From f8baa029cbe3e8446b0575caefd52ca44490a4e1 Mon Sep 17 00:00:00 2001 From: nasbench Date: Mon, 24 Aug 2026 00:37:46 +0200 Subject: [PATCH] add edr sil --- .../T1685/edr_silencer/edrsilencer.yml | 13 +++++++++++++ .../T1685/edr_silencer/windows-security-xml.log | 3 +++ 2 files changed, 16 insertions(+) create mode 100644 datasets/attack_techniques/T1685/edr_silencer/edrsilencer.yml create mode 100644 datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log diff --git a/datasets/attack_techniques/T1685/edr_silencer/edrsilencer.yml b/datasets/attack_techniques/T1685/edr_silencer/edrsilencer.yml new file mode 100644 index 00000000..8b4d7598 --- /dev/null +++ b/datasets/attack_techniques/T1685/edr_silencer/edrsilencer.yml @@ -0,0 +1,13 @@ +author: Nasreddine Bencherchali, Splunk +id: 07335ddc-97c4-44c4-b3af-feabe28a356d +date: '2026-08-23' +description: Windows Security event for EDRSilencer creating a Windows Filtering Platform outbound filter. +environment: attack_range +directory: edr_silencer +mitre_technique: +- T1685 +datasets: +- name: windows-security-xml + path: /datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log b/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log new file mode 100644 index 00000000..35ea40f0 --- /dev/null +++ b/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:e8bb642e285e88378fee955afd4136dda049f8b4c07f7042357a71de571e62cd +size 2536