Skip to content

Commit 760e109

Browse files
authored
fixing yaml for intune bulk wipe dataset
1 parent d649fe0 commit 760e109

1 file changed

Lines changed: 8 additions & 6 deletions

File tree

datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe.yml

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ id: 4a5c3288-8391-4e80-9c3d-9dbb60ed1c45
33
date: '2026-03-29'
44
description: The following data contains simulated bulk Intune "wipe ManagedDevice" events from the Intune admin portal.
55
environment: attack_range
6-
dataset:
7-
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe.log
8-
sourcetypes:
9-
- azure:monitor:activity
10-
references:
11-
- https://www.lumos.com/blog/stryker-hack
6+
directory: microsoft_intune_bulk_wipe
7+
mitre_technique:
8+
- T1561.001
9+
datasets:
10+
- name: microsoft_intune_bulk_wipe
11+
path: /datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe.log
12+
sourcetype: azure:monitor:activity
13+
source: not_applicable

0 commit comments

Comments
 (0)