Skip to content

Add Windows Sysmon TOR client execution dataset for T1090.003 #1123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nasbench merged 2 commits into from
Jan 29, 2026
Merged

Add Windows Sysmon TOR client execution dataset for T1090.003 #1123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dec0fd6
Add Windows Sysmon TOR client execution dataset for T1090.003
vignesh-user Jan 26, 2026
74a9fb0
Apply suggestions from code review
nasbench Jan 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions datasets/attack_techniques/T1090.003/windows_tor_client_execution/windows-sysmon.log
View file
Open in desktop
Git LFS file not shown
13 changes: 13 additions & 0 deletions ...attack_techniques/T1090.003/windows_tor_client_execution/windows_tor_client_execution.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
author: Vignesh Subramanian, Splunk
id: 59206f25-1c8a-43a8-878e-a0f5c8aed211
date: '2026-01-19'
description: 'Generated dataset of Windows Sysmon process creation logs (Event ID 1) capturing TOR browser and related TOR component activities on Windows endpoints. Insider threats and external attackers may use TOR to hide their activity and bypass network security controls. This dataset helps detect the presence and execution of TOR components on Windows systems.'
environment: manual simulations in a controlled lab environment
directory: windows_tor_client_execution
mitre_technique:
- T1090.003
datasets:
- name: windows-sysmon
path: /datasets/attack_techniques/T1090.003/windows_tor_client_execution/windows-sysmon.log
sourcetype: XmlWinEventLog
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Loading