splunk · nasbench · Aug 17, 2026 · Aug 17, 2026 · Aug 17, 2026 · Aug 17, 2026
diff --git a/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log b/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log
diff --git a/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log b/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log
diff --git a/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log b/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log
diff --git a/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log b/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log
diff --git a/datasets/emerging_threats/ShieldBreak/shieldbreak.yml b/datasets/emerging_threats/ShieldBreak/shieldbreak.yml
@@ -0,0 +1,39 @@
+author: Onur Mustafa Erdogan, Splunk
+id: 747ebcb7-b67c-4cdd-9409-320afb430187
+date: '2026-08-17'
+description: Generated datasets for ShieldBreak exploitation targeting Windows Defender. Includes various scenarios in order to detect ShieldBreak exploitation attempts.
+environment: NA
+directory: shieldbreak
+mitre_technique:
+- T1068
+- T1134.001
+- T1053.005
+- T1574.001
+- T1211
+- T1564.004
+- T1021.002
+datasets:
+- name: system_integrity_process.log
+  path: /datasets/emerging_threats/shieldbreak/system_integrity_process.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: wer_file_creation.log
+  path: /datasets/emerging_threats/shieldbreak/wer_file_creation.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: phoneinfo_dll_created.log
+  path: /datasets/emerging_threats/shieldbreak/phoneinfo_dll_created.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: mpclient_dll_loaded.log
+  path: /datasets/emerging_threats/shieldbreak/mpclient_dll_loaded.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: defender_kernel_object.log
+  path: /datasets/emerging_threats/shieldbreak/defender_kernel_object.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational
+- name: ads_over_local_share.log
+  path: /datasets/emerging_threats/shieldbreak/ads_over_local_share.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Security
diff --git a/datasets/emerging_threats/ShieldBreak/system_integrity_process.log b/datasets/emerging_threats/ShieldBreak/system_integrity_process.log
diff --git a/datasets/emerging_threats/ShieldBreak/wer_file_creation.log b/datasets/emerging_threats/ShieldBreak/wer_file_creation.log