From c4e854da9865d8eb3037d33b5fc350efc4ac5160 Mon Sep 17 00:00:00 2001 From: oerdogan Date: Mon, 17 Aug 2026 14:11:12 +0200 Subject: [PATCH 1/3] Attack Data for ShieldBreak Detections --- .../shieldbreak/ads_over_local_share.log | 1 + .../shieldbreak/defender_kernel_object.log | 2 + .../shieldbreak/mpclient_dll_loaded.log | 1 + .../shieldbreak/phoneinfo_dll_created.log | 1 + .../shieldbreak/shieldbreak.yml | 39 +++++++++++++++++++ .../shieldbreak/system_integrity_process.log | 1 + .../shieldbreak/wer_file_creation.log | 1 + 7 files changed, 46 insertions(+) create mode 100644 datasets/emerging_threats/shieldbreak/ads_over_local_share.log create mode 100644 datasets/emerging_threats/shieldbreak/defender_kernel_object.log create mode 100644 datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log create mode 100644 datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log create mode 100644 datasets/emerging_threats/shieldbreak/shieldbreak.yml create mode 100644 datasets/emerging_threats/shieldbreak/system_integrity_process.log create mode 100644 datasets/emerging_threats/shieldbreak/wer_file_creation.log diff --git a/datasets/emerging_threats/shieldbreak/ads_over_local_share.log b/datasets/emerging_threats/shieldbreak/ads_over_local_share.log new file mode 100644 index 000000000..23ce902f1 --- /dev/null +++ b/datasets/emerging_threats/shieldbreak/ads_over_local_share.log @@ -0,0 +1 @@ +5145001281100x8020000000000000300591SecurityEC2AMAZ-FKEOM7GNT AUTHORITY\SYSTEMEC2AMAZ-FKEOM7G$WORKGROUP0x3e7File127.0.0.161762\\*\C$\??\C:\Windows\System32\phoneinfo.dll:stream0x2%%4417- \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/defender_kernel_object.log b/datasets/emerging_threats/shieldbreak/defender_kernel_object.log new file mode 100644 index 000000000..a9ed22988 --- /dev/null +++ b/datasets/emerging_threats/shieldbreak/defender_kernel_object.log @@ -0,0 +1,2 @@ +111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\Administratorcontainerfile:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN; file:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7 +111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\Administratorcontainerfile:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN; file:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7 \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log b/datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log new file mode 100644 index 000000000..61c9fd7dd --- /dev/null +++ b/datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log @@ -0,0 +1 @@ +734700x800000000000000012799Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-08-14 16:03:24.305{1b43529b-3c4c-6a7f-c904-000000006300}8748C:\Users\Administrator\Desktop\ShieldBreak.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MpClient.dll4.18.26070.9 (797b3603749206dfffe67a1cc891531b0a2cf438)Client InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationmpclient.dllMD5=BD542955CA16303D5042FA6C519470F6,SHA256=F5BB3463A94C4D87CC90691B474126F5EC1330579DD596F381322C3DAF7F44DC,IMPHASH=E8D5A007E0A362B0C7263E95E1F2C82AtrueMicrosoft WindowsValidEC2AMAZ-FKEOM7G\Administrator \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log b/datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log new file mode 100644 index 000000000..55c2b370e --- /dev/null +++ b/datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log @@ -0,0 +1 @@ +11241100x800000000000000012805Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7GDLL2026-08-14 16:03:29.585{1b43529b-244c-6a7f-eb03-000000000000}4SystemC:\Windows\System32\phoneinfo.dll2026-08-14 16:03:29.585NT AUTHORITY\SYSTEM \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/shieldbreak.yml b/datasets/emerging_threats/shieldbreak/shieldbreak.yml new file mode 100644 index 000000000..ea5dc133a --- /dev/null +++ b/datasets/emerging_threats/shieldbreak/shieldbreak.yml @@ -0,0 +1,39 @@ +author: Onur Mustafa Erdogan, Splunk +id: 747ebcb7-b67c-4cdd-9409-320afb430187 +date: '2026-08-17' +description: Generated datasets for ShieldBreak exploitation targeting Windows Defender. Includes various scenarios in order to detect ShieldBreak exploitation attempts. +environment: NA +directory: shieldbreak +mitre_technique: +- T1068 +- T1134.001 +- T1053.005 +- T1574.001 +- T1211 +- T1564.004 +- T1021.002 +datasets: +- name: system_integrity_process.log + path: /datasets/emerging_threats/shieldbreak/system_integrity_process.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: wer_file_creation.log + path: /datasets/emerging_threats/shieldbreak/wer_file_creation.