Adding Dataset for Multiple Detections targeting ClickFix Campaigns

datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: 0d4fde14-e346-4159-b596-0a99e65c4daa
+date: '2026-09-16'
+description: Dataset generated in attack range for the attack technique of executing commands in a for loop using cmd.exe.
+environment: attack_range
+directory: cmd_for_loop
+mitre_technique:
+- T1059.003
+datasets:
+- name: cmd_for_loop
+  path: /datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: c7976c6a-dca8-4cb1-aab2-1b5ae9b23c4c
+date: '2026-09-16'
+description: Dataset generated in attack range for the attack technique of executing JavaScript scripts using Node.js.
+environment: attack_range
+directory: node_execute_js_script
+mitre_technique:
+- T1059.007
+datasets:
+- name: node_execute_js_script
+  path: /datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: e8114076-32b2-49c0-8874-9ee2bbb8ff3f
+date: '2026-09-16'
+description: Dataset generated in attack range for the attack technique of communicating with a remote host using the finger protocol.
+environment: attack_range
+directory: finger_remote_host
+mitre_technique:
+- T1071
+datasets:
+- name: finger_remote_host
+  path: /datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.yml

@@ -0,0 +1,13 @@
+author: Onur Mustafa Erdogan, Splunk
+id: ad1bad42-77f0-41e6-a3f5-7c9508638440
+date: '2026-09-16'
+description: Dataset generated in attack range for the attack technique of accessing IronLanguages repository.
+environment: attack_range
+directory: ironlanguage_download
+mitre_technique:
+- T1105
+datasets:
+- name: ironlanguage_download
+  path: /datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational