{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1204","id":"T1204","name":"User Execution","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1204","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"55e00563170fa7a8a5dc88989fdf5a27cc6dcf53fc18a2f73344261ca9aa3ea5","description":"An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).\n\nWhile [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).\n\nAdversaries may also deceive users into performing actions such as:\n\n* Enabling [Remote Access Tools](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary\n* Running malicious JavaScript in their browser, allowing adversaries to [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)s(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023)\n* Downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204)\n* Coerceing users to copy, paste, and execute malicious code manually(Citation: Reliaquest-execution)(Citation: proofpoint-selfpwn)\n\nFor example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Tools](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1204","external_id":"T1204"},{"source_name":"Krebs Discord Bookmarks 2023","description":"Brian Krebs. (2023, May 30). Discord Admins Hacked by Malicious Bookmarks. Retrieved January 2, 2024.","url":"https://krebsonsecurity.com/2023/05/discord-admins-hacked-by-malicious-bookmarks/"},{"source_name":"Reliaquest-execution","description":"Reliaquest. (2024, May 31). New Execution Technique in ClearFake Campaign. Retrieved August 2, 2024.","url":"https://www.reliaquest.com/blog/new-execution-technique-in-clearfake-campaign/"},{"source_name":"Telephone Attack Delivery","description":"Selena Larson, Sam Scholten, Timothy Kromphardt. (2021, November 4). Caught Beneath the Landline: A 411 on Telephone Oriented Attack Delivery. Retrieved January 5, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/caught-beneath-landline-411-telephone-oriented-attack-delivery"},{"source_name":"Talos Roblox Scam 2023","description":"Tiago Pereira. (2023, November 2). Attackers use JavaScript URLs, API forms and more to scam users in popular online game “Roblox”. Retrieved January 2, 2024.","url":"https://blog.talosintelligence.com/roblox-scam-overview/"},{"source_name":"proofpoint-selfpwn","description":"Tommy Madjar, Dusty Miller, Selena Larson. (2024, June 17). From Clipboard to Compromise: A PowerShell Self-Pwn. Retrieved August 2, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn"}],"platforms":["Linux","Windows","macOS","IaaS","Containers"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1204.001","id":"T1204.001","name":"Malicious Link","page":"techniques/enterprise/T1204.001/"},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"},{"key":"enterprise/T1204.003","id":"T1204.003","name":"Malicious Image","page":"techniques/enterprise/T1204.003/"},{"key":"enterprise/T1204.004","id":"T1204.004","name":"Malicious Copy and Paste","page":"techniques/enterprise/T1204.004/"},{"key":"enterprise/T1204.005","id":"T1204.005","name":"Malicious Library","page":"techniques/enterprise/T1204.005/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0072","name":"Container Creation","page":"telemetry/DC0072/","kind":"attack_component","category":"Container runtime","description":"Creation of a runtime container object.","collection_focus":"Collect runtime create events and image/container IDs; correlate with API audit to establish the initiating identity.","providers":[{"name":"Docker Engine events","scope":"Daemon lifecycle events for containers and images; collect continuously.","source_id":"docker"},{"name":"Kubernetes API audit","scope":"Control-plane context in Kubernetes, not a replacement for runtime observations.","source_id":"k8s"}],"configuration":["Subscribe to the lab daemon event stream with filters for the relevant object/action; send it to a durable collector.","Record runtime/container ID, image digest, action, timestamp and host. Join orchestrator identities where available.","Use a protected collector connection. Docker socket access is privileged; never expose it publicly or grant it to the website."],"configuration_example":null,"required_fields":["container_id","image_digest","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0072","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","image_digest":"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","action":"create"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Runtime event history is bounded and can be lost without continuous collection. Image tags are mutable; pin digests. A lifecycle event is not a full process or file audit.","sources":[{"id":"docker","title":"Docker engine event stream","url":"https://docs.docker.com/reference/cli/docker/system/events/"},{"id":"k8s","title":"Kubernetes audit policies and backends","url":"https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/"}],"association":"attack_component","anomaly_design":"Per workload image and namespace: rare process starts, unexpected image/privilege changes and new network relationships. Use workload/deployment identity, not short-lived container IDs alone."