From 521df9bad11b3d13d8eb57b44df3f55f088d26df Mon Sep 17 00:00:00 2001 From: Radka Date: Thu, 3 Sep 2026 17:06:47 +0200 Subject: [PATCH 1/2] initial commit --- .../osascript_do_shell_script/osascript_do_shell_script.log | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log diff --git a/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log b/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log new file mode 100644 index 00000000..87dda773 --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ba4c36609394699d6562f62eef563a0ea0006b0403523d07976bff33f25abe19 +size 2177 From 97298afb925f826d8bc9c10918b1f102771e6ea7 Mon Sep 17 00:00:00 2001 From: Radka Date: Thu, 3 Sep 2026 17:13:25 +0200 Subject: [PATCH 2/2] add yml file --- .../osascript_do_shell_script.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.yml diff --git a/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.yml b/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.yml new file mode 100644 index 00000000..ee5f90be --- /dev/null +++ b/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.yml @@ -0,0 +1,13 @@ +author: Radka Viskova +id: a0bd4a40-c54d-4ce4-9504-f7f217d6d9a8 +date: '2026-09-03' +description: Generated dataset for osascript binary inline command execution with osquery and endpoint security. +environment: TalosOffensiveLab +directory: osascript_do_shell_script +mitre_technique: +- T1059.002 +datasets: +- name: osascript_do_shell_script + path: /datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log + sourcetype: osquery:results + source: osquery \ No newline at end of file