{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1495","id":"T1495","name":"Firmware Corruption","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1495","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"8229e1c32178bae7adb544d25486223ebc86382de7f39e3e57a96f8f6f970237","description":"Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.\n\nIn general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices. For example, corruption of firmware responsible for loading the operating system for network devices may render the network devices inoperable.(Citation: dhs_threat_to_net_devices)(Citation: cisa_malware_orgs_ukraine) Depending on the device, this attack may also result in [Data Destruction](https://attack.mitre.org/techniques/T1485). ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1495","external_id":"T1495"},{"source_name":"cisa_malware_orgs_ukraine","description":"CISA. (2022, April 28). Alert (AA22-057A) Update: Destructive Malware Targeting Organizations in Ukraine. Retrieved July 29, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-057a"},{"source_name":"dhs_threat_to_net_devices","description":"U.S. Department of Homeland Security. (2016, August 30). The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations. Retrieved July 29, 2022.","url":"https://cyber.dhs.gov/assets/report/ar-16-20173.pdf"},{"source_name":"MITRE Trustworthy Firmware Measurement","description":"Upham, K. (2014, March). Going Deep into the BIOS with MITRE Firmware Security Research. Retrieved January 5, 2016.","url":"http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research"},{"source_name":"Symantec Chernobyl W95.CIH","description":"Yamamura, M. (2002, April 25). W95.CIH. Retrieved April 12, 2019.","url":"https://web.archive.org/web/20190508170055/https://www.symantec.com/security-center/writeup/2000-122010-2655-99"}],"platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0079","name":"Driver Load","page":"telemetry/DC0079/","kind":"attack_component","category":"Endpoint activity","description":"Loading of a driver into the running OS.","collection_focus":"Collect Sysmon DriverLoad (6) and retain image path, hash and signature result; distinguish load from file installation.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["driver_path","action","signature_status"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0079","collector":"illustrative-lab-collector","observation":{"driver_path":"C:\\Lab\\demo.sys","action":"load","signature_status":"lab_fixture_only"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0004","name":"Firmware Modification","page":"telemetry/DC0004/","kind":"attack_component","category":"Host state and inventory","description":"Changes to firmware state or a firmware update observation on a device.","collection_focus":"Collect approved OEM firmware inventory/update audit and compare version or measured hashes against a known baseline. Use read-only vendor-supported interfaces.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","firmware_before","firmware_after","change_ticket"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0004","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-device-1","firmware_before":"1.0-lab","firmware_after":"1.1-lab","change_ticket":"LAB-42"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1495","id":"T1495","name":"Firmware Corruption","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T1495","technique_page":"techniques/enterprise/T1495/","page":"detections/enterprise/T1495/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"d94a35f0-7a29-45f6-90a0-80df6159967c","title":"Cisco Denial of Service","status":"test","level":"medium","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/d94a35f0-7a29-45f6-90a0-80df6159967c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_dos.yml","author":"Austin Clark","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0167","name":"Firmware Modification via Flash Tool or Corrupted Firmware Upload","url":"https://attack.mitre.org/detectionstrategies/DET0167","stix_id":"x-mitre-detection-strategy--ab9027fb-3499-474b-845c-50ee113c3be5","relationship_id":"relationship--6279c298-4e08-4cef-89e1-5f90acb2e78e","description":"","analytics":[{"id":"AN0474","name":"Analytic 0474","guidance":"Firmware flash utility invoked with elevated privileges followed by raw access to firmware device path or changes to boot configuration.","url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0474","platforms":["Windows"],"tuning":[{"field":"ParentImage","description":"Common legitimate flash tool chains can be allowlisted"},{"field":"CommandLine","description":"Flags indicating silent or forced flash may vary"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0474","source_url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0474","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0079","component":"Driver Load","name":"WinEventLog:Sysmon","channel":"EventCode=6","platforms":["Windows"],"analytic_id":"AN0474","source_url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0474","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0079/"},{"component_id":"DC0004","component":"Firmware Modification","name":"WinEventLog:Microsoft-Windows-Kernel-Boot","channel":"Firmware integrity validation failed or boot configuration tampered","platforms":["Windows"],"analytic_id":"AN0474","source_url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0474","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0004/"}]},{"id":"AN0475","name":"Analytic 0475","guidance":"Direct write access to /dev/mem or /sys/firmware combined with usage of firmware flashing utilities (e.g., flashrom).","url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0475","platforms":["Linux"],"tuning":[{"field":"ToolName","description":"Custom or renamed firmware tools may require pattern matching"}],"log_sources":[{"component_id":"DC0004","component":"Firmware Modification","name":"auditd:SYSCALL","channel":"write access to /dev/mem or /sys/firmware/efi/efivars","platforms":["Linux"],"analytic_id":"AN0475","source_url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0475","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0004/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execution of known flash tools (e.g., flashrom, fwupd)","platforms":["Linux"],"analytic_id":"AN0475","source_url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0475","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0476","name":"Analytic 0476","guidance":"EFI updates executed via system processes or binaries outside of expected patch windows or using unsigned firmware packages.","url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0476","platforms":["macOS"],"tuning":[{"field":"UpdateTimeWindow","description":"Firmware updates usually occur after OS update; out-of-band patterns may indicate compromise"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"com.apple.firmwareupdater activity or update-firmware binary invoked","platforms":["macOS"],"analytic_id":"AN0476","source_url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0476","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0004","component":"Firmware Modification","name":"macos:unifiedlog","channel":"boot failure events or SMC validation errors","platforms":["macOS"],"analytic_id":"AN0476","source_url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0476","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0004/"}]},{"id":"AN0477","name":"Analytic 0477","guidance":"Firmware image uploaded via TFTP/SCP or web interface followed by reboot or unexpected loss of connectivity.","url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0477","platforms":["Network Devices"],"tuning":[{"field":"UploadSizeThreshold","description":"Size of firmware images varies by vendor"},{"field":"RebootWindow","description":"Reboots outside of patch maintenance may be suspicious"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"large upload to firmware interface port or path","platforms":["Network Devices"],"analytic_id":"AN0477","source_url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0477","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0004","component":"Firmware Modification","name":"networkdevice:firmware","channel":"Firmware update initiated or bootloader tampering detected","platforms":["Network Devices"],"analytic_id":"AN0477","source_url":"https://attack.mitre.org/detectionstrategies/DET0167#AN0477","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0004/"}]}]}],"telemetry_references":[{"id":"DC0079","name":"Driver Load","tag":"Driver Load","page":"telemetry/DC0079/","kind":"attack_component"},{"id":"DC0004","name":"Firmware Modification","tag":"Firmware Modification","page":"telemetry/DC0004/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) module \"Trickboot\" can write or erase the UEFI/BIOS firmware of a compromised device.(Citation: Eclypsium Trickboot December 2020)","relationship_id":"relationship--acece0c4-4c9e-4c11-a57a-f01bb23abbf7","references":[{"source_name":"Eclypsium Trickboot December 2020","description":"Eclypsium, Advanced Intelligence. (2020, December 1). TRICKBOT NOW OFFERS ‘TRICKBOOT’: PERSIST, BRICK, PROFIT. Retrieved March 15, 2021.","url":"https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf"}]},{"id":"S0606","name":"Bad Rabbit","url":"https://attack.mitre.org/software/S0606","kind":"malware","description":"[Bad Rabbit](https://attack.mitre.org/software/S0606) has used an executable that installs a modified bootloader to prevent normal boot-up.(Citation: Secure List Bad Rabbit)","relationship_id":"relationship--2374acc8-5a15-40cb-bafc-d74c5097249b","references":[{"source_name":"Secure List Bad Rabbit","description":"Mamedov, O. Sinitsyn, F.  Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021.","url":"https://securelist.com/bad-rabbit-ransomware/82851/"}]}],"actors":[],"mitigations":[{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Prevent adversary access to privileged accounts or access necessary to replace system firmware.","relationship_id":"relationship--b4dafcd2-fed8-4266-b83e-f4033ada0d55","references":[]},{"id":"M1046","name":"Boot Integrity","url":"https://attack.mitre.org/mitigations/M1046","kind":"course-of-action","description":"Check the integrity of the existing BIOS and device firmware to determine if it is vulnerable to modification.","relationship_id":"relationship--f365854f-76e6-4746-bab8-2f2b94b50087","references":[]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Patch the BIOS and other firmware as necessary to prevent successful use of known vulnerabilities.","relationship_id":"relationship--25a84607-970c-474e-83bc-143e2ccbb64b","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1485":"/ttp-simulation/techniques/enterprise/T1485/","T1495":"/ttp-simulation/techniques/enterprise/T1495/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1495","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0079","collector":"illustrative-lab-collector","observation":{"driver_path":"C:\\Lab\\demo.sys","action":"load","signature_status":"lab_fixture_only"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0004","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-device-1","firmware_before":"1.0-lab","firmware_after":"1.1-lab","change_ticket":"LAB-42"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}