},{"id":"DC0077","name":"Container Start","page":"telemetry/DC0077/","kind":"attack_component","category":"Container runtime","description":"A runtime container entering the started state.","collection_focus":"Collect runtime start events and join creation, image and later process activity. An orchestrator request alone is insufficient.","providers":[{"name":"Docker Engine events","scope":"Daemon lifecycle events for containers and images; collect continuously.","source_id":"docker"},{"name":"Kubernetes API audit","scope":"Control-plane context in Kubernetes, not a replacement for runtime observations.","source_id":"k8s"}],"configuration":["Subscribe to the lab daemon event stream with filters for the relevant object/action; send it to a durable collector.","Record runtime/container ID, image digest, action, timestamp and host. Join orchestrator identities where available.","Use a protected collector connection. Docker socket access is privileged; never expose it publicly or grant it to the website."],"configuration_example":null,"required_fields":["container_id","action","runtime"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0077","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","action":"start","runtime":"lab-docker"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Runtime event history is bounded and can be lost without continuous collection. Image tags are mutable; pin digests. A lifecycle event is not a full process or file audit.","sources":[{"id":"docker","title":"Docker engine event stream","url":"https://docs.docker.com/reference/cli/docker/system/events/"},{"id":"k8s","title":"Kubernetes audit policies and backends","url":"https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/"}],"association":"attack_component","anomaly_design":"Per workload image and namespace: rare process starts, unexpected image/privilege changes and new network relationships. Use workload/deployment identity, not short-lived container IDs alone."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0076","name":"Instance Creation","page":"telemetry/DC0076/","kind":"attack_component","category":"Cloud control plane","description":"Creation/provisioning of a compute instance.","collection_focus":"Collect launch/create request and completion state, retaining instance ID, image, region and initiating principal.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["instance_id","image_id","action","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0076","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","image_id":"image-lab-1","action":"create","state":"provisioning"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0080","name":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component","category":"Cloud control plane","description":"A request to start a stopped compute instance and its resulting state.","collection_focus":"Collect start APIs and instance-state transitions with request IDs; distinguish accepted from completed.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["instance_id","action","state_before","state_after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1204","id":"T1204","name":"User Execution","domain":"enterprise","platforms":["Linux","Windows","macOS","IaaS","Containers"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"source_url":"https://attack.mitre.org/techniques/T1204","technique_page":"techniques/enterprise/T1204/","page":"detections/enterprise/T1204/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"fa0c05b6-8ad3-468d-8231-c1cbccb64fba","title":"Antivirus Hacktool Detection","status":"stable","level":"high","logsource":{"category":"antivirus"},"data_path":"data/detection-rules/fa0c05b6-8ad3-468d-8231-c1cbccb64fba.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/category/antivirus/av_hacktool.yml","author":"Florian Roth (Nextron Systems), Arnim Rupp","kind":"sigma"},{"id":"234dc5df-40b5-49d1-bf53-0d44ce778eca","title":"Payload Decoded and Decrypted via Built-in Utilities","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/234dc5df-40b5-49d1-bf53-0d44ce778eca.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml","author":"Tim Rauch (rule), Elastic (idea)","kind":"sigma"},{"id":"6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4","title":"Suspicious Execution via macOS Script Editor","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml","author":"Tim Rauch (rule), Elastic (idea)","kind":"sigma"},{"id":"6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e","title":"Suspicious Deno File Written from Remote Source","status":"experimental","level":"low","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_creation_deno.yml","author":"Josh Nickels, Michael Taggart","kind":"sigma"},{"id":"b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e","title":"Suspicious Binaries and Scripts in Public Folder","status":"experimental","level":"high","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_public_folder_extension.yml","author":"The DFIR Report","kind":"sigma"},{"id":"24de4f3b-804c-4165-b442-5a06a2302c7e","title":"Arbitrary Shell Command Execution Via Settingcontent-Ms","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/24de4f3b-804c-4165-b442-5a06a2302c7e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml","author":"Sreeman","kind":"sigma"},{"id":"1412aa78-a24c-4abd-83df-767dfb2c5bbe","title":"Potentially Suspicious WebDAV LNK Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1412aa78-a24c-4abd-83df-767dfb2c5bbe.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml","author":"Micah Babinski","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1204-1","technique_id":"T1204","title":"T1204 User Execution","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#execution","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":61,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L61","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"2bdfe26decd6b0f28a7ad612eacc7768db5d6e73e8d9dada65432d7f93444fb9","validation":"published_concept_not_executable_or_live_validated","logic":"SEQUENCE(file_download_or_attachment_open, process_execution FROM downloaded_file) WITHIN 5m -> ALERT","log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Email Gateway Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#72-email-gateway-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0478","name":"User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)","url":"https://attack.mitre.org/detectionstrategies/DET0478","stix_id":"x-mitre-detection-strategy--70c9f174-2e96-4086-b59c-d2358e434f8e","relationship_id":"relationship--7a3c280c-1116-4197-812a-e233eb1d5a17","description":"","analytics":[{"id":"AN1314","name":"Analytic 1314","guidance":"Cause→effect chain: (1) User-facing app (Office/PDF/archiver/browser) records an open/click or abnormal event, then (2) a downloaded file is created in a user-writable path and/or decompressed, (3) the parent user app spawns a living-off-the-land binary (e.g., powershell/cmd/mshta/rundll32/msiexec/wscript/expand/zip) or installer, and (4) immediate outbound HTTP(S)/DNS/SMB from the same lineage.","url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1314","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlation window (e.g., 15 minutes) from document open to child/egress."},{"field":"HighRiskParents","description":"Apps that should rarely spawn OS utilities (winword.exe, excel.exe, powerpnt.exe, acrord32.exe, chrome/msedge/firefox, 7zFM.exe, winrar.exe, explorer.exe)."},{"field":"HighRiskChildren","description":"LOLBIN list: powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, msiexec.exe, curl.exe, bitsadmin.exe, pcalua.exe, expand.exe, tar.exe."},{"field":"UserPaths","description":"Writable paths to watch: %USERPROFILE%\\Downloads, %TEMP%, %APPDATA%\\*, OneDrive/Teams cache, Office startup folders."},{"field":"EgressAllowList","description":"Corporate update/CDN domains and proxy egress CIDRs to suppress benign updater traffic."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"WinEventLog:Application","channel":"EventCode=1000","platforms":["Windows"],"analytic_id":"AN1314","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1314","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1314","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1314","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1314","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1314","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1314","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1314","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1315","name":"Analytic 1315","guidance":"Cause→effect chain: (1) User app/browser/archiver logs an open/click or abnormal exit, (2) new executable/script/archive extracted into $HOME/Downloads, /tmp, or ~/.cache, (3) parent app spawns shell/interpreter (bash/sh/python/node/curl/wget) or desktop file, and (4) new outbound connection(s) from the child lineage.","url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1315","platforms":["Linux"],"tuning":[{"field":"TimeWindow","description":"5–20 minute correlation window."},{"field":"UserPaths","description":"$HOME/Downloads, /tmp, ~/.cache, ~/.config/autostart, ~/.local/share."},{"field":"HighRiskChildren","description":"bash, sh, zsh, python*, perl, node, curl, wget, xdg-open, kde-open, gio open, unzip/tar extraction leading to exec."},{"field":"PkgUpdaters","description":"Allow-list snap/flatpak/packagekit/apt workers to reduce false positives."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"linux:syslog","channel":"opened document|clicked link|segfault|abnormal termination|sandbox","platforms":["Linux"],"analytic_id":"AN1315","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1315","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open","platforms":["Linux"],"analytic_id":"AN1315","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1315","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0039","component":"File Creation","name":"auditd:SYSCALL","channel":"creat","platforms":["Linux"],"analytic_id":"AN1315","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1315","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"rename,chmod","platforms":["Linux"],"analytic_id":"AN1315","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1315","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1315","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1315","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"new outbound connection from browser/office lineage","platforms":["Linux"],"analytic_id":"AN1315","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1315","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1316","name":"Analytic 1316","guidance":"Cause→effect chain: (1) unified logs show application open/click or crash for Safari/Chrome/Office/Preview/archiver, (2) file write/extraction into ~/Downloads, /private/var/folders/* or ~/Library, (3) parent app spawns osascript/bash/zsh/curl/python or opens a quarantined app with Gatekeeper prompts, (4) network egress from child.","url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1316","platforms":["macOS"],"tuning":[{"field":"TimeWindow","description":"10–30 minute correlation window."