Merge pull request #1129 from splunk/xml_runner

xml_runner

Author: P4T12ICK

datasets/attack_techniques/T1218.014/msc_execution/loaded_msc_mmc.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fc9968c567767196f07070b297369639197024ef0a103275fa7b873a070359c0
+size 7988

datasets/attack_techniques/T1218.014/msc_execution/msc_execution.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 78393210-0113-11f1-b6d6-629be3538068
+date: '2026-02-03'
+description: Generated datasets for msc execution in attack range.
+environment: attack_range
+directory: msc_execution
+mitre_technique:
+- T1218.014
+datasets:
+- name: loaded_msc_mmc.log
+  path: /datasets/attack_techniques/T1218.014/msc_execution/loaded_msc_mmc.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

datasets/attack_techniques/T1620/mmc_script_modules/loaded_module_mmc.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:44790d426d978a6cbc1eb4a1c56fc5835eab84d9bfb87615e2389f676c8f173f
+size 203262

datasets/attack_techniques/T1620/mmc_script_modules/mmc_script_modules.yml

@@ -0,0 +1,13 @@
+author: Teoderick Contreras, Splunk
+id: 5b4a49dc-0113-11f1-b6d6-629be3538068
+date: '2026-02-03'
+description: Generated datasets for mmc script modules in attack range.
+environment: attack_range
+directory: mmc_script_modules
+mitre_technique:
+- T1620
+datasets:
+- name: loaded_module_mmc.log
+  path: /datasets/attack_techniques/T1620/mmc_script_modules/loaded_module_mmc.log
+  sourcetype: 'XmlWinEventLog'
+  source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'