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: phoneinfo_dll_created.log + path: /datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: mpclient_dll_loaded.log + path: /datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: defender_kernel_object.log + path: /datasets/emerging_threats/shieldbreak/defender_kernel_object.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational +- name: ads_over_local_share.log + path: /datasets/emerging_threats/shieldbreak/ads_over_local_share.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/system_integrity_process.log b/datasets/emerging_threats/shieldbreak/system_integrity_process.log new file mode 100644 index 000000000..50fc825ee --- /dev/null +++ b/datasets/emerging_threats/shieldbreak/system_integrity_process.log @@ -0,0 +1 @@ +154100x800000000000000012812Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-08-14 16:03:29.752{1b43529b-3c51-6a7f-cb04-000000006300}9148C:\Windows\System32\conhost.exe10.0.26100.33158 (WinBuild.160101.0800)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXE"C:\Windows\System32\conhost.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{1b43529b-244e-6a7f-e703-000000000000}0x3e72SystemMD5=A8306D3735D6E7B127050F42E92A6932,SHA256=CE219763B73D8B4FE41517B70CAE7421F28CACA149C6637D3312290357D81508,IMPHASH=D5AC805663F5B0C1826ED50248F028B9{1b43529b-3c51-6a7f-ca04-000000006300}5640C:\Windows\System32\wermgr.exe"C:\Windows\system32\wermgr.exe" -uploadNT AUTHORITY\SYSTEM \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/wer_file_creation.log b/datasets/emerging_threats/shieldbreak/wer_file_creation.log new file mode 100644 index 000000000..438f9b0d9 --- /dev/null +++ b/datasets/emerging_threats/shieldbreak/wer_file_creation.log @@ -0,0 +1 @@ +11241100x800000000000000012806Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-08-14 16:03:29.646{1b43529b-3c4c-6a7f-c904-000000006300}8748C:\Users\Administrator\Desktop\ShieldBreak.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c0000000_A_B_C-C-D-E-{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\Report.wer2026-08-14 16:03:29.645EC2AMAZ-FKEOM7G\Administrator \ No newline at end of file From e48df4a92859e27992731839843d8c4e54788048 Mon Sep 17 00:00:00 2001 From: oerdogan Date: Mon, 17 Aug 2026 14:31:59 +0200 Subject: [PATCH 2/3] Removing local files --- .../shieldbreak/ads_over_local_share.log | 1 - .../shieldbreak/defender_kernel_object.log | 2 - .../shieldbreak/mpclient_dll_loaded.log | 1 - .../shieldbreak/phoneinfo_dll_created.log | 1 - .../shieldbreak/shieldbreak.yml | 39 ------------------- .../shieldbreak/system_integrity_process.log | 1 - .../shieldbreak/wer_file_creation.log | 1 - 7 files changed, 46 deletions(-) delete mode 100644 datasets/emerging_threats/shieldbreak/ads_over_local_share.log delete mode 100644 datasets/emerging_threats/shieldbreak/defender_kernel_object.log delete mode 100644 datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log delete mode 100644 datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log delete mode 100644 datasets/emerging_threats/shieldbreak/shieldbreak.yml delete mode 100644 datasets/emerging_threats/shieldbreak/system_integrity_process.log delete mode 100644 datasets/emerging_threats/shieldbreak/wer_file_creation.log diff --git a/datasets/emerging_threats/shieldbreak/ads_over_local_share.log b/datasets/emerging_threats/shieldbreak/ads_over_local_share.log deleted file mode 100644 index 23ce902f1..000000000 --- a/datasets/emerging_threats/shieldbreak/ads_over_local_share.log +++ /dev/null @@ -1 +0,0 @@ -5145001281100x8020000000000000300591SecurityEC2AMAZ-FKEOM7GNT AUTHORITY\SYSTEMEC2AMAZ-FKEOM7G$WORKGROUP0x3e7File127.0.0.161762\\*\C$\??\C:\Windows\System32\phoneinfo.dll:stream0x2%%4417- \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/defender_kernel_object.log b/datasets/emerging_threats/shieldbreak/defender_kernel_object.log deleted file mode 100644 index a9ed22988..000000000 --- a/datasets/emerging_threats/shieldbreak/defender_kernel_object.log +++ /dev/null @@ -1,2 +0,0 @@ -111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\Administratorcontainerfile:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN; file:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7 -111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\Administratorcontainerfile:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN; file:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7 \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log b/datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log deleted file mode 100644 index 61c9fd7dd..000000000 --- a/datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log +++ /dev/null @@ -1 +0,0 @@ -734700x800000000000000012799Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-08-14 16:03:24.305{1b43529b-3c4c-6a7f-c904-000000006300}8748C:\Users\Administrator\Desktop\ShieldBreak.