Skip to content

The following attack data links were partially bad, but not totally wrong. - #4209

Open
pyth0n1c wants to merge 1 commit into
developfrom
fix_partially_bad_attack_data_links
Open

The following attack data links were partially bad, but not totally wrong.#4209
pyth0n1c wants to merge 1 commit into
developfrom
fix_partially_bad_attack_data_links

Conversation

@pyth0n1c

@pyth0n1c pyth0n1c commented Aug 10, 2026

Copy link
Copy Markdown
Collaborator

Several of them had a path containing double backslash, like attack_data//T1003/file.log. This is resolvable by a redirect, but still wrong. A few others did not point to the prefix https://media.githubusercontent.com/media/splunk/attack_data/master/datasets and instead started with https://media.githubusercontent.com/media/splunk/attack_data/refs/head/master/datasets which, while it still resolved, was wrong

DETECTION VERSIONS ARE INTENTIONALLY NOT BUMPED BECAUSE THEY SHOULDN'T BE - ATTACK DATA LINKS ARE NOT SERIALIZED INTO SAVEDSEARCHES.CONF

…rong.

Several of them had a path containing double
backslash, like attack_data//T1003/file.log. This is resolvable by a
redirect, but still wrong. A few others did not point to the prefix
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets
and instead started with
https://media.githubusercontent.com/media/splunk/attack_data/refs/head/master/datasets
which, while it still resolved, was wrong

@nasbench nasbench left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assuming this is targeting 6.5. So I will not merge for now

@nasbench nasbench added this to the v6.5.0 milestone Aug 10, 2026
@pyth0n1c

pyth0n1c commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator Author

Assuming this is targeting 6.5. So I will not merge for now

Correct. This also doesn't actually matter for releases, it is only relevant to validation/testing workflows which validate attack data links. Interesting enough, you will find both links to an attack_data file "work":
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application.log

https://media.githubusercontent.com/media/////splunk/attack_data///////master/datasets/attack_techniques//////T1546.012/atomic_red_team/windows-application.log

It's just that the second is "silently" redirected.

And I suppose different sites handle this differently. Both
https://www.google.com/maps
and
https://www.google.com/////maps
image

work, with the second one NOT being redirected.

Interesting...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants