{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1480","id":"T1480","name":"Execution Guardrails","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1480","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"67b514528aee66ef8ed39dc5f68faa6867e68f909c6f400b6423a46b8d19d73f","description":"Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)\n\nGuardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.\n\nAdversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.(Citation: Trellix-Qakbot)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1480","external_id":"T1480"},{"source_name":"FireEye Outlook Dec 2019","description":"McWhirt, M., Carr, N., Bienstock, D. (2019, December 4). Breaking the Rules: A Tough Outlook for Home Page Attacks (CVE-2017-11774). Retrieved June 23, 2020.","url":"https://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html"},{"source_name":"Trellix-Qakbot","description":"Pham Duy Phuc, John Fokker J.E., Alejandro Houspanossian and Mathanraj Thangaraju. (2023, March 7). Qakbot Evolves to OneNote Malware Distribution. Retrieved June 7, 2024.","url":"https://www.trellix.com/blogs/research/qakbot-evolves-to-onenote-malware-distribution/"},{"source_name":"FireEye Kevin Mandia Guardrails","description":"Shoorbajee, Z. (2018, June 1). Playing nice? FireEye CEO says U.S. malware is more restrained than adversaries'. Retrieved January 17, 2019.","url":"https://www.cyberscoop.com/kevin-mandia-fireeye-u-s-malware-nice/"}],"platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1480.001","id":"T1480.001","name":"Environmental Keying","page":"techniques/enterprise/T1480.001/"},{"key":"enterprise/T1480.002","id":"T1480.002","name":"Mutual Exclusion","page":"techniques/enterprise/T1480.002/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0020","name":"Process Modification","page":"telemetry/DC0020/","kind":"attack_component","category":"Endpoint activity","description":"Observed modification or tampering of a running process.","collection_focus":"Use Sysmon ProcessTampering (25) for supported detections and corroborating EDR/memory evidence; it is not a record of every memory write.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","observation","sensor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0020","collector":"illustrative-lab-collector","observation":{"process_id":4200,"observation":"process_image_changed","sensor":"lab-instrumentation"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."},{"id":"DC0008","name":"WMI Creation","page":"telemetry/DC0008/","kind":"attack_component","category":"Endpoint activity","description":"Creation of WMI objects relevant to event subscriptions or other instrumented WMI activity.","collection_focus":"For permanent subscriptions, collect Sysmon WmiEvent 19–21 and retain filter, consumer and binding information; this is not comprehensive auditing of every WMI operation.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["object_kind","namespace","object_name","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0008","collector":"illustrative-lab-collector","observation":{"object_kind":"event_filter","namespace":"root/subscription","object_name":"LabFilter","action":"create"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1480","id":"T1480","name":"Execution Guardrails","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1480","technique_page":"techniques/enterprise/T1480/","page":"detections/enterprise/T1480/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0562","name":"Multi-Platform Execution Guardrails Environmental Validation Detection Strategy","url":"https://attack.mitre.org/detectionstrategies/DET0562","stix_id":"x-mitre-detection-strategy--99bdd6d6-ebef-40e2-83d2-2f39408c82e3","relationship_id":"relationship--d1b82c9a-003e-4eb2-b34d-d2b2dbbebe19","description":"","analytics":[{"id":"AN1551","name":"Analytic 1551","guidance":"Windows environmental validation behavioral chain: (1) Rapid system discovery reconnaissance through WMI queries, registry enumeration, and network share discovery, (2) Environment-specific artifact collection (hostname, domain, IP addresses, installed software, hardware identifiers), (3) Cryptographic operations or conditional logic based on collected environmental values, (4) Selective payload execution contingent on environmental validation results, (5) Temporal correlation between discovery activities and subsequent execution or network communication","url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","platforms":["Windows"],"tuning":[{"field":"DiscoveryTimeWindow","description":"Maximum time window for correlating multiple discovery activities indicating reconnaissance phase - adjust based on normal system behavior (default: 300 seconds)"},{"field":"DiscoveryActivityThreshold","description":"Minimum number of different discovery techniques within time window to trigger detection - balance between false positives and coverage (default: 4 activities)"},{"field":"CryptographicLibraryWhitelist","description":"Approved cryptographic libraries and modules for legitimate organizational use - maintain based on approved software inventory"},{"field":"WMIQueryComplexityThreshold","description":"Complexity score for WMI queries indicating reconnaissance vs. legitimate administration - tune based on administrative patterns"},{"field":"EnvironmentalArtifactList","description":"Environment-specific values commonly targeted by guardrails (hostnames, domains, network shares) - customize for organizational environment"},{"field":"ExecutionDelayBaseline","description":"Statistical baseline for normal delay between discovery and execution activities - establish through historical analysis"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0002","component":"User Account Authentication","name":"WinEventLog:Security","channel":"EventCode=4648","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"WinEventLog:Security","channel":"EventCode=4624, 4648","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0020","component":"Process Modification","name":"WinEventLog:Sysmon","channel":"EventCode=8","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0020/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"},{"component_id":"DC0008","component":"WMI Creation","name":"WinEventLog:WMI","channel":"EventCode=5857, 5858, 5860, 5861","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0008/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN1551","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1551","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1552","name":"Analytic 1552","guidance":"Linux environmental validation behavioral chain: (1) Intensive system enumeration through command execution (uname, hostname, ifconfig, lsblk, mount), (2) File system reconnaissance targeting specific paths, network configurations, and installed packages, (3) Process and user enumeration to validate target environment characteristics, (4) Conditional script execution or binary activation based on environmental criteria, (5) Network connectivity validation and external IP address resolution for geolocation verification","url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1552","platforms":["Linux"],"tuning":[{"field":"SystemDiscoveryCommandList","description":"Linux commands commonly used for system reconnaissance - customize based on environment-specific discovery patterns"},{"field":"ReconnaissanceBurstThreshold","description":"Number of discovery commands within time window indicating reconnaissance burst - tune based on legitimate administrative activity"},{"field":"EnvironmentalCheckPatterns","description":"File paths and system properties commonly validated by environmental keying - adapt to organizational infrastructure"},{"field":"NetworkDiscoveryBaseline","description":"Normal network discovery activity patterns to distinguish from malicious reconnaissance"},{"field":"ConditionalExecutionIndicators","description":"Script patterns and conditional logic indicating environment-based execution decisions"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1552","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1552","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open","platforms":["Linux"],"analytic_id":"AN1552","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1552","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"openat,connect -k discovery","platforms":["Linux"],"analytic_id":"AN1552","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1552","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0064","component":"Command Execution","name":"auditd:PROCTITLE","channel":"command-line execution patterns for system discovery utilities (uname, hostname, ifconfig, netstat, lsof, ps, mount)","platforms":["Linux"],"analytic_id":"AN1552","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1552","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0002","component":"User Account Authentication","name":"linux:syslog","channel":"authentication and authorization events during environmental validation phase","platforms":["Linux"],"analytic_id":"AN1552","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1552","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN1553","name":"Analytic 1553","guidance":"macOS environmental validation behavioral chain: (1) System profiling through system_profiler, sysctl, and hardware discovery commands, (2) Network interface and configuration enumeration for geolocation and network environment validation, (3) Application installation and version discovery for software environment fingerprinting, (4) Security feature detection (SIP, Gatekeeper, XProtect status), (5) Conditional payload execution based on macOS-specific environmental criteria and System Integrity Protection bypass validation","url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1553","platforms":["macOS"],"tuning":[{"field":"MacOSDiscoveryTools","description":"macOS-specific system discovery utilities commonly used for environmental validation"},{"field":"SecurityFeatureEnumeration","description":"Security features and configurations typically validated by macOS execution guardrails"},{"field":"HardwareFingerprintBaseline","description":"Normal hardware discovery patterns to distinguish from environmental validation attempts"},{"field":"SIPBypassIndicators","description":"Patterns indicating attempts to validate or bypass System Integrity Protection"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process execution events for system discovery utilities (system_profiler, sysctl, networksetup, ioreg) with parameter analysis","platforms":["macOS"],"analytic_id":"AN1553","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1553","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"fs:fileevents","channel":"File system access events with kFSEventStreamEventFlagItemRemoved, kFSEventStreamEventFlagItemRenamed flags for environmental artifact collection (/System/Library, /usr/sbin, plist files)","platforms":["macOS"],"analytic_id":"AN1553","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1553","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1554","name":"Analytic 1554","guidance":"ESXi hypervisor environmental validation behavioral chain: (1) Virtual machine inventory and configuration enumeration through vim-cmd and esxcli commands, (2) Host hardware and network configuration discovery for hypervisor environment validation, (3) Datastore and storage configuration reconnaissance, (4) vCenter connectivity and cluster membership validation, (5) Selective malware deployment based on virtualization infrastructure characteristics and target VM validation","url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1554","platforms":["ESXi"],"tuning":[{"field":"ESXiDiscoveryCommands","description":"ESXi commands commonly used for hypervisor and VM reconnaissance"},{"field":"VMInventoryEnumerationThreshold","description":"Number of VM inventory queries within time window indicating reconnaissance activity"},{"field":"HypervisorEnvironmentBaseline","description":"Normal hypervisor management activity patterns for distinguishing malicious reconnaissance"},{"field":"DatastoreAccessPatterns","description":"Unusual datastore access patterns indicating environmental validation or target selection"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"shell command execution for system discovery (vim-cmd, esxcli, vmware-cmd) targeting VM inventory and host configuration","platforms":["ESXi"],"analytic_id":"AN1554","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1554","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0032","component":"Process Creation","name":"esxi:hostd","channel":"host daemon events related to VM operations and configuration queries during reconnaissance","platforms":["ESXi"],"analytic_id":"AN1554","source_url":"https://attack.mitre.org/detectionstrategies/DET0562#AN1554","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0020","name":"Process Modification","tag":"Process Modification","page":"telemetry/DC0020/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"},{"id":"DC0008","name":"WMI Creation","tag":"WMI Creation","page":"telemetry/DC0008/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S9003","name":"evilginx2","page":"tools/S9003/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S9003","name":"evilginx2","page":"tools/S9003/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0504","name":"Anchor","url":"https://attack.mitre.org/software/S0504","kind":"malware","description":"[Anchor](https://attack.mitre.org/software/S0504) can terminate itself if specific execution flags are not present.(Citation: Cyberreason Anchor December 2019)","relationship_id":"relationship--1a1e8bdb-bcb5-41ec-a151-c2f5ebc90ab2","references":[{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}]},{"id":"S0562","name":"SUNSPOT","url":"https://attack.mitre.org/software/S0562","kind":"malware","description":"[SUNSPOT](https://attack.mitre.org/software/S0562) only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.(Citation: CrowdStrike SUNSPOT Implant January 2021) ","relationship_id":"relationship--70d81631-4f33-4fd0-98ac-15b57b8c1ed1","references":[{"source_name":"CrowdStrike SUNSPOT Implant January 2021","description":"CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"}]},{"id":"S0570","name":"BitPaymer","url":"https://attack.mitre.org/software/S0570","kind":"malware","description":"[BitPaymer](https://attack.mitre.org/software/S0570) compares file names and paths to a list of excluded names and directory names during encryption.(Citation: Crowdstrike Indrik November 2018)","relationship_id":"relationship--1cc1c2b0-5fb8-420e-8285-db4616a9fab2","references":[{"source_name":"Crowdstrike Indrik November 2018","description":"Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--6a92b1de-a2f2-4e68-aabc-a5568614f18c","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0634","name":"EnvyScout","url":"https://attack.mitre.org/software/S0634","kind":"malware","description":"[EnvyScout](https://attack.mitre.org/software/S0634) can call <code>window.location.pathname</code> to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--27fd8291-3fba-49e9-a2e0-d3a76a584471","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0635","name":"BoomBox","url":"https://attack.mitre.org/software/S0635","kind":"malware","description":"[BoomBox](https://attack.mitre.org/software/S0635) can check its current working directory and for the presence of a specific file and terminate if specific values are not found.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--8ece1131-5221-498b-9370-30b3b459203e","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0636","name":"VaporRage","url":"https://attack.mitre.org/software/S0636","kind":"malware","description":"[VaporRage](https://attack.mitre.org/software/S0636) has the ability to check for the presence of a specific DLL and terminate if it is not found.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--25e7301f-2207-4d02-aa69-772c222dab70","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0637","name":"NativeZone","url":"https://attack.mitre.org/software/S0637","kind":"malware","description":"[NativeZone](https://attack.mitre.org/software/S0637) can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.(Citation: MSTIC Nobelium Toolset May 2021)(Citation: SentinelOne NobleBaron June 2021)","relationship_id":"relationship--b704b2b0-50c5-4fba-ab6c-db346b3524c7","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"},{"source_name":"SentinelOne NobleBaron June 2021","description":"Guerrero-Saade, J. (2021, June 1). NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks. Retrieved August 4, 2021.","url":"https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"}]},{"id":"S0678","name":"Torisma","url":"https://attack.mitre.org/software/S0678","kind":"malware","description":"[Torisma](https://attack.mitre.org/software/S0678) is only delivered to a compromised host if the victim's IP address is on an allow-list.(Citation: McAfee Lazarus Nov 2020)","relationship_id":"relationship--37599333-0974-4442-976e-6f8d8c3ceac7","references":[{"source_name":"McAfee Lazarus Nov 2020","description":"Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"}]},{"id":"S1035","name":"Small Sieve","url":"https://attack.mitre.org/software/S1035","kind":"malware","description":"[Small Sieve](https://attack.mitre.org/software/S1035) can only execute correctly if the word `Platypus` is passed to it on the command line.(Citation: NCSC GCHQ Small Sieve Jan 2022)","relationship_id":"relationship--3790f831-7228-4de1-9272-3d304dd7328c","references":[{"source_name":"NCSC GCHQ Small Sieve Jan 2022","description":"NCSC GCHQ. (2022, January 27). Small Sieve Malware Analysis Report. Retrieved August 22, 2022.","url":"https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf"}]},{"id":"S1052","name":"DEADEYE","url":"https://attack.mitre.org/software/S1052","kind":"malware","description":"[DEADEYE](https://attack.mitre.org/software/S1052) can ensure it executes only on intended systems by identifying the victim's volume serial number, hostname, and/or DNS domain.(Citation: Mandiant APT41)","relationship_id":"relationship--03cb8f9a-7ad7-4aa8-966f-bf768023eb89","references":[{"source_name":"Mandiant APT41","description":"Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) uses per-victim links for hosting malicious archives, such as ZIP files, in services such as SharePoint to prevent other entities from retrieving them.(Citation: Trellix Darkgate 2023)","relationship_id":"relationship--1eafa58c-6247-4a4f-ba06-39e39f4da806","references":[{"source_name":"Trellix Darkgate 2023","description":"Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) will check for the presence of several security products on victim machines and will avoid UAC bypass mechanisms if they are identified.(Citation: TrendMicro RaspberryRobin 2022) [Raspberry Robin](https://attack.mitre.org/software/S1130) can use specific cookie values in HTTP requests to command and control infrastructure to validate that requests for second stage payloads originate from the initial downloader script.(Citation: HP RaspberryRobin 2024)","relationship_id":"relationship--23b1bbb5-ab75-42f7-8bc9-d1c918f6817d","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"},{"source_name":"HP RaspberryRobin 2024","description":"Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024.","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}]},{"id":"S1133","name":"Apostle","url":"https://attack.mitre.org/software/S1133","kind":"malware","description":"[Apostle](https://attack.mitre.org/software/S1133)'s ransomware variant requires that a base64-encoded argument is passed when executed, that is used as the Public Key for subsequent encryption operations. If [Apostle](https://attack.mitre.org/software/S1133) is executed without this argument, it automatically runs a self-delete function.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--7313a6d7-fb8f-4254-8de2-fd42da02dd6a","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1143","name":"LunarLoader","url":"https://attack.mitre.org/software/S1143","kind":"malware","description":"[LunarLoader](https://attack.mitre.org/software/S1143) can use the DNS domain name of a compromised host to create a decryption key to ensure a malicious payload can only execute against the intended targets.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--79a92839-53b3-4ff2-90f4-8f9630b2da93","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can execute a task which leads to execution if it finds a process name containing “creensaver.”(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--089cfcb7-2e3b-43f2-8e63-5e42fcbdcf06","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1150","name":"ROADSWEEP","url":"https://attack.mitre.org/software/S1150","kind":"malware","description":"[ROADSWEEP](https://attack.mitre.org/software/S1150) requires four command line arguments to execute correctly, otherwise it will produce a message box and halt execution.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)\n","relationship_id":"relationship--c29450bf-20a4-47f8-8ef9-7c6559cfad75","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","description":"CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"},{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"},{"source_name":"Microsoft Albanian Government Attacks September 2022","description":"MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"}]},{"id":"S1161","name":"BPFDoor","url":"https://attack.mitre.org/software/S1161","kind":"malware","description":"[BPFDoor](https://attack.mitre.org/software/S1161) creates a zero byte PID file at `/var/run/haldrund.pid`. [BPFDoor](https://attack.mitre.org/software/S1161) uses this file to determine if it is already running on a system to ensure only one instance is executing at a time.(Citation: Sandfly BPFDoor 2022) ","relationship_id":"relationship--1d2b2827-7289-487a-9ea5-b1245ea7448a","references":[{"source_name":"Sandfly BPFDoor 2022","description":"The Sandfly Security Team. (2022, May 11). BPFDoor - An Evasive Linux Backdoor Technical Analysis. Retrieved September 29, 2023.","url":"https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) will exit its \"main\" function if the victim domain name does not match provided criteria.(Citation: Splunk ShrinkLocker 2024)","relationship_id":"relationship--dacadb45-10fd-4f34-b6fe-f63047a3346e","references":[{"source_name":"Splunk ShrinkLocker 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}]},{"id":"S1179","name":"Exbyte","url":"https://attack.mitre.org/software/S1179","kind":"malware","description":"[Exbyte](https://attack.mitre.org/software/S1179) checks for the presence of a configuration file before completing execution.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--0747ca0c-ff34-4364-bb17-765054d06533","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) creates a mutex value with a hard-coded name, and terminates if that mutex already exists on the victim system. [BlackByte Ransomware](https://attack.mitre.org/software/S1180) checks the system language to see if it matches one of a list of hard-coded values; if a match is found, the malware will terminate.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--cbad7487-ad0d-4165-9fd2-3c3121021457","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1183","name":"StrelaStealer","url":"https://attack.mitre.org/software/S1183","kind":"malware","description":"[StrelaStealer](https://attack.mitre.org/software/S1183) variants only execute if the keyboard layout or language matches a set list of variables.(Citation: Fortgale StrelaStealer 2023)(Citation: IBM StrelaStealer 2024)","relationship_id":"relationship--38640ec4-060f-47ea-8ea5-58e42f5e8341","references":[{"source_name":"Fortgale StrelaStealer 2023","description":"Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.","url":"https://fortgale.com/blog/malware-analysis/strelastealer-malware-analysis-2/"},{"source_name":"IBM StrelaStealer 2024","description":"Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.","url":"https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"}]},{"id":"S1184","name":"BOLDMOVE","url":"https://attack.mitre.org/software/S1184","kind":"malware","description":"[BOLDMOVE](https://attack.mitre.org/software/S1184) verifies it is executing from a specific path during execution.(Citation: Google Cloud BOLDMOVE 2023)","relationship_id":"relationship--e2a0910e-16a9-493e-8c0e-d5557e77e3b0","references":[{"source_name":"Google Cloud BOLDMOVE 2023","description":"Scott Henderson, Cristiana Kittner, Sarah Hawley & Mark Lechtik, Google Cloud. (2023, January 19). Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475). Retrieved December 31, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"On macOS, [LightSpy](https://attack.mitre.org/software/S1185) checks the existence of a process identification number (PID) file, `/Users/Shared/irc.pid`, to verify if [LightSpy](https://attack.mitre.org/software/S1185) is currently running.(Citation: Huntress LightSpy macOS 2024)","relationship_id":"relationship--299f512d-5afc-44b0-b4c1-9cda96306166","references":[{"source_name":"Huntress LightSpy macOS 2024","description":"Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025.","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}]},{"id":"S1194","name":"Akira _v2","url":"https://attack.mitre.org/software/S1194","kind":"malware","description":"[Akira _v2](https://attack.mitre.org/software/S1194) will fail to execute if the targeted `/vmfs/volumes/` path does not exist or is not defined.(Citation: Cisco Akira Ransomware OCT 2024)","relationship_id":"relationship--fd4c608f-ebfc-4c17-947d-f79e854b4bb1","references":[{"source_name":"Cisco Akira Ransomware OCT 2024","description":"Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) will not execute on hosts where the system language is set to a language spoken in the Commonwealth of Independent States region.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Palo Alto Lockbit 2.0 JUN 2022)","relationship_id":"relationship--ad02f6c8-9b1c-4d94-b6fd-fb953b9f8048","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","description":"Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"},{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) will execute an empty infinite loop if it detects it is being run in the context of a debugger.(Citation: Cybereason StealBit Exfiltration Tool)","relationship_id":"relationship--99174f3b-8c31-4d4d-b803-0a6bff16e859","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can make execution dependent on specific parameters including a unique passphrase and the system language of the targeted host not being found on a set exclusion list. (Citation: Joint Cybersecurity Advisory LockBit JUN 2023)(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)","relationship_id":"relationship--53ae49f4-6cc4-4fb0-b79e-84af1aa136eb","references":[{"source_name":"Joint Cybersecurity Advisory LockBit JUN 2023","description":"CISA et al. (2023, June 14). UNDERSTANDING RANSOMWARE THREAT ACTORS: LOCKBIT. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf"},{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"},{"source_name":"Sentinel Labs LockBit 3.0 JUL 2022","description":"Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025.","url":"https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"}]},{"id":"S1210","name":"Sagerunex","url":"https://attack.mitre.org/software/S1210","kind":"malware","description":"[Sagerunex](https://attack.mitre.org/software/S1210) uses a \"servicemain\" function to verify its environment to ensure it can only be executed as a service, as well as the existence of a configuration file in a specified directory.(Citation: Cisco LotusBlossom 2025)","relationship_id":"relationship--dc35293c-815c-467e-bdd4-8ee0e5fdd644","references":[{"source_name":"Cisco LotusBlossom 2025","description":"Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) will terminate without proceeding to encryption if the infected machine is on a list of allowlisted machines specified in its configuration.(Citation: Group-IB RansomHub FEB 2025)","relationship_id":"relationship--1546211f-fc4f-416a-9e79-43310b09bc51","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has an exception handler that executes when ESET antivirus applications `ekrn.exe` and `egui.exe` are not found and directly injects its code into waitfor.exe using Native Windows API including `WriteProcessMemory` and `CreateRemoteThreadEx`.(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025)","relationship_id":"relationship--0bd24ac6-08f1-441b-bb55-777e20799b17","references":[{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","description":"Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) has built in settings to not operate based on geolocation or country of the victim host.(Citation: ESET RedLine Stealer November 2024)(Citation: Proofpoint RedLine Stealer March 2020)","relationship_id":"relationship--b6455e96-9b28-4749-8b76-220f27ac4ee8","references":[{"source_name":"ESET RedLine Stealer November 2024","description":"Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/life-crooked-redline-analyzing-infamous-infostealers-backend/"},{"source_name":"Proofpoint RedLine Stealer March 2020","description":"Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.","url":"https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can require a specific password to be passed by command-line argument during execution which must match a pre-defined value in the configuration in order for it to continue execution.(Citation: Picus Qilin MAR 2025)(Citation: Trend Micro Agenda Ransomware OCT 2025)","relationship_id":"relationship--5c39581b-cf62-4b14-bce2-9efbcf46440b","references":[{"source_name":"Picus Qilin MAR 2025","description":"Hacioglu, S. (2025, March 10). Qilin Ransomware: Exposing the TTPs Behind One of the Most Active Ransomware Campaigns of 2024. Retrieved September 26, 2025.","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"},{"source_name":"Trend Micro Agenda Ransomware OCT 2025","description":"Trend Micro. (2025, October 23). Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques. Retrieved March 26, 2026.","url":"https://www.trendmicro.com/en_us/research/25/j/agenda-ransomware-deploys-linux-variant-on-windows-systems.html"}]},{"id":"S9001","name":"SystemBC","url":"https://attack.mitre.org/software/S9001","kind":"malware","description":"[SystemBC](https://attack.mitre.org/software/S9001) has checked if the last characters of DNS server names end in .bit before initializing C2 communication.(Citation: HarmonProofpoint_SystemBC_Aug2019) [SystemBC](https://attack.mitre.org/software/S9001) has identified running processes associated with anti-virus solutions to include `a2guard.exe` to determine whether it executes or not.(Citation: SophosGnGal_SystemBC_Dec2020)  ","relationship_id":"relationship--69e823be-ab39-44c1-b56f-b371a2a0118b","references":[{"source_name":"SophosGnGal_SystemBC_Dec2020","description":"Gallagher, S., Gn, S. (2020, December 16). Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor. Retrieved May 16, 2025.","url":"https://news.sophos.com/en-us/2020/12/16/systembc/"},{"source_name":"HarmonProofpoint_SystemBC_Aug2019","description":"Harmon, K., et al. (2019, August 1). SystemBC is like Christmas in July for SOCKS5 Malware and Exploit Kits . Retrieved June 13, 2025.","url":"https://www.proofpoint.com/us/threat-insight/post/systembc-christmas-july-socks5-malware-and-exploit-kits"}]},{"id":"S9003","name":"evilginx2","url":"https://attack.mitre.org/software/S9003","kind":"tool","description":"[evilginx2](https://attack.mitre.org/software/S9003) can reject requests to phishing URLs if the User-Agent of the visitor doesn't match the allowlist REGEX filter for a specific lure.(Citation: Breakdev Evilginx 2.4 SEP 2020)","relationship_id":"relationship--3a749db3-cabf-4849-a9e4-a7ba21bfbd1f","references":[{"source_name":"Breakdev Evilginx 2.4 SEP 2020","description":"Gretzky, K. (2020, September 14). Evilginx 2.4 - Gone Phishing. Retrieved January 27, 2026.","url":"https://breakdev.org/evilginx-2-4-gone-phishing/"}]},{"id":"S9010","name":"GlassWorm","url":"https://attack.mitre.org/software/S9010","kind":"malware","description":"[GlassWorm](https://attack.mitre.org/software/S9010) has utilized logic to avoid executing on Russian based devices.(Citation: Socket GlassWorm January 2026)","relationship_id":"relationship--19f69da1-f2c1-4228-867b-e0d07a123681","references":[{"source_name":"Socket GlassWorm January 2026","description":"Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}]},{"id":"S9019","name":"PureCrypter","url":"https://attack.mitre.org/software/S9019","kind":"malware","description":"[PureCrypter](https://attack.mitre.org/software/S9019) code contains an ExclusionRegionNames option where it can compare the results of `kernel32!GetGeoInfo` with a list of regions.(Citation: Zscaler PureCrypter JUN 2022)","relationship_id":"relationship--8801b2f6-2f8d-4e75-aecf-6432695c969f","references":[{"source_name":"Zscaler PureCrypter JUN 2022","description":"Dumont, R. (2022, June 13). Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) can halt execution if the “en_US” locale is identified on a victim's machine.(Citation: Kaspersky LODEINFO Part II OCT 2022)","relationship_id":"relationship--3ba83641-d086-4a15-8465-33d8caa98c6a","references":[{"source_name":"Kaspersky LODEINFO Part II OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) can check for the presence of specific analysis tools and will terminate itself if they are found.(Citation: Trend Micro Earth Kasha NOV 2024)","relationship_id":"relationship--f45b0144-2b01-4e99-aff5-538cab3670d0","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"S9026","name":"ROAMINGHOUSE","url":"https://attack.mitre.org/software/S9026","kind":"malware","description":"[ROAMINGHOUSE](https://attack.mitre.org/software/S9026) can change its execution method to create a batch file in the startup folder that executes a legitimate executable if a McAfee product is detected.(Citation: Trend Micro Earth Kasha Updates APR 2025)","relationship_id":"relationship--90a3bf9a-3edd-4a86-ab53-6fda02c6d375","references":[{"source_name":"Trend Micro Earth Kasha Updates APR 2025","description":"Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}]},{"id":"S9034","name":"Tsundere Botnet","url":"https://attack.mitre.org/software/S9034","kind":"malware","description":"[Tsundere Botnet](https://attack.mitre.org/software/S9034) has checked the victim machine’s location to avoid infecting in the Commonwealth of Independent States (CIS) region.(Citation: SecureListUbiedo_Tsundere_Nov2025) ","relationship_id":"relationship--0e7e92e6-2163-44cb-b8c5-420577aeada7","references":[{"source_name":"SecureListUbiedo_Tsundere_Nov2025","description":"Ubiedo, L. (2025, November 20). Blockchain and Node.js abused by Tsundere: an emerging botnet. Retrieved April 6, 2026.","url":"https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"}]},{"id":"S9039","name":"LazyWiper","url":"https://attack.mitre.org/software/S9039","kind":"malware","description":"[LazyWiper](https://attack.mitre.org/software/S9039) can halt execution if `[System.Net.Dns]::GetHostName()` or `$env:COMPUTERNAME` contains `“pe-dc”`.(Citation: CERT Polska)","relationship_id":"relationship--4cee562b-14d6-45b3-8409-7009be02cb82","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) has checked if it is running on a developer machine (rather than GitHub Actions) before executing a Python script for persistence. The script has also polled C2 every 50 minutes for additional payloads and aborted if the returned value contained YouTube.(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Wiz TeamPCP KICS MAR 2026) ","relationship_id":"relationship--f2da1e7c-d5c2-4f1b-b58a-3650c758858a","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Wiz TeamPCP KICS MAR 2026","description":"McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) can base execution on specific conditions including halting its wiper component if Kubernetes is not found and if the target is not located in Iran.(Citation: Aikido CanisterWorm MAR 2026)","relationship_id":"relationship--7dd9023d-73df-4fb3-a8b3-0e44564d3b92","references":[{"source_name":"Aikido CanisterWorm MAR 2026","description":"Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has utilized execution guardrails in order to prevent operating in restricted geolocations to include Russia by checking the devices language and terminating when a forbidden value is detected.(Citation: Wiz Mini Shai-Hulud MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026) [Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has also utilized designated instructions that execute when victim hosts match geolocations to include wiping victim devices when the device is determined to be located within Iran or Israel.(Citation: Hunt.io TeamPCP Toolkit MAY 2026)","relationship_id":"relationship--e9d29d73-6a2e-4b06-81e0-4dd29467711b","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source_name":"Wiz Mini Shai-Hulud MAY 2026","description":"McCarthy, R., Cohen, A., and Read, B. (2026, May 12). Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised. Retrieved July 16, 2026.","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source_name":"Phoenix TeamPCP 20 MAY 2026","description":"Webb, M. (2026, May 20). TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated. Retrieved July 16, 2026.","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"If a debugger or analysis environment is detected, [Vidar](https://attack.mitre.org/software/S9050) has triggered a memory access violation exception, terminating its process by calling `RtlExitUserProcess`.(Citation: Cyfirma_Vidar_June2024)","relationship_id":"relationship--044701e4-2c5c-4574-8ac7-1d9034dff4d6","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"}]}],"actors":[{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has used geoblocking to limit downloads of the malicious file to specific geographic locations.(Citation: unit42_gamaredon_dec2022)(Citation: VenereCiscoTalos_Gamaredon_Mar2025)","relationship_id":"relationship--f523a64f-7c27-4c23-a35d-c56b4bcce8be","references":[{"source_name":"unit42_gamaredon_dec2022","description":"Unit 42. (2022, December 20). Russia’s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine. Retrieved September 12, 2024.","url":"https://unit42.paloaltonetworks.com/trident-ursa/"},{"source_name":"VenereCiscoTalos_Gamaredon_Mar2025","description":"Venere, G. (2025, March 28). Gamaredon campaign abuses LNK files to distribute Remcos backdoor. Retrieved July 23, 2025.","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has leveraged file discovery actions to determine if a predetermined file is present prior to execution to prevent redundant execution on a compromised device.(Citation: Microsoft Sapphire Sleet APR 2026)","relationship_id":"relationship--72654ee9-cf29-49a0-b53c-87de0d9e868d","references":[{"source_name":"Microsoft Sapphire Sleet APR 2026","description":"Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"}]},{"id":"G0099","name":"APT-C-36","url":"https://attack.mitre.org/groups/G0099","kind":"intrusion-set","description":"[APT-C-36](https://attack.mitre.org/groups/G0099) has used geolocation filtering in malware delivery to redirect traffic not coming from a targeted region or country, such as Ecuador or Colombia, to legitimate sites.(Citation: Kaspersky BlindEagle AUG 2024)(Citation: Recorded Future TAG-144 AUG 2025)\n","relationship_id":"relationship--abff6712-78bf-4a73-a950-0547442ff301","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","description":"Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"Recorded Future TAG-144 AUG 2025","description":"Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics.(Citation: Picus BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) has used ransomware variants requiring a key passed on the command line for the malware to execute.(Citation: Cisco BlackByte 2024)","relationship_id":"relationship--dc906a37-e2f5-4e8f-8f3c-317ad667d484","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Cisco BlackByte 2024","description":"James Nutland, Craig Jackson, Terryn Valikodath, & Brennan Evans. (2024, August 28). BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks. Retrieved December 16, 2024.","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) has configured C2 endpoints to review IP geolocation, request headers, victim environment details and runtime conditions prior to delivering payloads.(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)","relationship_id":"relationship--d579ce62-ba0b-4637-9237-d5dc92c32922","references":[{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]}],"mitigations":[{"id":"M1055","name":"Do Not Mitigate","url":"https://attack.mitre.org/mitigations/M1055","kind":"course-of-action","description":"[Execution Guardrails](https://attack.mitre.org/techniques/T1480) likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.","relationship_id":"relationship--20cc9dc5-61ad-4fbb-86da-4861e60b98e4","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1497":"/ttp-simulation/techniques/enterprise/T1497/","T1480":"/ttp-simulation/techniques/enterprise/T1480/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1480","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0020","collector":"illustrative-lab-collector","observation":{"process_id":4200,"observation":"process_image_changed","sensor":"lab-instrumentation"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0008","collector":"illustrative-lab-collector","observation":{"object_kind":"event_filter","namespace":"root/subscription","object_name":"LabFilter","action":"create"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}