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MpClient.dll4.18.26070.9 (797b3603749206dfffe67a1cc891531b0a2cf438)Client InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationmpclient.dllMD5=BD542955CA16303D5042FA6C519470F6,SHA256=F5BB3463A94C4D87CC90691B474126F5EC1330579DD596F381322C3DAF7F44DC,IMPHASH=E8D5A007E0A362B0C7263E95E1F2C82AtrueMicrosoft WindowsValidEC2AMAZ-FKEOM7G\Administrator \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log b/datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log deleted file mode 100644 index 55c2b370e..000000000 --- a/datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log +++ /dev/null @@ -1 +0,0 @@ -11241100x800000000000000012805Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7GDLL2026-08-14 16:03:29.585{1b43529b-244c-6a7f-eb03-000000000000}4SystemC:\Windows\System32\phoneinfo.dll2026-08-14 16:03:29.585NT AUTHORITY\SYSTEM \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/shieldbreak.yml b/datasets/emerging_threats/shieldbreak/shieldbreak.yml deleted file mode 100644 index ea5dc133a..000000000 --- a/datasets/emerging_threats/shieldbreak/shieldbreak.yml +++ /dev/null @@ -1,39 +0,0 @@ -author: Onur Mustafa Erdogan, Splunk -id: 747ebcb7-b67c-4cdd-9409-320afb430187 -date: '2026-08-17' -description: Generated datasets for ShieldBreak exploitation targeting Windows Defender. Includes various scenarios in order to detect ShieldBreak exploitation attempts. -environment: NA -directory: shieldbreak -mitre_technique: -- T1068 -- T1134.001 -- T1053.005 -- T1574.001 -- T1211 -- T1564.004 -- T1021.002 -datasets: -- name: system_integrity_process.log - path: /datasets/emerging_threats/shieldbreak/system_integrity_process.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational -- name: wer_file_creation.log - path: /datasets/emerging_threats/shieldbreak/wer_file_creation.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational -- name: phoneinfo_dll_created.log - path: /datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational -- name: mpclient_dll_loaded.log - path: /datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational -- name: defender_kernel_object.log - path: /datasets/emerging_threats/shieldbreak/defender_kernel_object.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational -- name: ads_over_local_share.log - path: /datasets/emerging_threats/shieldbreak/ads_over_local_share.log - sourcetype: XmlWinEventLog - source: XmlWinEventLog:Security \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/system_integrity_process.log b/datasets/emerging_threats/shieldbreak/system_integrity_process.log deleted file mode 100644 index 50fc825ee..000000000 --- a/datasets/emerging_threats/shieldbreak/system_integrity_process.log +++ /dev/null @@ -1 +0,0 @@ -154100x800000000000000012812Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-08-14 16:03:29.752{1b43529b-3c51-6a7f-cb04-000000006300}9148C:\Windows\System32\conhost.exe10.0.26100.33158 (WinBuild.160101.0800)Console Window HostMicrosoft® Windows® Operating SystemMicrosoft CorporationCONHOST.EXE"C:\Windows\System32\conhost.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{1b43529b-244e-6a7f-e703-000000000000}0x3e72SystemMD5=A8306D3735D6E7B127050F42E92A6932,SHA256=CE219763B73D8B4FE41517B70CAE7421F28CACA149C6637D3312290357D81508,IMPHASH=D5AC805663F5B0C1826ED50248F028B9{1b43529b-3c51-6a7f-ca04-000000006300}5640C:\Windows\System32\wermgr.exe"C:\Windows\system32\wermgr.exe" -uploadNT AUTHORITY\SYSTEM \ No newline at end of file diff --git a/datasets/emerging_threats/shieldbreak/wer_file_creation.log b/datasets/emerging_threats/shieldbreak/wer_file_creation.log deleted file mode 100644 index 438f9b0d9..000000000 --- a/datasets/emerging_threats/shieldbreak/wer_file_creation.log +++ /dev/null @@ -1 +0,0 @@ -11241100x800000000000000012806Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-08-14 16:03:29.646{1b43529b-3c4c-6a7f-c904-000000006300}8748C:\Users\Administrator\Desktop\ShieldBreak.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c0000000_A_B_C-C-D-E-{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\Report.wer2026-08-14 16:03:29.645EC2AMAZ-FKEOM7G\Administrator \ No newline at end of file From 241b2a87c5b8941e0f2e7be0505c56139af6c334 Mon Sep 17 00:00:00 2001 From: oerdogan Date: Mon, 17 Aug 2026 14:39:44 +0200 Subject: [PATCH 3/3] updated lfs links --- .../ShieldBreak/ads_over_local_share.log | 3 ++ .../ShieldBreak/defender_kernel_object.log | 3 ++ .../ShieldBreak/mpclient_dll_loaded.log | 3 ++ .../ShieldBreak/phoneinfo_dll_created.log | 3 ++ .../ShieldBreak/shieldbreak.yml | 39 +++++++++++++++++++ .../ShieldBreak/system_integrity_process.log | 3 ++ .../ShieldBreak/wer_file_creation.log | 3 ++ 7 files changed, 57 insertions(+) create mode 100644 datasets/emerging_threats/ShieldBreak/ads_over_local_share.log create mode 100644 datasets/emerging_threats/ShieldBreak/defender_kernel_object.log create mode 100644 datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log create mode 100644 datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log create mode 100644 datasets/emerging_threats/ShieldBreak/shieldbreak.yml create mode 100644 datasets/emerging_threats/ShieldBreak/system_integrity_process.log create mode 100644 datasets/emerging_threats/ShieldBreak/wer_file_creation.log diff --git a/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log b/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log new file mode 100644 index 000000000..d37682d73 --- /dev/null +++ b/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d8d079236fe6f0c17783e309735d2368a0b3d6751840e1b453569be594cfc70c +size 1132 diff --git a/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log b/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log new file mode 100644 index 000000000..75d5f0a43 --- /dev/null +++ b/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f88ca718b81e5971cec4865a692df4bb3cb71263c71f26bd91ab3cd44e7f6bf1 +size 5698 diff --git a/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log b/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log new file mode 100644 index 000000000..90a87c2de --- /dev/null +++ b/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:41d280e80b304f6fa0a52cccd39f3d6fe53e448b9822d27b2ac2efb2a7661e23 +size 1619 diff --git a/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log b/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log new file mode 100644 index 000000000..c167f0548 --- /dev/null +++ b/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f88debe62e622cb82760960ae80be0574c29489371d87821bd821c82fc0c5eaa +size 993 diff --git a/datasets/emerging_threats/ShieldBreak/shieldbreak.yml b/datasets/emerging_threats/ShieldBreak/shieldbreak.yml new file mode 100644 index 000000000..ea5dc133a --- /dev/null +++ b/datasets/emerging_threats/ShieldBreak/shieldbreak.yml @@ -0,0 +1,39 @@ +author: Onur Mustafa Erdogan, Splunk +id: 747ebcb7-b67c-4cdd-9409-320afb430187 +date: '2026-08-17' +description: Generated datasets for ShieldBreak exploitation targeting Windows Defender. Includes various scenarios in order to detect ShieldBreak exploitation attempts. +environment: NA +directory: shieldbreak +mitre_technique: +- T1068 +- T1134.001 +- T1053.005 +- T1574.001 +- T1211 +- T1564.004 +- T1021.002 +datasets: +- name: system_integrity_process.log + path: /datasets/emerging_threats/shieldbreak/system_integrity_process.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: wer_file_creation.log + path: /datasets/emerging_threats/shieldbreak/wer_file_creation.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: phoneinfo_dll_created.log + path: /datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: mpclient_dll_loaded.log + path: /datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: defender_kernel_object.log + path: /datasets/emerging_threats/shieldbreak/defender_kernel_object.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational +- name: ads_over_local_share.log + path: /datasets/emerging_threats/shieldbreak/ads_over_local_share.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security \ No newline at end of file diff --git a/datasets/emerging_threats/ShieldBreak/system_integrity_process.log b/datasets/emerging_threats/ShieldBreak/system_integrity_process.log new file mode 100644 index 000000000..654609161 --- /dev/null +++ b/datasets/emerging_threats/ShieldBreak/system_integrity_process.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2643e30817ebf2a9246dbed07b4a14782a0ae4d5ee3f52d170aadb9060b94697 +size 1960 diff --git a/datasets/emerging_threats/ShieldBreak/wer_file_creation.log b/datasets/emerging_threats/ShieldBreak/wer_file_creation.log new file mode 100644 index 000000000..9793d2bf9 --- /dev/null +++ b/datasets/emerging_threats/ShieldBreak/wer_file_creation.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:464af16d37e3ba0fb36fddb332e4126402dc3671354e7bf2cb0a4fd55274a8ce +size 1137