Security Datasets

Contributing datasets, from different platforms, to the InfoSec community to expedite data analysis and threat research!

[Security Datasets @SecDatasets]

🚨 Collecting and sharing logs from the ☁️

🙏 Thanks to project SimuLand 🏝️ (an @OTR_Community Initiative), we are starting to collect data from known community templates & emulation plans 😎

🌩️AWS Dateset: https://t.co/WDHftzUCz0

🏗️ SimuLand: https://t.co/w9zbaqkY8t

[Microsoft Threat Intelligence @MsftSecIntel]

Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: https://t.co/B0G6BxUeaM

[Open Threat Research @OTR_Community]

🚨 We decided to re-brand Mordor to @SecDatasets 😈 We’ll cover new types of datasets to extend its application 💜 more coming soon.. 🍻

Help us build the largest library of datasets for the InfoSec community! 🚀

Site: https://t.co/tpgVTJWNfL…
Repo: https://t.co/q5USTVMZCt

[Security Datasets @SecDatasets]

@cyb3rops @OTR_Community @sigma_hq 😉💜

[Security Datasets @SecDatasets]

We shared a dataset that contains the core behavior 🍻 You can add more context around it! (i.e. Service creation & execution) @OTR_Community

😈 Data: https://t.co/EUpini3Vkn

🛡️@sigma_hq rules:
1⃣ https://t.co/d85dp6R2ah
2⃣ https://t.co/AJscSIqqMR

How Do I use the data? ⏬

[John Lambert @JohnLaTwC]

#HuntingTipOfTheDay
Search for command lines 🔎with 'comsvcs.dll' and 'MiniDump' to find credential dumping. 👀

✏️Test your detections: https://t.co/dX9LPgDvuR

📎References:
▪️https://t.co/lBgmVUn2Ru by Jenna Magius and Nate Caroe (@RiskSense)
▪️https://t.co/OcrRw4xc41

[John Lambert @JohnLaTwC]

Importance of data sets for SecOps research and rule testing with projects by @SBousseaden, @Mordor_Project, @Cyb3rWard0g's SimuLand

[Open Threat Research @OTR_Community]

🚨 In less than 24h 😉, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone 🌎 expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike

🗒️Metadata: https://t.co/63RGi5RQ0u

😈Dataset: https://t.co/kRRl71Vrdc

[Microsoft Security @msftsecurity]

It's time to go to SimuLand! 🎠🎡🎢

But it isn't a new vacation theme park hot spot, it's a new open-source initiative that will help you deploy a lab environment to reproduce real attack scenarios to test your security defenses.

Get the details: https://t.co/IZwtdMLlT0

[Security Datasets @SecDatasets]

@Cyb3rPandaH @DebugPrivilege @OTR_Community

[Open Threat Research @OTR_Community]

Sharing @Mordor_Project datasets for "Getting AD FS Database Config Remotely" (Security, Sysmon & PCAP) @Cyb3rWard0g 🍻🙏

https://t.co/UQgGy59ha8

1⃣ A few tool-based comments at the host level
2⃣ Group hosts & processes connecting to AD FS server over port 80 (Usually 443)

[Security Datasets @SecDatasets]

@cyb3rops

[Security Datasets @SecDatasets]

@Cyb3rWard0g @Ch33r10 @NetworkDefense @chrissanders88 Happy to see you are using the @Mordor_Project ! The project comes with small (atomic) and large (campaigns) datasets.

One great example of how to use our large datasets is this post by @filar (APT3) https://t.co/xLtUBfPVE3

[Security Datasets @SecDatasets]

@OTR_Community @Cyb3rWard0g @sigma_hq @ProjectJupyter @jack_halon @Flangvik @mvelazco 😈 Endpoint dataset: built-in & Sysmon telemetry 🛡️

Doc: https://t.co/unUjd0EkK3

✅ Web shell created
✅ Unexpected compiled ASPX files created by w3wp in Temporary ASP[.]NET Files directory
✅ OabVirtualDirectory ExternalUrl set to <script>
✅ w3wp child process & more

[Security Datasets @SecDatasets]

Sharing some data samples (PCAP & WinEvents) to validate detection of lateral movement via remote scheduled task creation & update 🍻 @OTR_Community

1⃣ Creation: https://t.co/ljZQuar0FD

2⃣ Update: https://t.co/IQyNC327JH

@HunterPlaybook Library Doc: https://t.co/HxIlW98DCo

[John Lambert @JohnLaTwC]

https://t.co/7k2txhWjLK

[Security Datasets @SecDatasets]

Looking forward to it! 🍻 Let's talk about some of the steps taken before sharing a dataset with the community 💜

[Red Canary, a Zscaler company @redcanary]

THIS FRIDAY: Catch @Cyb3rWard0g in conversation with @mattifestation for the last #AtomicFriday of 2020! https://t.co/aBCAfUqDEr

[Red Canary, a Zscaler company @redcanary]

Big news ya'll: @Cyb3rWard0g will be hosting our next Atomic Friday on December 11! Join us for a deep dive into @Mordor_Project and learn strategies for expediting data analysis. https://t.co/9hedpYj9SZ

[Ashwin Patil @ashwinpatil]

Don`t Forget to checkout Project SimuLand for
☁️Cloud Datasets

https://t.co/iRl4ASDCjI

[Security Datasets @SecDatasets]

Looking for ways to validate detection rules for that specific behavior? A small sample of data and a few rules!

Thank you @rbmaslen @domchell @tifkin_ @OTR_Community

😈 Dataset: https://t.co/okyM2hqYQW

🏹 @sigma_hq:
1) https://t.co/aQyfn8ucNa

2) https://t.co/O55phnexfi

[Rob Maslen @rbmaslen]

SharpView, if you've run it on a machine have a look in %TEMP%\ba9ea7344a4a5f591d6e5dc32a13494b you might find a nasty surprise.....

[Johnny Shaw @jxy__s]

So cool to see this! 👍

[Security Datasets @SecDatasets]

If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s !

😈 https://t.co/vvCb7xG1qb

[Johnny Shaw @jxy__s]

I’m pleased to present this Windows exploit. Process Herpaderping is a method for evading detection - similar to process migration, hollowing, or doppelganging.

https://t.co/ZoUJkBtOsw