},{"field":"HighRiskChildren","description":"osascript, bash, zsh, curl, python, open -a Terminal, installer, tccutil misuse."},{"field":"QuarantineSignals","description":"Flag new apps lacking com.apple.quarantine or with quarantine='0081' (downloaded then auto-opened)."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"macos:unifiedlog","channel":"opened document|clicked link|EXC_BAD_ACCESS|abort|LSQuarantine","platforms":["macOS"],"analytic_id":"AN1316","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1316","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0039","component":"File Creation","name":"fs:fileevents","channel":"create/write/rename in user-writable paths","platforms":["macOS"],"analytic_id":"AN1316","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1316","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:osquery","channel":"exec","platforms":["macOS"],"analytic_id":"AN1316","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1316","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"new outbound connection from exploited lineage","platforms":["macOS"],"analytic_id":"AN1316","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1316","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1317","name":"Analytic 1317","guidance":"Cause→effect chain in CI/dev desktops: (1) user triggers container run/pull after opening a doc/link/script, (2) newly created image/container uses unexpected external registry or entrypoint, (3) container starts and immediately egresses to suspicious destinations.","url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1317","platforms":["Containers"],"tuning":[{"field":"TrustedRegistries","description":"Approved registries/namespaces."},{"field":"AllowedEntrypoints","description":"Expected CMD/ENTRYPOINT for known images."},{"field":"TimeWindow","description":"Correlate user action → docker/podman run within 10 minutes."}],"log_sources":[{"component_id":"DC0072","component":"Container Creation","name":"docker:events","channel":"created,started: new container from untrusted registry or unexpected entrypoint","platforms":["Containers"],"analytic_id":"AN1317","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1317","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0072/"},{"component_id":"DC0077","component":"Container Start","name":"docker:events","channel":"start","platforms":["Containers"],"analytic_id":"AN1317","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1317","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0077/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"container egress to unknown IPs/domains","platforms":["Containers"],"analytic_id":"AN1317","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1317","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1318","name":"Analytic 1318","guidance":"Cause→effect chain in cloud consoles: (1) user clicks link then invokes instance/image creation via API, (2) instance/image originates from external AMI or unknown image, (3) instance immediately egresses or retrieves payloads.","url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1318","platforms":["IaaS"],"tuning":[{"field":"ApprovedImages","description":"AMI/image allow-list with owners."},{"field":"UserContext","description":"High-risk identities (federated, external IdP)."},{"field":"TimeWindow","description":"5–30 minutes from console/API action to network egress."}],"log_sources":[{"component_id":"DC0076","component":"Instance Creation","name":"AWS:CloudTrail","channel":"RunInstances,CreateImage","platforms":["IaaS"],"analytic_id":"AN1318","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1318","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0076/"},{"component_id":"DC0080","component":"Instance Start","name":"AWS:CloudTrail","channel":"StartInstances","platforms":["IaaS"],"analytic_id":"AN1318","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1318","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0080/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"gcp:vpcflow","channel":"first 5m egress to unknown ASNs","platforms":["IaaS"],"analytic_id":"AN1318","source_url":"https://attack.mitre.org/detectionstrategies/DET0478#AN1318","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0072","name":"Container Creation","tag":"Container Creation","page":"telemetry/DC0072/","kind":"attack_component"},{"id":"DC0077","name":"Container Start","tag":"Container Start","page":"telemetry/DC0077/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0076","name":"Instance Creation","tag":"Instance Creation","page":"telemetry/DC0076/","kind":"attack_component"},{"id":"DC0080","name":"Instance Start","tag":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) execution can rely on users directly interacting with malicious LNK files.