaybook is putting together a #jupyter notebook soon. INNER JOINs! 😎 @OTR_Community TY @domchell @MDSecLabs 🙏 1⃣ ExecuteExcel4Macro: mordordatasets.com/notebooks… 2⃣ RegisterXLL: mordordatasets.com/notebooks…

WE HAVE PCAPs 😈 a) @Suricata_IDS ➕ ET Rules! b) git clone github.com/hunters-forge/mor… && cd mordor/datasets/large c) find apt29/day*/pcaps -name '*.zip' -execdir unzip -P infected {} \; c) find apt29/day*/pcaps -name '*cap' -execdir suricata -r {} -k none \; TY @jason_trost 🙏