{ "read_only": true, "ioc_library_count": 156125, "lookups": [ { "session_id": "8b7b5cdd-2fd8-4edb-a346-1920bb702d52", "artifact": "194.62.42.206", "stored_result_sha256": "f182fff983d10b0ddb45eb2b2d0e06b644db5491edad36f84426e9280852e7e2", "expected_sha256": "f182fff983d10b0ddb45eb2b2d0e06b644db5491edad36f84426e9280852e7e2", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": false, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "ececde00-c0d7-49bc-be9a-cc6bee393239", "artifact": "simpsonsavingss.com", "stored_result_sha256": "a3a635b0b0f4fbf80bf0a6304c183b4c1ba2be92e51e9788faf291afcef70990", "expected_sha256": "a3a635b0b0f4fbf80bf0a6304c183b4c1ba2be92e51e9788faf291afcef70990", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": false, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "84edb541-725a-4951-95f7-557c53fc8cf8", "artifact": "167.172.37.9", "stored_result_sha256": "5aa905b18ceabe6fe2db9b6ddae8c4f273373c346d08ea2881bc259552f5192c", "expected_sha256": "5aa905b18ceabe6fe2db9b6ddae8c4f273373c346d08ea2881bc259552f5192c", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": false, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "997d0aa6-7dd5-4cbb-893d-72ff83b93601", "artifact": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8", "stored_result_sha256": "a38bae147d1765125690fa0faf35e5b5a42a7f5d5f3bac4094c0bb499517df80", "expected_sha256": "a38bae147d1765125690fa0faf35e5b5a42a7f5d5f3bac4094c0bb499517df80", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": false, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "89e9d15a-c2f9-4310-b3cd-0676c64daa28", "artifact": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431", "stored_result_sha256": "0309c5fa0b117e2fc2d6591020286ae48e6c03181212654b21d52438087c8722", "expected_sha256": "0309c5fa0b117e2fc2d6591020286ae48e6c03181212654b21d52438087c8722", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "144ab9a0-2681-49f4-a410-b126d75d334d", "artifact": "au.download.windowsupdate.com", "stored_result_sha256": "a64064e6a20a9c8152ea59a4664ee0e506d9eeb267bfea80a8e9df5d12d19f65", "expected_sha256": "a64064e6a20a9c8152ea59a4664ee0e506d9eeb267bfea80a8e9df5d12d19f65", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "58057369-e44a-47d1-97a6-8f537e481157", "artifact": "kamuchehddhgfgf.ddns.net", "stored_result_sha256": "94b3937ac6a6b5d32c9fb7840ad0e38b55fd525fcd0d9a704badc9166e989b39", "expected_sha256": "94b3937ac6a6b5d32c9fb7840ad0e38b55fd525fcd0d9a704badc9166e989b39", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "593d219e-2578-45ab-8d90-697899320a04", "artifact": "23.111.114.52", "stored_result_sha256": "1ededd6629c01614a8444bda2fb6531de2e7fc877fca7f592901fea8725d70d8", "expected_sha256": "1ededd6629c01614a8444bda2fb6531de2e7fc877fca7f592901fea8725d70d8", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": false, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "107aeeec-5730-437f-969a-3f434a0cae71", "artifact": "newsaarctech.com", "stored_result_sha256": "9fece7a44ab95fb95c13fb16af9147348fffbfd3bbff1044c4ccbe8ea9e8ee86", "expected_sha256": "9fece7a44ab95fb95c13fb16af9147348fffbfd3bbff1044c4ccbe8ea9e8ee86", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": false, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "3c93d6d2-ef39-45ac-9cff-0a0591383b57", "artifact": "172.104.227.98", "stored_result_sha256": "d030c11de1a0d31ce1857e052aa94a5b90347c152b420239bfdffd5d7cacf7f9", "expected_sha256": "d030c11de1a0d31ce1857e052aa94a5b90347c152b420239bfdffd5d7cacf7f9", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": false, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "28f3673b-6918-4d37-a37c-1ec91202489a", "artifact": "163.172.50.82", "stored_result_sha256": "84530f3c642bb57c7a0a6ee42d368dd25248d70b738b7864cecf45827f45ed64", "expected_sha256": "84530f3c642bb57c7a0a6ee42d368dd25248d70b738b7864cecf45827f45ed64", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": false, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "417e279b-de9f-426d-90dc-61255e3367de", "artifact": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a", "stored_result_sha256": "f4476a30778ad878ae2e1b39b3b15be69c6b90709364d5c9073801bbc5981714", "expected_sha256": "f4476a30778ad878ae2e1b39b3b15be69c6b90709364d5c9073801bbc5981714", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "20f513e1-0d5c-4c07-a135-12408729e84e", "artifact": "37.0.10.22", "stored_result_sha256": "1790b685bb34c9fb8dea3e469ef1a7e7774c87d2ed2eaf7731242f2404049de7", "expected_sha256": "1790b685bb34c9fb8dea3e469ef1a7e7774c87d2ed2eaf7731242f2404049de7", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "06d6b15b-eaad-426c-9261-8c8e2e31c5ac", "artifact": "sobolpand.top", "stored_result_sha256": "5e27dc2aed2ccf831c9d48d748ee2a34e4d87128f393fe1ed2a8bd69a8a21a0b", "expected_sha256": "5e27dc2aed2ccf831c9d48d748ee2a34e4d87128f393fe1ed2a8bd69a8a21a0b", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "ed278503-bcef-4a9e-985d-fdb452eaa0f4", "artifact": "95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d", "stored_result_sha256": "5188e9b6c2e0b8286aa11da14b53d4ac74e77800c2abf0c424fc89c2aa1d2f7e", "expected_sha256": "5188e9b6c2e0b8286aa11da14b53d4ac74e77800c2abf0c424fc89c2aa1d2f7e", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "449a4d13-67b3-4897-a60b-1da08fcdd5ac", "artifact": "11f3d84aad7131fe124155c9edfceb594649e87de1ee03383f470442d6ed69a1", "stored_result_sha256": "1706b85454c367d88975a65f236d3e61f4d3276250d96ef378e046c5d393ea74", "expected_sha256": "1706b85454c367d88975a65f236d3e61f4d3276250d96ef378e046c5d393ea74", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2", "artifact": "gamaes.shop", "stored_result_sha256": "581b98aa9fe192b796fb797016bdf746f69dfb2e69f66565693b775e03852832", "expected_sha256": "581b98aa9fe192b796fb797016bdf746f69dfb2e69f66565693b775e03852832", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "0ac59bd3-1ec5-4019-b24e-02ea5aa390d9", "artifact": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38", "stored_result_sha256": "ae7b77dedd81499d9e80b0c5178966ca634e6e9dbe3059aa9f81c1fa794e0e18", "expected_sha256": "ae7b77dedd81499d9e80b0c5178966ca634e6e9dbe3059aa9f81c1fa794e0e18", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "6f1651e0-2db5-42f4-9749-2e0f20d3b464", "artifact": "2.56.57.108", "stored_result_sha256": "c8f19a3eda854febffa54600acf1dd1e4a103b0354c16ff575771b5d29b83094", "expected_sha256": "c8f19a3eda854febffa54600acf1dd1e4a103b0354c16ff575771b5d29b83094", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "7d2523b8-f4ad-4bd6-b2e0-d0446f827f41", "artifact": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "stored_result_sha256": "e1ec1521935782721078cb83306213a3dbfd52dd9f949d6404d38adde3b14769", "expected_sha256": "e1ec1521935782721078cb83306213a3dbfd52dd9f949d6404d38adde3b14769", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "2bbb7c7c-b87c-4856-b61d-5fd7a8e45641", "artifact": "a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba", "stored_result_sha256": "f9ccc8b0e50420333f6e2444bf262c7efea168a4712e8c0e9c8d0e7a96195bdc", "expected_sha256": "f9ccc8b0e50420333f6e2444bf262c7efea168a4712e8c0e9c8d0e7a96195bdc", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "426e629d-a1bb-4c70-bffe-adec45624786", "artifact": "156.96.154.210", "stored_result_sha256": "489a8d66cf28853e55a1605bc14d44990a43aa2482bb327fece617ac838473a3", "expected_sha256": "489a8d66cf28853e55a1605bc14d44990a43aa2482bb327fece617ac838473a3", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "6b810f26-5efb-4b64-86c5-f137700f232d", "artifact": "www.katchybugonsale.com", "stored_result_sha256": "88a196fe9ac5a05191d5cad4b66a211ec399a52e77a534620ca4d57e25742e9b", "expected_sha256": "88a196fe9ac5a05191d5cad4b66a211ec399a52e77a534620ca4d57e25742e9b", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "957b537c-03f1-478c-b84e-261fc9f84eb1", "artifact": "www.privilegetroissecurity.com", "stored_result_sha256": "96e1019cc0af00a4fa543cd8c0f763625bfdf40e9c3d3c2d06dfddd452b8c882", "expected_sha256": "96e1019cc0af00a4fa543cd8c0f763625bfdf40e9c3d3c2d06dfddd452b8c882", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "d7572e86-86a5-4184-ab77-87658439325e", "artifact": "135.148.121.246", "stored_result_sha256": "0aba8aecfa8142b98dc0fefda43b5362c635eb0837df0edafc3c5bc0a6994388", "expected_sha256": "0aba8aecfa8142b98dc0fefda43b5362c635eb0837df0edafc3c5bc0a6994388", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "f8c66060-4bfb-4eda-a201-47d5630305f2", "artifact": "14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3", "stored_result_sha256": "b4cf0fbdeabe087bf0e12e8cee7b41f7118f40d7fd379af9bd1fbcebac31dc65", "expected_sha256": "b4cf0fbdeabe087bf0e12e8cee7b41f7118f40d7fd379af9bd1fbcebac31dc65", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "cd20c1f5-325a-4cf2-bc51-c0b907cba6d3", "artifact": "abca26cf70ef57ef879c81a3b45d9fc5ce4437f54bda65d0170f3f5bae8a54f5", "stored_result_sha256": "4171e36cd98f19bca0f97ebbab3210fc96ead22f6851b3e949eb35f34f3f94d0", "expected_sha256": "4171e36cd98f19bca0f97ebbab3210fc96ead22f6851b3e949eb35f34f3f94d0", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "3b3e5ae3-95b0-4125-b73a-2986e33954cb", "artifact": "188.166.154.118", "stored_result_sha256": "7102bf88a9dbf9a1357da3d48bca191b9343927673643af39728b244139936b6", "expected_sha256": "7102bf88a9dbf9a1357da3d48bca191b9343927673643af39728b244139936b6", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "faf612e1-3438-432b-a1e7-89652376acc6", "artifact": "157.245.142.66", "stored_result_sha256": "18e03112eecc819e805b2535f4117c200531ef96a1cc07a6444f1b677754d3bc", "expected_sha256": "18e03112eecc819e805b2535f4117c200531ef96a1cc07a6444f1b677754d3bc", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "7e91950e-04c2-4541-b6b6-38e9425ee481", "artifact": "oceriesfornot.top", "stored_result_sha256": "4d44d4a7f6e5ecaac667fe71ae4eae6a6c1c3ebc0a28396d66785cef48931e4e", "expected_sha256": "4d44d4a7f6e5ecaac667fe71ae4eae6a6c1c3ebc0a28396d66785cef48931e4e", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "a1256e32-3c5c-4bcb-81ad-ec0b47d92f9e", "artifact": "antnosience.com", "stored_result_sha256": "f75e97c8af9eced4acae10382e3e62c32edb84946cc982dd51b2f87de6d14c17", "expected_sha256": "f75e97c8af9eced4acae10382e3e62c32edb84946cc982dd51b2f87de6d14c17", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "5d471573-3351-49e7-9990-be7655bdf498", "artifact": "ac64292e91738bf97842e7e5d28373a3a52bdb0aa2bc48a0df512e34d1b41501", "stored_result_sha256": "677ebda6d879088e87b70510aa1205f36fa9d064462def8c2766a5ecc2e8cffe", "expected_sha256": "677ebda6d879088e87b70510aa1205f36fa9d064462def8c2766a5ecc2e8cffe", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "4492fdf5-0121-46c6-886a-c6cb8a6f097e", "artifact": "67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd", "stored_result_sha256": "4da793ad5e09f790349e68bc6c02b30bd4d558decfd60d62afc00583e97d6438", "expected_sha256": "4da793ad5e09f790349e68bc6c02b30bd4d558decfd60d62afc00583e97d6438", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "17ddb894-4ad1-40c5-94e0-7171f453da51", "artifact": "141.98.10.79", "stored_result_sha256": "4f7cccc73a05fb8bc79cf6d6ac54b4f2971df396c4ba5ed086d321f7193ed5aa", "expected_sha256": "4f7cccc73a05fb8bc79cf6d6ac54b4f2971df396c4ba5ed086d321f7193ed5aa", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "51042b4c-1d8d-4259-9cc4-8d3702b2f063", "artifact": "github.com", "stored_result_sha256": "0c2deac3fc2bd97698564be0e158870dedd17cbe14d90e884c47c48f6b9c77b8", "expected_sha256": "0c2deac3fc2bd97698564be0e158870dedd17cbe14d90e884c47c48f6b9c77b8", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "6060459a-a3e3-4a99-b805-0e042f0d2d76", "artifact": "objects.githubusercontent.com", "stored_result_sha256": "d9698205cf3ef8521019b75bfbf8b6231da5ef6629b34f11216cddbcc4199905", "expected_sha256": "d9698205cf3ef8521019b75bfbf8b6231da5ef6629b34f11216cddbcc4199905", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "b781981b-9b96-423b-b518-e335fb56cfb7", "artifact": "47729774d301b648e888dee3b5e215d63adabb069700e1d81671fcbdfb80e4bb", "stored_result_sha256": "7ac5c3136d8b6540e222dbde9fba0b55b26e292e2b36bb67d16f9d1564e6c37d", "expected_sha256": "7ac5c3136d8b6540e222dbde9fba0b55b26e292e2b36bb67d16f9d1564e6c37d", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "8a0966a7-69b7-486c-b36a-c8389ee03a63", "artifact": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "stored_result_sha256": "78189dd7d5fd8f2dd4768eea03b3186996771999d80e6e6d508b5f80fe97f295", "expected_sha256": "78189dd7d5fd8f2dd4768eea03b3186996771999d80e6e6d508b5f80fe97f295", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "5a18f1ad-bf5c-44fc-bf57-26b343c5aebb", "artifact": "104.21.55.70", "stored_result_sha256": "0c6316f9b743980f34975ed2a018855c41e1543eec750d69c65934ddf91fc85d", "expected_sha256": "0c6316f9b743980f34975ed2a018855c41e1543eec750d69c65934ddf91fc85d", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "40c58a2f-b2de-4bff-8363-b060de19940e", "artifact": "172.67.170.159", "stored_result_sha256": "cea996476dd0e857c1d186be4af673164a52e806c8835b6e8fe61ec7547fa3db", "expected_sha256": "cea996476dd0e857c1d186be4af673164a52e806c8835b6e8fe61ec7547fa3db", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "691c6ed7-fde0-4ac9-9ab8-61cb05e2d986", "artifact": "quote.checkfedexexp.com", "stored_result_sha256": "5262859e36a64a74b0602aaf843415454964a2f62338e83a0dc46554dcc80e8a", "expected_sha256": "5262859e36a64a74b0602aaf843415454964a2f62338e83a0dc46554dcc80e8a", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "dd60fb30-9c1f-4deb-80a8-83799e126691", "artifact": "business.checkfedexexp.com", "stored_result_sha256": "563621dec5cd53482d2dc1c454b0841bda7ea043c7f9d9627921f4c642564717", "expected_sha256": "563621dec5cd53482d2dc1c454b0841bda7ea043c7f9d9627921f4c642564717", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "69b5e3ba-8ca6-4c05-98e9-ec0567792f3c", "artifact": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5", "stored_result_sha256": "35bc161a21762d2fd4d80089b2c70786ce756cade6144983528944cf2ae9b968", "expected_sha256": "35bc161a21762d2fd4d80089b2c70786ce756cade6144983528944cf2ae9b968", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "f5d34eb6-9ada-4b7b-8496-a5af3cd4e147", "artifact": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6", "stored_result_sha256": "1aa898e2c298b95e7a206ece4682f9f97429ef281af73185baca74e667000857", "expected_sha256": "1aa898e2c298b95e7a206ece4682f9f97429ef281af73185baca74e667000857", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "171a09ff-2ff9-4286-a62b-99398bc3eb8b", "artifact": "79.124.78.197", "stored_result_sha256": "60bd2de0b5182dfb093fdac3df73be73615b92ff637389c89544953e296436a4", "expected_sha256": "60bd2de0b5182dfb093fdac3df73be73615b92ff637389c89544953e296436a4", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "e2e7ab6b-ad96-446e-bc47-b809d2cc2f7e", "artifact": "ed0855c1637e5f93be7d54acb2cb8872683a0e5eb670258abb1ebc41bfbf4591", "stored_result_sha256": "a9208a7f25ce2b844a23885609fb81cfe3a99c6773ca0b18253c269d691eec9c", "expected_sha256": "a9208a7f25ce2b844a23885609fb81cfe3a99c6773ca0b18253c269d691eec9c", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "04a41182-b1e3-4eae-94dd-063ce4cbf1e2", "artifact": "736f0cb5cc23435dad920dbe447efcf102e61c8691fa8528f5f39f386537f43e", "stored_result_sha256": "9d6307371082b37c0f798e44736ccec86791cf56125d8842a27256049bfa6a20", "expected_sha256": "9d6307371082b37c0f798e44736ccec86791cf56125d8842a27256049bfa6a20", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "94bf7f27-3bc4-4b5f-b440-8fda0059e9f4", "artifact": "194.180.191.64", "stored_result_sha256": "e394c316e35a31777d00d58bea6405f0ce9218b0af6a3026f4bff5e556dad49a", "expected_sha256": "e394c316e35a31777d00d58bea6405f0ce9218b0af6a3026f4bff5e556dad49a", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "06ed7fd6-f18b-4c19-adc7-d6c3bb5859f9", "artifact": "modandcrackedapk.com", "stored_result_sha256": "dbd0523f0946425ff326e683e4a0dae8e8d120e0bb909bf3d36f4e1d78e45c18", "expected_sha256": "dbd0523f0946425ff326e683e4a0dae8e8d120e0bb909bf3d36f4e1d78e45c18", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "d9f3fb06-93de-429c-ae9a-406df4e2c147", "artifact": "classicgrand.com", "stored_result_sha256": "652eeb5567b973a2415d733f9b2b797e5f36a350e60ca274fab0fad53979d22a", "expected_sha256": "652eeb5567b973a2415d733f9b2b797e5f36a350e60ca274fab0fad53979d22a", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "15f10752-0d94-4b08-9ad7-e3d15f5006ee", "artifact": "cd6f72bd96cbbad446325f8c2d087283f051ccaf77523dc436eec2d98be29bf7", "stored_result_sha256": "5d543439f5cf5616e0033658b610bd99371cc53f682c3d0c14cd633ab1f7d8d4", "expected_sha256": "5d543439f5cf5616e0033658b610bd99371cc53f682c3d0c14cd633ab1f7d8d4", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true }, { "session_id": "1b9c6fcc-8089-4cab-9b35-f22887131a25", "artifact": "839e234a3a10b60d559ee5679d2019ad4e58d9cd66e6cfd971207c3c6ef8ea4d", "stored_result_sha256": "ae5f56c8ec47f6b1ca4d8c0fa26c99dac7c1f4e50ebd98925fa0d3f49626cd89", "expected_sha256": "ae5f56c8ec47f6b1ca4d8c0fa26c99dac7c1f4e50ebd98925fa0d3f49626cd89", "stored_exact": true, "ai_disabled": true, "current_graph_replay_exact": true, "current_graph_content_replay_exact": true, "current_score_replay_exact": true } ], "cases": [ { "date": "2021-09-10", "investigation_id": "507c6eec-8119-424e-bada-fcd00ccff4f5", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 82, "distinct_edge_ids": true, "packet_enrichment_edge_count": 6, "expected_packet_enrichment_edges": 6, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true }, { "date": "2021-10-22", "investigation_id": "49664677-c404-485e-8035-766012f9a9a4", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 35, "distinct_edge_ids": true, "packet_enrichment_edge_count": 6, "expected_packet_enrichment_edges": 6, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true }, { "date": "2021-12-08", "investigation_id": "40fe3cfe-82bb-402a-98a4-11b7a58a0b41", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 86, "distinct_edge_ids": true, "packet_enrichment_edge_count": 6, "expected_packet_enrichment_edges": 6, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true }, { "date": "2022-01-07", "investigation_id": "46cea0b8-e35e-48de-862a-1dd27b46759d", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 81, "distinct_edge_ids": true, "packet_enrichment_edge_count": 4, "expected_packet_enrichment_edges": 4, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true }, { "date": "2022-02-23", "investigation_id": "7ebcdf06-0ce2-42bb-aa0c-6cd478f63e57", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 61, "distinct_edge_ids": true, "packet_enrichment_edge_count": 6, "expected_packet_enrichment_edges": 6, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true }, { "date": "2022-03-21", "investigation_id": "abad4a24-6a07-41cb-abc4-9bc1b8fb2303", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 101, "distinct_edge_ids": true, "packet_enrichment_edge_count": 6, "expected_packet_enrichment_edges": 6, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true }, { "date": "2024-07-30", "investigation_id": "087a87a3-97fa-4ca9-b481-e3d08ce92d90", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 140, "distinct_edge_ids": true, "packet_enrichment_edge_count": 5, "expected_packet_enrichment_edges": 5, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true }, { "date": "2024-08-15", "investigation_id": "0d46927d-003d-4d7f-bc0d-3e85ca1411b9", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 286, "distinct_edge_ids": true, "packet_enrichment_edge_count": 6, "expected_packet_enrichment_edges": 6, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true }, { "date": "2024-09-04", "investigation_id": "51b8fd21-ce38-44fb-9a74-86602c0275db", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 21, "distinct_edge_ids": true, "packet_enrichment_edge_count": 3, "expected_packet_enrichment_edges": 3, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true }, { "date": "2024-11-26", "investigation_id": "19851c85-b03b-4655-bc64-64c6f1520100", "test_name_exact": true, "all_saved_lookups_attached": true, "actor_associations": [], "bound_edges": true, "edge_count": 61, "distinct_edge_ids": true, "packet_enrichment_edge_count": 5, "expected_packet_enrichment_edges": 5, "packet_edges_bound": true, "promotion_count": 0, "provider_nodes_advisory": true } ], "techniques": [ { "attack_id": "T1003", "current_catalog_match": true, "name": "OS Credential Dumping", "tactics": [ "credential-access" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--8b8cfd0f-bbe2-417b-b1d2-eebf84d3f008", "name": "Credential Dumping via Sensitive Memory and Registry Access Correlation" } ] }, { "attack_id": "T1005", "current_catalog_match": true, "name": "Data from Local System", "tactics": [ "collection" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--36bb5edf-e7b6-4d36-8ccc-1a18ddc573da", "name": "Detection of Local Data Collection Prior to Exfiltration" } ] }, { "attack_id": "T1010", "current_catalog_match": true, "name": "Application Window Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--d2daf569-4fc9-46a3-97b7-4d3d76c04a64", "name": "Detection of Application Window Enumeration via API or Scripting" } ] }, { "attack_id": "T1012", "current_catalog_match": true, "name": "Query Registry", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--106e32a9-29b7-4ec7-80cf-768662706490", "name": "Detection of Registry Query for Environmental Discovery" } ] }, { "attack_id": "T1014", "current_catalog_match": true, "name": "Rootkit", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--00a4e92b-8164-4342-a71c-013ecc777ad0", "name": "Detection of Kernel/User-Level Rootkit Behavior Across Platforms" } ] }, { "attack_id": "T1016", "current_catalog_match": true, "name": "System Network Configuration Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--172cff54-a89b-4207-abc2-8d0c9601025e", "name": "Behavioral Detection of System Network Configuration Discovery" } ] }, { "attack_id": "T1018", "current_catalog_match": true, "name": "Remote System Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--9ec6dafe-3e93-4ebb-943e-26b84136f6a9", "name": "Detection Strategy for Remote System Enumeration Behavior" } ] }, { "attack_id": "T1021", "current_catalog_match": true, "name": "Remote Services", "tactics": [ "lateral-movement" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--d33ffd4e-6328-4b10-84c0-7ad4a241b02d", "name": "Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity" } ] }, { "attack_id": "T1027", "current_catalog_match": true, "name": "Obfuscated Files or Information", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--e3758cbb-5dd9-4aad-b848-0539a8c56307", "name": "Behavioral Detection of Obfuscated Files or Information" } ] }, { "attack_id": "T1027.005", "current_catalog_match": true, "name": "Indicator Removal from Tools", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--6ab338c4-9ed3-4f63-9462-b13cea5a68b0", "name": "Detection Strategy for Indicator Removal from Tools - Post-AV Evasion Modification" } ] }, { "attack_id": "T1033", "current_catalog_match": true, "name": "System Owner/User Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--050d236f-745a-4801-add6-50cb58248615", "name": "Behavioral Detection of User Discovery via Local and Remote Enumeration" } ] }, { "attack_id": "T1036", "current_catalog_match": true, "name": "Masquerading", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--408aedab-4a23-41ad-809d-fe9c3805b7f6", "name": "Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy" } ] }, { "attack_id": "T1041", "current_catalog_match": true, "name": "Exfiltration Over C2 Channel", "tactics": [ "exfiltration" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--beb3a98c-f1a4-434a-81e7-29d178b14db2", "name": "Detection Strategy for Exfiltration Over C2 Channel" } ] }, { "attack_id": "T1045", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1046", "current_catalog_match": true, "name": "Network Service Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--82e20b1f-300e-43cc-9259-1d506ef5d1f8", "name": "Behavioral Detection Strategy for Network Service Discovery Across Platforms" } ] }, { "attack_id": "T1047", "current_catalog_match": true, "name": "Windows Management Instrumentation", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--8374a5e5-6d9f-4896-9546-a4d998188ac5", "name": "Behavioral Detection Strategy for WMI Execution Abuse on Windows" } ] }, { "attack_id": "T1049", "current_catalog_match": true, "name": "System Network Connections Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--7c45d09a-030e-4b30-b2d9-41fee3daa293", "name": "Detection of System Network Connections Discovery Across Platforms" } ] }, { "attack_id": "T1050", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1053", "current_catalog_match": true, "name": "Scheduled Task/Job", "tactics": [ "execution", "persistence", "privilege-escalation" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--df11466a-27a2-4cb1-bf73-2a3a4aaee0d9", "name": "Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse" } ] }, { "attack_id": "T1053.005", "current_catalog_match": true, "name": "Scheduled Task", "tactics": [ "execution", "persistence", "privilege-escalation" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--c7bdd7d7-19dc-4042-8565-5e0cf4656102", "name": "Detection of Suspicious Scheduled Task Creation and Execution on Windows" } ] }, { "attack_id": "T1055", "current_catalog_match": true, "name": "Process Injection", "tactics": [ "privilege-escalation", "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--9833b57b-4c83-4f58-b4cf-76f041b29273", "name": "Behavioral Detection of Process Injection Across Platforms" } ] }, { "attack_id": "T1055.011", "current_catalog_match": true, "name": "Extra Window Memory Injection", "tactics": [ "privilege-escalation", "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--1a8d87f1-48ca-4929-a5cc-2b2a03983f12", "name": "Detection Strategy for Extra Window Memory (EWM) Injection on Windows" } ] }, { "attack_id": "T1056", "current_catalog_match": true, "name": "Input Capture", "tactics": [ "collection", "credential-access" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--c922d994-74bd-4847-a870-c0ae216318c9", "name": "Behavioral Detection of Input Capture Across Platforms" } ] }, { "attack_id": "T1056.001", "current_catalog_match": true, "name": "Keylogging", "tactics": [ "collection", "credential-access" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--fe0d7d82-1575-4685-9a4f-4bf83e0227a0", "name": "Behavioral Detection of Keylogging Activity Across Platforms" } ] }, { "attack_id": "T1057", "current_catalog_match": true, "name": "Process Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--309ca3cd-d3f0-4aea-8932-558550aa89f4", "name": "Detection of Adversarial Process Discovery Behavior" } ] }, { "attack_id": "T1059", "current_catalog_match": true, "name": "Command and Scripting Interpreter", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--8582f5e6-44a5-4950-b7e8-a3e1b6d58d63", "name": "Behavioral Detection of Command and Scripting Interpreter Abuse" } ] }, { "attack_id": "T1059.001", "current_catalog_match": true, "name": "PowerShell", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--72b209e2-8c65-4217-8532-fabd0cb54ae5", "name": "Abuse of PowerShell for Arbitrary Execution" } ] }, { "attack_id": "T1059.003", "current_catalog_match": true, "name": "Windows Command Shell", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--1806ad13-6fa8-4cb0-9d91-c8a989a1d9fe", "name": "Behavioral Detection of Windows Command Shell Execution" } ] }, { "attack_id": "T1059.007", "current_catalog_match": true, "name": "JavaScript", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--6dd441e4-d264-4f7f-b145-9c122955c532", "name": "Cross-Platform Detection of JavaScript Execution Abuse" } ] }, { "attack_id": "T1060", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1063", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1064", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1070", "current_catalog_match": true, "name": "Indicator Removal", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--7225a3bd-f235-4c13-a236-3c6b9a3d445c", "name": "Behavioral Detection of Indicator Removal Across Platforms" } ] }, { "attack_id": "T1070.004", "current_catalog_match": true, "name": "File Deletion", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--b96fce76-6b29-4e1c-b8b1-741f45a89fdc", "name": "Behavioral Detection of Malicious File Deletion" } ] }, { "attack_id": "T1071", "current_catalog_match": true, "name": "Application Layer Protocol", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--155cab5b-c70b-4cfb-ba52-f62a21836b19", "name": "Detection of Command and Control Over Application Layer Protocols" } ] }, { "attack_id": "T1071.001", "current_catalog_match": true, "name": "Web Protocols", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc", "name": "Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets" } ] }, { "attack_id": "T1071.004", "current_catalog_match": true, "name": "DNS", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--c2721658-fa76-4b6f-9f84-50618de81ae0", "name": "Behavioral Detection of DNS Tunneling and Application Layer Abuse" } ] }, { "attack_id": "T1074.001", "current_catalog_match": true, "name": "Local Data Staging", "tactics": [ "collection" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--e91165c5-e850-465e-9042-6ba82478b522", "name": "Detection of Local Data Staging Prior to Exfiltration" } ] }, { "attack_id": "T1078", "current_catalog_match": true, "name": "Valid Accounts", "tactics": [ "initial-access", "persistence", "privilege-escalation", "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--a6245075-b59f-46cf-8b76-e8d95c378a22", "name": "Detection of Valid Account Abuse Across Platforms" } ] }, { "attack_id": "T1080", "current_catalog_match": true, "name": "Taint Shared Content", "tactics": [ "lateral-movement" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--cdfe6166-43e9-434a-a961-139edd58ca0c", "name": "Detection of Tainted Content Written to Shared Storage" } ] }, { "attack_id": "T1082", "current_catalog_match": true, "name": "System Information Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--75161d5e-2b6d-4112-ab4d-338f70ea97f0", "name": "System Discovery via Native and Remote Utilities" } ] }, { "attack_id": "T1083", "current_catalog_match": true, "name": "File and Directory Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--33ab9d0c-5671-48e6-8465-f80560909c65", "name": "Recursive Enumeration of Files and Directories Across Privilege Contexts" } ] }, { "attack_id": "T1087", "current_catalog_match": true, "name": "Account Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--fdda430c-e4f6-43ce-95d6-0f97253ff6a2", "name": "Enumeration of User or Account Information Across Platforms" } ] }, { "attack_id": "T1090", "current_catalog_match": true, "name": "Proxy", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--5c44619a-da36-4bbd-9730-efceacf2409f", "name": "Detection of Proxy Infrastructure Setup and Traffic Bridging" } ] }, { "attack_id": "T1095", "current_catalog_match": true, "name": "Non-Application Layer Protocol", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--2cb544af-ef54-4376-9608-b399ad67d3d6", "name": "Detection of Non-Application Layer Protocols for C2" } ] }, { "attack_id": "T1102", "current_catalog_match": true, "name": "Web Service", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--769615c5-08d5-4f51-8f3b-7ac2f1febce8", "name": "Suspicious Use of Web Services for C2" } ] }, { "attack_id": "T1104", "current_catalog_match": true, "name": "Multi-Stage Channels", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--6368178a-04c5-490b-96d5-f12dcccd0497", "name": "Detect Multi-Stage Command and Control Channels" } ] }, { "attack_id": "T1105", "current_catalog_match": true, "name": "Ingress Tool Transfer", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "name": "Detect Ingress Tool Transfers via Behavioral Chain" } ] }, { "attack_id": "T1106", "current_catalog_match": true, "name": "Native API", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--36654ec6-5019-4e79-b299-1fbf3a03e064", "name": "Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls" } ] }, { "attack_id": "T1112", "current_catalog_match": true, "name": "Modify Registry", "tactics": [ "defense-impairment", "persistence" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--cf6a38ec-4c16-4c7f-8730-6e04f6dd6e67", "name": "Behavior-Based Registry Modification Detection on Windows" } ] }, { "attack_id": "T1113", "current_catalog_match": true, "name": "Screen Capture", "tactics": [ "collection" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--a9de0990-69e9-4b1a-9754-1c7fb4102ac9", "name": "Detect Screen Capture via Commands and API Calls" } ] }, { "attack_id": "T1114", "current_catalog_match": true, "name": "Email Collection", "tactics": [ "collection" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--2470975e-6748-42a5-9a48-74dc7b687fe9", "name": "Email Collection via Local Email Access and Auto-Forwarding Behavior" } ] }, { "attack_id": "T1119", "current_catalog_match": true, "name": "Automated Collection", "tactics": [ "collection" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--5e9a51b5-7e4a-4e78-a1ba-215ce937c877", "name": "Automated File and API Collection Detection Across Platforms" } ] }, { "attack_id": "T1129", "current_catalog_match": true, "name": "Shared Modules", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--928a6ce6-fca0-4d66-aba3-1121431b953e", "name": "Behavior-chain, platform-aware detection strategy for T1129 Shared Modules" } ] }, { "attack_id": "T1134", "current_catalog_match": true, "name": "Access Token Manipulation", "tactics": [ "privilege-escalation", "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--774bbba8-45c2-403d-a445-3a64b3679faf", "name": "Behavior-chain detection for T1134 Access Token Manipulation on Windows" } ] }, { "attack_id": "T1137", "current_catalog_match": true, "name": "Office Application Startup", "tactics": [ "persistence" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--71a8576b-c9ef-4485-b461-d706fd757a67", "name": "Detect Office Startup-Based Persistence via Macros, Forms, and Registry Hooks" } ] }, { "attack_id": "T1140", "current_catalog_match": true, "name": "Deobfuscate/Decode Files or Information", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--5b3bf2de-d91e-4272-97a8-5df6f4071e45", "name": "Detect Adversary Deobfuscation or Decoding of Files and Payloads" } ] }, { "attack_id": "T1143", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1146", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1156", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1189", "current_catalog_match": true, "name": "Drive-by Compromise", "tactics": [ "initial-access" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--a070f9d2-3480-4362-99b3-8b36f5be0189", "name": "Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189)" } ] }, { "attack_id": "T1190", "current_catalog_match": true, "name": "Exploit Public-Facing Application", "tactics": [ "initial-access" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--dd8477c8-2aad-4db3-b810-fe0d2f605fa8", "name": "Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)" } ] }, { "attack_id": "T1193", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1204", "current_catalog_match": true, "name": "User Execution", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--70c9f174-2e96-4086-b59c-d2358e434f8e", "name": "User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)" } ] }, { "attack_id": "T1204.001", "current_catalog_match": true, "name": "Malicious Link", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--b977bf63-8fe2-4538-b4f2-0098fe26d67b", "name": "User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)" } ] }, { "attack_id": "T1204.002", "current_catalog_match": true, "name": "Malicious File", "tactics": [ "execution" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--e2023eb5-d813-4a08-985e-e8c998672037", "name": "User Execution – Malicious File via download/open → spawn chain (T1204.002)" } ] }, { "attack_id": "T1210", "current_catalog_match": true, "name": "Exploitation of Remote Services", "tactics": [ "lateral-movement" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--ee73dd97-cf1a-4220-a7cf-52d864811bb4", "name": "Exploitation of Remote Services – multi-platform lateral movement detection" } ] }, { "attack_id": "T1213", "current_catalog_match": true, "name": "Data from Information Repositories", "tactics": [ "collection" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--48e8d8b1-0117-48bd-a32d-f4e43b665bf3", "name": "Abuse of Information Repositories for Data Collection" } ] }, { "attack_id": "T1216", "current_catalog_match": true, "name": "System Script Proxy Execution", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--8ac2b0d0-a589-4c72-9287-a7d9e47065a9", "name": "Detection of Script-Based Proxy Execution via Signed Microsoft Utilities" } ] }, { "attack_id": "T1218", "current_catalog_match": true, "name": "System Binary Proxy Execution", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--ce0b969a-1411-4b6f-a6aa-c31ef6fe6727", "name": "Detection of Proxy Execution via Trusted Signed Binaries Across Platforms" } ] }, { "attack_id": "T1218.010", "current_catalog_match": true, "name": "Regsvr32", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--0a931f22-4820-48aa-8051-056da15a6183", "name": "Detection Strategy for System Binary Proxy Execution: Regsvr32" } ] }, { "attack_id": "T1218.011", "current_catalog_match": true, "name": "Rundll32", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--a51d4d34-78fc-49b7-9071-348905dd33c2", "name": "Detection Strategy for T1218.011 Rundll32 Abuse" } ] }, { "attack_id": "T1219", "current_catalog_match": true, "name": "Remote Access Tools", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--ec412019-109f-4f84-aa2f-d623f40254e0", "name": "Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)" } ] }, { "attack_id": "T1399", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1471", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1482", "current_catalog_match": true, "name": "Domain Trust Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--3414f3b8-17a2-438c-8bbc-a261a04da8bc", "name": "Detection of Domain Trust Discovery via API, Script, and CLI Enumeration" } ] }, { "attack_id": "T1486", "current_catalog_match": true, "name": "Data Encrypted for Impact", "tactics": [ "impact" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--d080a1b1-5ad1-45a1-8f7b-b736986c20d9", "name": "Detection of Multi-Platform File Encryption for Impact" } ] }, { "attack_id": "T1490", "current_catalog_match": true, "name": "Inhibit System Recovery", "tactics": [ "impact" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--b13116ed-e9c0-4cd5-81f6-676074078477", "name": "Behavioral Detection for T1490 - Inhibit System Recovery" } ] }, { "attack_id": "T1491", "current_catalog_match": true, "name": "Defacement", "tactics": [ "impact" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--2d5f2445-a395-4012-b378-c953f2df7353", "name": "Defacement via File and Web Content Modification Across Platforms" } ] }, { "attack_id": "T1491.001", "current_catalog_match": true, "name": "Internal Defacement", "tactics": [ "impact" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--c8b4a2e4-386f-45b3-b32a-8ca4113e5592", "name": "Internal Website and System Content Defacement via UI or Messaging Modifications" } ] }, { "attack_id": "T1496", "current_catalog_match": true, "name": "Resource Hijacking", "tactics": [ "impact" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--440ddaf2-4e80-4699-90d7-0bdccdfeece6", "name": "Resource Hijacking Detection Strategy" } ] }, { "attack_id": "T1497", "current_catalog_match": true, "name": "Virtualization/Sandbox Evasion", "tactics": [ "discovery", "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--7f5dde79-7872-48dd-8718-cd2e10d7cbfc", "name": "Detection Strategy for T1497 Virtualization/Sandbox Evasion" } ] }, { "attack_id": "T1505.003", "current_catalog_match": true, "name": "Web Shell", "tactics": [ "persistence" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--abb052c6-4edd-4592-9b9b-e53a55ac53b8", "name": "Web Shell Detection via Server Behavior and File Execution Chains" } ] }, { "attack_id": "T1518", "current_catalog_match": true, "name": "Software Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--f18dee58-43be-41e4-85a3-c6820033ac0d", "name": "Multi-Platform Software Discovery Behavior Chain" } ] }, { "attack_id": "T1518.001", "current_catalog_match": true, "name": "Security Software Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--e2409f82-e24c-4bb9-ad44-b20d97fb7a5a", "name": "Security Software Discovery Across Platforms" } ] }, { "attack_id": "T1529", "current_catalog_match": true, "name": "System Shutdown/Reboot", "tactics": [ "impact" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--2a464ecb-46ef-41f0-8ab6-a97a99ad0559", "name": "Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events" } ] }, { "attack_id": "T1539", "current_catalog_match": true, "name": "Steal Web Session Cookie", "tactics": [ "credential-access" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--26fdbcb2-abc1-4844-8e5d-2c6039336cb7", "name": "Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts" } ] }, { "attack_id": "T1542", "current_catalog_match": true, "name": "Pre-OS Boot", "tactics": [ "persistence", "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--abf6c96c-09f3-4bea-a5b7-1177f99881bc", "name": "Detection Strategy for T1542 Pre-OS Boot" } ] }, { "attack_id": "T1542.003", "current_catalog_match": true, "name": "Bootkit", "tactics": [ "persistence", "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--74252ca3-585e-466f-8020-ed77ebda3369", "name": "Detection Strategy for File Creation or Modification of Boot Files" } ] }, { "attack_id": "T1543", "current_catalog_match": true, "name": "Create or Modify System Process", "tactics": [ "persistence", "privilege-escalation" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--dab6c58b-2f44-4539-93e1-b03990fc1649", "name": "Detection of System Process Creation or Modification Across Platforms" } ] }, { "attack_id": "T1543.001", "current_catalog_match": true, "name": "Launch Agent", "tactics": [ "persistence", "privilege-escalation" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--4dbd7441-627f-4d5a-a060-28fe6a8cbb9e", "name": "Detection of Launch Agent Creation or Modification on macOS" } ] }, { "attack_id": "T1543.003", "current_catalog_match": true, "name": "Windows Service", "tactics": [ "persistence", "privilege-escalation" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--c7d19c6f-a7f8-4323-af57-c626ccb74d88", "name": "Detection of Windows Service Creation or Modification" } ] }, { "attack_id": "T1546", "current_catalog_match": true, "name": "Event Triggered Execution", "tactics": [ "persistence", "privilege-escalation" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--c5e3823f-5ee0-43db-b6fa-b63d6587b24c", "name": "Behavioral Detection of Event Triggered Execution Across Platforms" } ] }, { "attack_id": "T1547", "current_catalog_match": true, "name": "Boot or Logon Autostart Execution", "tactics": [ "persistence", "privilege-escalation" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--a9796458-df5d-467f-b037-acad6c261f25", "name": "Boot or Logon Autostart Execution Detection Strategy" } ] }, { "attack_id": "T1547.001", "current_catalog_match": true, "name": "Registry Run Keys / Startup Folder", "tactics": [ "persistence", "privilege-escalation" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--8febbfe8-91ae-4625-8fc7-656639b90a11", "name": "Detect Registry and Startup Folder Persistence (Windows)" } ] }, { "attack_id": "T1553", "current_catalog_match": true, "name": "Subvert Trust Controls", "tactics": [ "defense-impairment" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--73cde34a-247f-4ebc-87a5-ab6a9c400f40", "name": "Detect Subversion of Trust Controls via Certificate, Registry, and Attribute Manipulation" } ] }, { "attack_id": "T1560", "current_catalog_match": true, "name": "Archive Collected Data", "tactics": [ "collection" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--043bc738-1f07-4d28-9f5c-1b1f81525e7c", "name": "Detect Archiving and Encryption of Collected Data (T1560)" } ] }, { "attack_id": "T1562", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1562.001", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1564", "current_catalog_match": true, "name": "Hide Artifacts", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--bd2348f8-acef-4310-bd03-cf7b866d2592", "name": "Detection Strategy for Hidden Artifacts Across Platforms" } ] }, { "attack_id": "T1564.001", "current_catalog_match": true, "name": "Hidden Files and Directories", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--3f59957a-2e55-4378-bbe7-090fb1e4f067", "name": "Detection Strategy for Hidden Files and Directories" } ] }, { "attack_id": "T1564.003", "current_catalog_match": true, "name": "Hidden Window", "tactics": [ "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--1167a6c8-d735-4d5d-81f5-d81c6eafe239", "name": "Detection Strategy for Hidden Windows" } ] }, { "attack_id": "T1566", "current_catalog_match": true, "name": "Phishing", "tactics": [ "initial-access" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--7ee73f2e-76b2-4f00-bcc0-7fb79d31d344", "name": "Detection Strategy for Phishing across platforms." } ] }, { "attack_id": "T1567", "current_catalog_match": true, "name": "Exfiltration Over Web Service", "tactics": [ "exfiltration" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--1753ab98-4530-4284-9bc3-5d4813abfb9e", "name": "Detection Strategy for Exfiltration Over Web Service" } ] }, { "attack_id": "T1571", "current_catalog_match": true, "name": "Non-Standard Port", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--cc8324a7-03d0-47d1-8e2b-3caec44fc129", "name": "Detection Strategy for Non-Standard Ports" } ] }, { "attack_id": "T1573", "current_catalog_match": true, "name": "Encrypted Channel", "tactics": [ "command-and-control" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--08861418-398c-4972-8850-5e11f2d32944", "name": "Detection Strategy for Encrypted Channel across OS Platforms" } ] }, { "attack_id": "T1574", "current_catalog_match": true, "name": "Hijack Execution Flow", "tactics": [ "execution", "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--07669925-383b-455b-a3e2-3a79e18eed27", "name": "Detection Strategy for Hijack Execution Flow across OS platforms." } ] }, { "attack_id": "T1574.002", "current_catalog_match": false, "name": null, "tactics": [], "detection_strategies": [] }, { "attack_id": "T1583", "current_catalog_match": true, "name": "Acquire Infrastructure", "tactics": [ "resource-development" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--56752265-8647-4ce2-bc6c-c38c2e14685c", "name": "Detection of Acquire Infrastructure" } ] }, { "attack_id": "T1584", "current_catalog_match": true, "name": "Compromise Infrastructure", "tactics": [ "resource-development" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--7f3e2c35-7394-4cc6-baef-73a830930953", "name": "Detection of Compromise Infrastructure" } ] }, { "attack_id": "T1608", "current_catalog_match": true, "name": "Stage Capabilities", "tactics": [ "resource-development" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--5a1ada5b-5729-45d5-8b3d-f6fa7d2a3352", "name": "Detection of Stage Capabilities" } ] }, { "attack_id": "T1614", "current_catalog_match": true, "name": "System Location Discovery", "tactics": [ "discovery" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--9daf5067-79c3-477c-bf41-813aada4770d", "name": "Detection Strategy for System Location Discovery" } ] }, { "attack_id": "T1622", "current_catalog_match": true, "name": "Debugger Evasion", "tactics": [ "discovery", "stealth" ], "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--22f3a380-389d-44f7-a846-c6223fc06ddd", "name": "Detection Strategy for Debugger Evasion (T1622)" } ] } ] }