(Citation: Microsoft RaspberryRobin 2022)","relationship_id":"relationship--a6a6e8e2-c9c2-40b9-b410-ea84b2c43caf","references":[{"source_name":"Microsoft RaspberryRobin 2022","description":"Microsoft Threat Intelligence. (2022, October 27). Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity. Retrieved May 17, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/"}]},{"id":"S1213","name":"Lumma Stealer","url":"https://attack.mitre.org/software/S1213","kind":"malware","description":"[Lumma Stealer](https://attack.mitre.org/software/S1213) has been distributed through a fake CAPTCHA that presents instructions to the victim to open Windows Run window (“Windows Button + R”) and paste clipboard contents (“CTRL + V”) and press “Enter” to execute a Base64-encoded PowerShell.(Citation: Qualys LummaStealer 2024)(Citation: Cybereason LumaStealer Undated)(Citation: Netskope LummaStealer 2025)","relationship_id":"relationship--9b3e3de5-c598-446c-981d-5dc1ca8ab5a9","references":[{"source_name":"Cybereason LumaStealer Undated","description":"Cybereaon Security Services Team. (n.d.). Your Data Is Under New Lummanagement: The Rise of LummaStealer. Retrieved March 22, 2025.","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"},{"source_name":"Netskope LummaStealer 2025","description":"Leandro Fróes, Netskope. (2025, January 23). Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection. Retrieved March 22, 2025.","url":"https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection"},{"source_name":"Qualys LummaStealer 2024","description":"Vishwajeet Kumar, Qualys. (2024, October 20). Unmasking Lumma Stealer: Analyzing Deceptive Tactics with Fake CAPTCHA. Retrieved March 22, 2025.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha"}]}],"actors":[{"id":"G1004","name":"LAPSUS$","url":"https://attack.mitre.org/groups/G1004","kind":"intrusion-set","description":"[LAPSUS$](https://attack.mitre.org/groups/G1004) has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing [LAPSUS$](https://attack.mitre.org/groups/G1004) to take control of an authenticated system.(Citation: MSTIC DEV-0537 Mar 2022)","relationship_id":"relationship--64c83ccd-f074-4ff2-80c9-05d03f8fc9d3","references":[{"source_name":"MSTIC DEV-0537 Mar 2022","description":"MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access.(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--54de26f7-7981-49b8-a353-d342a89552c8","references":[{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.","relationship_id":"relationship--1d1525e6-74f2-447d-ba11-9e9c9c552403","references":[]},{"id":"M1021","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M1021","kind":"course-of-action","description":"If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.","relationship_id":"relationship--66551074-a1e3-439c-a996-c1f7ca8136e2","references":[]},{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.","relationship_id":"relationship--8e567361-e2de-4dc6-b953-ec82dc143f58","references":[]},{"id":"M1033","name":"Limit Software Installation","url":"https://attack.mitre.org/mitigations/M1033","kind":"course-of-action","description":"Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones.","relationship_id":"relationship--a0919108-e327-4429-abc6-d251d78bd3a2","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Application control may be able to prevent the running of executables masquerading as other files.","relationship_id":"relationship--225ab1b4-f800-4a92-9949-a0f05fce6213","references":[]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent executable files from running unless they meet a prevalence, age, or trusted list criteria and to prevent Office applications from creating potentially malicious executable content by blocking malicious code from being written to disk. Note: cloud-delivered protection must be enabled to use certain rules. (Citation: win10_asr)","relationship_id":"relationship--3551c43c-b1b9-432b-8c3a-cf0265ca74ff","references":[{"source_name":"win10_asr","description":"Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1566":"/ttp-simulation/techniques/enterprise/T1566/","T1204":"/ttp-simulation/techniques/enterprise/T1204/","T1534":"/ttp-simulation/techniques/enterprise/T1534/","T1219":"/ttp-simulation/techniques/enterprise/T1219/","T1539":"/ttp-simulation/techniques/enterprise/T1539/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1204","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0072","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","image_digest":"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","action":"create"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0077","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","action":"start","runtime":"lab-docker"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0076","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","image_id":"image-lab-1","action":"create","state":"provisioning"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}