@SecDatasets

Contributing datasets, from different platforms, to the InfoSec community to expedite data analysis and threat research! https://xitter.cf/t.co/j62Xx21lEc

 Datastore
securitydatasets.com/
Joined September 2019
  • Tweets66
  • Following5
  • Followers2.1K
10Media
🚨 Collecting and sharing logs from the ☁️ 🙏 Thanks to project SimuLand 🏝️ (an @OTR_Community Initiative), we are starting to collect data from known community templates & emulation plans 😎 🌩️AWS Dateset: mordordatasets.com/notebooks… 🏗️ SimuLand: github.com/OTRF/SimuLand/tre…
2
26
57
Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: msft.it/6011n46MT
6
142
22
315
🚨 We decided to re-brand Mordor to @SecDatasets 😈 We’ll cover new types of datasets to extend its application 💜 more coming soon.. 🍻 Help us build the largest library of datasets for the InfoSec community! 🚀 Site: securitydatasets.com/introdu…… Repo: github.com/OTRF/Security-Dat…

GitHub - OTRF/Security-Datasets: Re-play Security Events

Re-play Security Events. Contribute to OTRF/Security-Datasets development by creating an account on GitHub.

github.com
1
52
2
107
We shared a dataset that contains the core behavior 🍻 You can add more context around it! (i.e. Service creation & execution) @OTR_Community 😈 Data: mordordatasets.com/notebooks… 🛡️@sigma_hq rules: 1⃣ github.com/SigmaHQ/sigma/blo… 2⃣ github.com/SigmaHQ/sigma/blo… How Do I use the data? ⏬
John Lambert
@JohnLaTwC23 Jun 2021
#HuntingTipOfTheDay Search for command lines 🔎with 'comsvcs.dll' and 'MiniDump' to find credential dumping. 👀 ✏️Test your detections: gist.github.com/JohnLaTwC/3e… 📎References: ▪️risksense.com/blog/hidden-ge… by Jenna Magius and Nate Caroe (@RiskSense) ▪️modexp.wordpress.com/2019/08…
1
13
39
Security Datasets retweeted
John Lambert
@JohnLaTwC16 Jun 2021
Importance of data sets for SecOps research and rule testing with projects by @SBousseaden, @Mordor_Project, @Cyb3rWard0g's SimuLand
1
1
6
🚨 In less than 24h 😉, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone 🌎 expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike 🗒️Metadata: mordordatasets.com/notebooks… 😈Dataset: raw.githubusercontent.com/OT…
Florian Roth ⚡️
@cyb3rops11 Jun 2021
APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with - NamedPipe Creation - Service installation & exec pattern - HTTP beaconing github.com/NextronSystems/AP… If you want to help, add some steps in here: github.com/NextronSystems/AP…
79
2
186
Security Datasets retweeted
Microsoft Security
@msftsecurity20 May 2021
It's time to go to SimuLand! 🎠🎡🎢 But it isn't a new vacation theme park hot spot, it's a new open-source initiative that will help you deploy a lab environment to reproduce real attack scenarios to test your security defenses. Get the details: msft.it/6017VxcHv

SimuLand: Understand adversary tradecraft and improve detection strategies | Microsoft Security Blog

At Microsoft, we continuously collaborate with customers and the InfoSec community to learn more about the latest adversary tradecraft so that we can improve our detection strategies across all our...

microsoft.com
7
166
32
329
Sharing @Mordor_Project datasets for "Getting AD FS Database Config Remotely" (Security, Sysmon & PCAP) @Cyb3rWard0g 🍻🙏 mordordatasets.com/notebooks… 1⃣ A few tool-based comments at the host level 2⃣ Group hosts & processes connecting to AD FS server over port 80 (Usually 443)
Dr. Nestori Syynimaa
@DrAzureAD27 Apr 2021
New version of #AADInternals out now, including remote dumping of #ADFS configuration database🔥 Read the blog at: o365blog.com/post/adfs/ Credits to @vesat, @doughsec, @BakedSec, @_dirkjan, @gentilkiwi, @MGrafnetter, and @Cyb3rWard0g for your help and previous work!
3
38
70
Sharing some data samples (PCAP & WinEvents) to validate detection of lateral movement via remote scheduled task creation & update 🍻 @OTR_Community 1⃣ Creation: mordordatasets.com/notebooks… 2⃣ Update: mordordatasets.com/notebooks… @HunterPlaybook Library Doc: github.com/OTRF/ThreatHunter…
John Lambert
@JohnLaTwC18 Dec 2020
microsoft.com/security/blog/…
28
91
Looking forward to it! 🍻 Let's talk about some of the steps taken before sharing a dataset with the community 💜
Red Canary, a Zscaler company
@redcanary15 Dec 2020
THIS FRIDAY: Catch @Cyb3rWard0g in conversation with @mattifestation for the last #AtomicFriday of 2020! bit.ly/33AKlil
4
8
Big news ya'll: @Cyb3rWard0g will be hosting our next Atomic Friday on December 11! Join us for a deep dive into @Mordor_Project and learn strategies for expediting data analysis. bit.ly/33AKlil
2
17
2
69
Security Datasets retweeted
Ashwin Patil
@ashwinpatil13 Nov 2020
Don`t Forget to checkout Project SimuLand for ☁️Cloud Datasets mordordatasets.com/notebooks…
1
3
19
Looking for ways to validate detection rules for that specific behavior? A small sample of data and a few rules! Thank you @rbmaslen @domchell @tifkin_ @OTR_Community 😈 Dataset: mordordatasets.com/notebooks… 🏹 @sigma_hq: 1) github.com/OTRF/sigma/blob/m… 2) github.com/OTRF/sigma/blob/m…
Rob Maslen@rbmaslen29 Oct 2020
SharpView, if you've run it on a machine have a look in %TEMP%\ba9ea7344a4a5f591d6e5dc32a13494b you might find a nasty surprise.....
15
43
Security Datasets retweeted
Johnny Shaw@jxy__s27 Oct 2020
So cool to see this! 👍
Security Datasets@SecDatasets27 Oct 2020
If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s ! 😈 mordordatasets.com/notebooks…
4
1
17
If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s ! 😈 mordordatasets.com/notebooks…
Johnny Shaw@jxy__s26 Oct 2020
I’m pleased to present this Windows exploit. Process Herpaderping is a method for evading detection - similar to process migration, hollowing, or doppelganging. herpaderping.com/

Process Herpaderping

Detection Evasion Exploit

jxy-s.github.io
1
43
3
119
Very happy to join forces, leverage PurpleSharp and share the data with the community! Keep up the great work @mvelazco ! More coming soon.. 😈
Mauricio Velazco@mvelazco23 Oct 2020
Replying to @mvelazco
Thanks to @Cyb3rWard0g & the @Mordor_Project we are also releasing samples of data (host & network) that you can explore to get familiarized with the data these techniques generate! @OTR_Community mordordatasets.com/notebooks…
1
10
😈 Adding more Windows datasets after using @redcanary Atomic Red Team and @mvelazco PurpleSharp 💜 Thank you all for everything you share with the Infosec Community 🌎 Courtesy of the @OTR_Community ! Commit: github.com/OTRF/mordor/commi…
1
28
4
113
HOW to contribute a @Mordor_Project dataset in 2 mins ⏳w/ the help of @redcanary ART & then contribute to @sigma_hq after exploring the data! @OTR_Community ♻️ Clear, Exec & Collect: youtu.be/6iteEfbuwU8 😈 Data: mordordatasets.com/notebooks… 🏹 Rule: github.com/OTRF/sigma/blob/m…
1
37
1
84
Security Datasets retweeted
DTM
@dtmsecurity16 Oct 2020
Check out mordordatasets.com/notebooks… and threathunterplaybook.com/not… - Mordor Dataset and Playbook entry for wuauclt.exe abuse with many thanks to @Cyb3rWard0g 🤜 for his epic work as ever! Will be updating blog with these links too for reference 💪
DTM
@dtmsecurity12 Oct 2020
I found an interesting #LOLBIN using Windows Update Client (wuauclt.exe) as a loader - blog, pull request to LOLBAS and in the wild sample here dtm.uk/wuauclt/ - I am hoping to finalise some of my work on the methodology I used soon @MDSecLabs so keep your eyes posted.

Code execution via the Windows Update client (wuauclt)

Its been a few months since my last post about uploading and downloading data with certreq.exe as a potential alternative to certutil.exe in LOLBIN land. I've been having a blast starting my new role...

dtm.uk
1
16
1
40
Security Datasets retweeted
Russ McRee@holisticinfosec14 Oct 2020
Since I last discussed @brimsecurity use with @Cyb3rWard0g & @Cyb3rPandaH's Mordor APT29 datasets in #toolsmith 144, @OliverRochford has been hard at work for Brim, exploring further & documenting his practice well. Check out medium.com/brim-securitys-kn… & the prior post. Great work!

Investigating Network traffic activity using Brim and Zeek

In the last article, I shared my favourite Brim ZQL queries to begin a threat hunting investigation in Zeek data. We covered pretty…

medium.com
8
2
32
Security Datasets retweeted
Julio Ureña@JulioUrena13 Oct 2020
#Day3 #100DaysOfBlueTeam Today I learned a few things about some open source projects. I must admit I was not expecting the music theme for the example of @Mordor_Project 🤣 youtu.be/kBe6-D1_ais

Mordor - Covenant - Kafkacat Consumer Mode - Rubeus asktgt ptt

The Mordor Project: https://github.com/Cyb3rWard0g/mordorIn consu...

youtube.com
1
2
12
Load more