{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1213","id":"T1213","name":"Data from Information Repositories","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1213","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"a64b62daa2dec4616764183fc350955570b7346adc4bea534eddfe96f64982c7","description":"Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., [Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537)). \n\nThe following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:\n\n* Policies, procedures, and standards\n* Physical / logical network diagrams\n* System architecture diagrams\n* Technical system documentation\n* Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) \n* Work / project schedules\n* Source code snippets\n* Links to network shares and other internal resources\n* Contact or other sensitive information about business partners and customers, including personally identifiable information (PII) \n\nInformation stored in a repository may vary based on the specific instance or environment. Specific common information repositories include the following:\n\n* Storage services such as IaaS databases, enterprise databases, and more specialized platforms such as customer relationship management (CRM) databases \n* Collaboration platforms such as SharePoint, Confluence, and code repositories\n* Messaging platforms such as Slack and Microsoft Teams \n\nIn some cases, information repositories have been improperly secured, typically by unintentionally allowing for overly-broad access by all users or even public access to unauthenticated users. This is particularly common with cloud-native or cloud-hosted services, such as AWS Relational Database Service (RDS), Redis, or ElasticSearch.(Citation: Mitiga)(Citation: TrendMicro Exposed Redis 2020)(Citation: Cybernews Reuters Leak 2022)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1213","external_id":"T1213"},{"source_name":"Mitiga","description":"Ariel Szarf, Doron Karmi, and Lionel Saposnik. (n.d.). Oops, I Leaked It Again — How Mitiga Found PII in Exposed Amazon RDS Snapshots. Retrieved September 24, 2024.","url":"https://www.mitiga.io/blog/how-mitiga-found-pii-in-exposed-amazon-rds-snapshots"},{"source_name":"Atlassian Confluence Logging","description":"Atlassian. (2018, January 9). How to Enable User Access Logging. Retrieved April 4, 2018.","url":"https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html"},{"source_name":"TrendMicro Exposed Redis 2020","description":"David Fiser and Jaromir Horejsi. (2020, April 21). Exposed Redis Instances Abused for Remote Code Execution, Cryptocurrency Mining. Retrieved September 25, 2024.","url":"https://www.trendmicro.com/en_us/research/20/d/exposed-redis-instances-abused-for-remote-code-execution-cryptocurrency-mining.html"},{"source_name":"Microsoft SharePoint Logging","description":"Microsoft. (2017, July 19). Configure audit settings for a site collection. Retrieved April 4, 2018.","url":"https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2"},{"source_name":"Sharepoint Sharing Events","description":"Microsoft. (n.d.). Sharepoint Sharing Events. Retrieved October 8, 2021.","url":"https://docs.microsoft.com/en-us/microsoft-365/compliance/use-sharing-auditing?view=o365-worldwide#sharepoint-sharing-events"},{"source_name":"Cybernews Reuters Leak 2022","description":"Vilius Petkauskas . (2022, November 3). Thomson Reuters collected and leaked at least 3TB of sensitive data. Retrieved September 25, 2024.","url":"https://cybernews.com/security/thomson-reuters-leaked-terabytes-sensitive-data/"}],"platforms":["Linux","Windows","macOS","SaaS","IaaS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1213.001","id":"T1213.001","name":"Confluence","page":"techniques/enterprise/T1213.001/"},{"key":"enterprise/T1213.002","id":"T1213.002","name":"Sharepoint","page":"techniques/enterprise/T1213.002/"},{"key":"enterprise/T1213.003","id":"T1213.003","name":"Code Repositories","page":"techniques/enterprise/T1213.003/"},{"key":"enterprise/T1213.004","id":"T1213.004","name":"Customer Relationship Management Software","page":"techniques/enterprise/T1213.004/"},{"key":"enterprise/T1213.005","id":"T1213.005","name":"Messaging Applications","page":"techniques/enterprise/T1213.005/"},{"key":"enterprise/T1213.006","id":"T1213.006","name":"Databases","page":"techniques/enterprise/T1213.006/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0069","name":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a managed cloud service configuration.","collection_focus":"Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["service","resource_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0025","name":"Cloud Storage Access","page":"telemetry/DC0025/","kind":"attack_component","category":"Cloud storage","description":"Access to stored cloud data, including reads and provider-supported access outcomes.","collection_focus":"Explicitly select relevant object-read data events; keep principal, key, request ID and result without object contents.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":{"label":"CloudTrail advanced event selector · example S3 prefix","language":"json","source_id":"data_events","content":"[\n  {\n    \"Name\": \"LabObjectReads\",\n    \"FieldSelectors\": [\n      {\n        \"Field\": \"eventCategory\",\n        \"Equals\": [\n          \"Data\"\n        ]\n      },\n      {\n        \"Field\": \"resources.type\",\n        \"Equals\": [\n          \"AWS::S3::Object\"\n        ]\n      },\n      {\n        \"Field\": \"resources.ARN\",\n        \"StartsWith\": [\n          \"arn:aws:s3:::lab-bucket/demo/\"\n        ]\n      },\n      {\n        \"Field\": \"readOnly\",\n        \"Equals\": [\n          \"true\"\n        ]\n      }\n    ]\n  }\n]","note":"Replace the placeholder with an owned lab bucket/prefix. Review costs and merge with required selectors; applying selectors can replace an existing selection. This does not enable management-event retention or object-write coverage."},"required_fields":["action","bucket","key","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0025","collector":"illustrative-lab-collector","observation":{"action":"get_object","bucket":"lab-bucket","key":"demo.txt","actor":"lab-reader","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0102","name":"Network Share Access","page":"telemetry/DC0102/","kind":"attack_component","category":"Windows and directory audit","description":"Access to a network share or an object through that share.","collection_focus":"Enable Audit File Share / Detailed File Share on the lab file server; correlate share checks with file-system access and requesting host/account.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["share","relative_path","access","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0102","collector":"illustrative-lab-collector","observation":{"share":"\\\\lab-server\\demo","relative_path":"demo.txt","access":"read","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1213","id":"T1213","name":"Data from Information Repositories","domain":"enterprise","platforms":["Linux","Windows","macOS","SaaS","IaaS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1213","technique_page":"techniques/enterprise/T1213/","page":"detections/enterprise/T1213/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"5259cbf2-0a75-48bf-b57a-c54d6fabaef3","title":"Bitbucket User Details Export Attempt Detected","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/5259cbf2-0a75-48bf-b57a-c54d6fabaef3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"87cc6698-3e07-4ba2-9b43-a85a73e151e2","title":"Bitbucket User Permissions Export Attempt","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/87cc6698-3e07-4ba2-9b43-a85a73e151e2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"4fe17521-aef3-4e6a-9d6b-4a7c8de155a8","title":"OpenCanary - GIT Clone Request","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/4fe17521-aef3-4e6a-9d6b-4a7c8de155a8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_git_clone_request.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"3ec9a16d-0b4f-4967-9542-ebf38ceac7dd","title":"OpenCanary - MSSQL Login Attempt Via SQLAuth","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/3ec9a16d-0b4f-4967-9542-ebf38ceac7dd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_mssql_login_sqlauth.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"6e78f90f-0043-4a01-ac41-f97681613a66","title":"OpenCanary - MSSQL Login Attempt Via Windows Authentication","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/6e78f90f-0043-4a01-ac41-f97681613a66.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_mssql_login_winauth.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"e7d79a1b-25ed-4956-bd56-bd344fa8fd06","title":"OpenCanary - MySQL Login Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/e7d79a1b-25ed-4956-bd56-bd344fa8fd06.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_mysql_login_attempt.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"547dfc53-ebf6-4afe-8d2e-793d9574975d","title":"OpenCanary - REDIS Action Command Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/547dfc53-ebf6-4afe-8d2e-793d9574975d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_redis_command.yml","author":"Security Onion Solutions","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1213-1","technique_id":"T1213","title":"T1213 Data from Information Repositories","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#collection","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":155,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L155","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"d3f3afc114f68f279e1214ce6dbce5eaa6c9f5a4a63f01379b3362060b7ecac1","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(repository_reads_or_exports BY actor, 10m) >= threshold OR MATCH(bulk_export_operation) -> ALERT","log_sources":[{"title":"Database Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#86-database-audit-logs"},{"title":"Data Warehouse Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#149-data-warehouse-audit-logs"},{"title":"Application Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#81-application-audit-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0413","name":"Abuse of Information Repositories for Data Collection","url":"https://attack.mitre.org/detectionstrategies/DET0413","stix_id":"x-mitre-detection-strategy--48e8d8b1-0117-48bd-a32d-f4e43b665bf3","relationship_id":"relationship--9f605e91-c94f-48b0-ab9f-1d692649eca5","description":"","analytics":[{"id":"AN1160","name":"Analytic 1160","guidance":"Programmatic or excessive access to file shares, SharePoint, or database repositories by users not typically interacting with them. This includes abnormal access by privileged accounts, enumeration of large numbers of files, or downloads of sensitive content in bursts.","url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1160","platforms":["Windows"],"tuning":[{"field":"UserContext","description":"Privileged users may be excluded if they routinely perform admin actions on SharePoint or file shares."},{"field":"AccessVolumeThreshold","description":"The number of files accessed or pages retrieved in a short window to flag as abnormal."},{"field":"TimeWindow","description":"The time range (e.g., 5 minutes, 1 hour) in which burst access patterns are considered anomalous."}],"log_sources":[{"component_id":"DC0102","component":"Network Share Access","name":"WinEventLog:Security","channel":"EventCode=5145","platforms":["Windows"],"analytic_id":"AN1160","source_url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1160","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0102/"},{"component_id":"DC0025","component":"Cloud Storage Access","name":"m365:unified","channel":"Accessed SharePoint files or pages","platforms":["Windows"],"analytic_id":"AN1160","source_url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1160","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0025/"}]},{"id":"AN1161","name":"Analytic 1161","guidance":"Command-line tools (e.g., curl, rsync, wget, or custom Python scripts) used to scrape documentation systems or internal REST APIs. Unusual access patterns to knowledge base folders or shared team drives.","url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1161","platforms":["Linux"],"tuning":[{"field":"CommandRegex","description":"Regex matching internal doc servers, knowledge base paths, or IP patterns."},{"field":"TimeWindow","description":"Burst access of repositories over a short time window."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"execve of curl, rsync, wget with internal knowledge base or IPs","platforms":["Linux"],"analytic_id":"AN1161","source_url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1161","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"linux:Sysmon","channel":"EventCode=3, 22","platforms":["Linux"],"analytic_id":"AN1161","source_url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1161","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1162","name":"Analytic 1162","guidance":"Abuse of SaaS platforms such as Confluence, GitHub, SharePoint Online, or Slack to access excessive internal documentation or export source code/data. Includes use of tokens or browser automation from unapproved IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1162","platforms":["SaaS"],"tuning":[{"field":"APIUsageThreshold","description":"Number of API calls or files accessed before triggering detection."},{"field":"KnownSafeIPs","description":"Whitelist of internal IPs/users that may be excluded from detection."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"saas:confluence","channel":"access.content","platforms":["SaaS"],"analytic_id":"AN1162","source_url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1162","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0069","component":"Cloud Service Modification","name":"saas:slack","channel":"Exported file or accessed admin API","platforms":["SaaS"],"analytic_id":"AN1162","source_url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1162","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"}]},{"id":"AN1163","name":"Analytic 1163","guidance":"Access of mounted cloud shares or document repositories via browser, terminal, or Finder by users not typically interacting with those resources. Includes script-based enumeration or mass download.","url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1163","platforms":["macOS"],"tuning":[{"field":"AccessedMountPath","description":"Paths to sensitive volumes may differ based on org setup."},{"field":"UserGroup","description":"Expected user groups that typically access shared data."}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"macos:unifiedlog","channel":"access to /Volumes/SharePoint or network mount","platforms":["macOS"],"analytic_id":"AN1163","source_url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1163","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:osquery","channel":"curl, python scripts, rsync with internal share URLs","platforms":["macOS"],"analytic_id":"AN1163","source_url":"https://attack.mitre.org/detectionstrategies/DET0413#AN1163","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"},{"id":"DC0025","name":"Cloud Storage Access","tag":"Cloud Storage Access","page":"telemetry/DC0025/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0102","name":"Network Share Access","tag":"Network Share Access","page":"telemetry/DC0102/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) gathers information from repositories associated with cryptocurrency wallets and the Telegram messaging service.(Citation: Sekoia Raccoon2 2022)","relationship_id":"relationship--77cf946d-eb39-4f49-abd0-a64733ea9538","references":[{"source_name":"Sekoia Raccoon2 2022","description":"Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"}]},{"id":"S1196","name":"Troll Stealer","url":"https://attack.mitre.org/software/S1196","kind":"malware","description":"[Troll Stealer](https://attack.mitre.org/software/S1196) gathers information from the Government Public Key Infrastructure (GPKI) folder, associated with South Korean government public key infrastructure, on infected systems.(Citation: S2W Troll Stealer 2024)(Citation: Symantec Troll Stealer 2024)","relationship_id":"relationship--7d1f1a6a-f2ab-4ee9-9c06-6afeac5d033b","references":[{"source_name":"S2W Troll Stealer 2024","description":"Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source_name":"Symantec Troll Stealer 2024","description":"Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has collected files from various information repositories.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)","relationship_id":"relationship--8d07ed87-6692-4010-8c94-c12cbf3885ca","references":[{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","description":"NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has gathered data from internal service ticketing systems to include credentials.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--63cb5def-6905-45b0-9f14-9958eb39758e","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Develop and publish policies that define acceptable information to be stored in repositories.","relationship_id":"relationship--2ffde834-36f9-463d-93c4-77048f020cf9","references":[]},{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.","relationship_id":"relationship--8b3f2915-ca04-4770-88bb-e6f1314da34d","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.","relationship_id":"relationship--2bd8bb5f-6210-4460-84c4-b7fab86e08a2","references":[]},{"id":"M1041","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M1041","kind":"course-of-action","description":"Encrypt data stored at rest in databases. ","relationship_id":"relationship--f6d679df-1b24-4f80-a50e-96ee86b881e9","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Consider periodic review of accounts and privileges for critical and sensitive repositories. Ensure that repositories such as cloud-hosted databases are not unintentionally exposed to the public, and that security groups assigned to them permit only necessary and authorized hosts.(Citation: AWS DB VPC)","relationship_id":"relationship--eacf09ab-0264-4af8-bfa5-f3be9df47e3f","references":[{"source_name":"AWS DB VPC","description":"AWS. (n.d.). Working with a DB instance in a VPC. Retrieved September 24, 2024.","url":"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html"}]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.  ","relationship_id":"relationship--617db1e2-ad66-46b2-8dfc-02094a861754","references":[]},{"id":"M1060","name":"Out-of-Band Communications Channel","url":"https://attack.mitre.org/mitigations/M1060","kind":"course-of-action","description":"Create plans for leveraging a secure out-of-band communications channel, rather than existing in-network chat applications, in case of a security incident.(Citation: TrustedSec OOB Communications)","relationship_id":"relationship--2e1fb9b9-c5b9-42ca-9a46-afb7b03be48c","references":[{"source_name":"TrustedSec OOB Communications","description":"Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.","url":"https://trustedsec.com/blog/to-oob-or-not-to-oob-why-out-of-band-communications-are-essential-for-incident-response"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1537":"/ttp-simulation/techniques/enterprise/T1537/","T1552":"/ttp-simulation/techniques/enterprise/T1552/","T1213":"/ttp-simulation/techniques/enterprise/T1213/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1213","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0025","collector":"illustrative-lab-collector","observation":{"action":"get_object","bucket":"lab-bucket","key":"demo.txt","actor":"lab-reader","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0102","collector":"illustrative-lab-collector","observation":{"share":"\\\\lab-server\\demo","relative_path":"demo.txt","access":"read","source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}