{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1496","id":"T1496","name":"Resource Hijacking","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1496","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"03a971270411002efa3f76cc24d48c3e4164b61afa7e8de6ba66af1954ac9ee6","description":"Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. \n\nResource hijacking may take a number of different forms. For example, adversaries may:\n\n* Leverage compute resources in order to mine cryptocurrency\n* Sell network bandwidth to proxy networks\n* Generate SMS traffic for profit\n* Abuse cloud-based messaging services to send large quantities of spam messages\n\nIn some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1496","external_id":"T1496"},{"source_name":"Sysdig Cryptojacking Proxyjacking 2023","description":"Miguel Hernandez. (2023, August 17). LABRAT: Stealthy Cryptojacking and Proxyjacking Campaign Targeting GitLab . Retrieved September 25, 2024.","url":"https://sysdig.com/blog/labrat-cryptojacking-proxyjacking-campaign/"}],"platforms":["Windows","IaaS","Linux","macOS","Containers","SaaS"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1496.001","id":"T1496.001","name":"Compute Hijacking","page":"techniques/enterprise/T1496.001/"},{"key":"enterprise/T1496.002","id":"T1496.002","name":"Bandwidth Hijacking","page":"techniques/enterprise/T1496.002/"},{"key":"enterprise/T1496.003","id":"T1496.003","name":"SMS Pumping","page":"techniques/enterprise/T1496.003/"},{"key":"enterprise/T1496.004","id":"T1496.004","name":"Cloud Service Hijacking","page":"techniques/enterprise/T1496.004/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0069","name":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a managed cloud service configuration.","collection_focus":"Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["service","resource_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0018","name":"Host Status","page":"telemetry/DC0018/","kind":"attack_component","category":"Host state and inventory","description":"Host health and availability observations such as heartbeat, shutdown or degraded state.","collection_focus":"Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","status","heartbeat_age_seconds","collector_healthy"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0080","name":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component","category":"Cloud control plane","description":"A request to start a stopped compute instance and its resulting state.","collection_focus":"Collect start APIs and instance-state transitions with request IDs; distinguish accepted from completed.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["instance_id","action","state_before","state_after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1496","id":"T1496","name":"Resource Hijacking","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS","Containers","SaaS"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1496","technique_page":"techniques/enterprise/T1496/","page":"detections/enterprise/T1496/","status":"rule_source_available","counts":{"sigma":13,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"sigma_rules":[{"id":"93e0ef48-37c8-49ed-a02c-038aab23628e","title":"Azure Container Registry Created or Deleted","status":"test","level":"low","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/93e0ef48-37c8-49ed-a02c-038aab23628e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"9541f321-7cba-4b43-80fc-fbd1fb922808","title":"Azure Kubernetes Cluster Created or Deleted","status":"test","level":"low","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/9541f321-7cba-4b43-80fc-fbd1fb922808.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"08d6ac24-c927-4469-b3b7-2e422d6e3c43","title":"Azure Kubernetes Network Policy Change","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/08d6ac24-c927-4469-b3b7-2e422d6e3c43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"818fee0c-e0ec-4e45-824e-83e4817b0887","title":"Azure Kubernetes Sensitive Role Access","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/818fee0c-e0ec-4e45-824e-83e4817b0887.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"25cb259b-bbdc-4b87-98b7-90d7c72f8743","title":"Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/25cb259b-bbdc-4b87-98b7-90d7c72f8743.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"7ee0b4aa-d8d4-4088-b661-20efdf41a04c","title":"Azure Kubernetes Secret or Config Object Access","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/7ee0b4aa-d8d4-4088-b661-20efdf41a04c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"12d027c3-b48c-4d9d-8bb6-a732200034b2","title":"Azure Kubernetes Service Account Modified or Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/12d027c3-b48c-4d9d-8bb6-a732200034b2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"a46c93b7-55ed-4d27-a41b-c259456c4746","title":"Linux Crypto Mining Pool Connections","status":"stable","level":"high","logsource":{"product":"linux","category":"network_connection"},"data_path":"data/detection-rules/a46c93b7-55ed-4d27-a41b-c259456c4746.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"9069ea3c-b213-4c52-be13-86506a227ab1","title":"Linux Crypto Mining Indicators","status":"test","level":"high","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/9069ea3c-b213-4c52-be13-86506a227ab1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"b593fd50-7335-4682-a36c-4edcb68e4641","title":"Monero Crypto Coin Mining Pool Lookup","status":"stable","level":"high","logsource":{"category":"dns"},"data_path":"data/detection-rules/b593fd50-7335-4682-a36c-4edcb68e4641.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/dns/net_dns_pua_cryptocoin_mining_xmr.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"bf74135c-18e8-4a72-a926-0e4f47888c19","title":"DNS Events Related To Mining Pools","status":"test","level":"low","logsource":{"service":"dns","product":"zeek"},"data_path":"data/detection-rules/bf74135c-18e8-4a72-a926-0e4f47888c19.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/zeek/zeek_dns_mining_pools.yml","author":"Saw Winn Naung, Azure-Sentinel, @neu5ron","kind":"sigma"},{"id":"fa5b1358-b040-4403-9868-15f7d9ab6329","title":"Network Communication With Crypto Mining Pool","status":"stable","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/fa5b1358-b040-4403-9868-15f7d9ab6329.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"66c3b204-9f88-4d0a-a7f7-8a57d521ca55","title":"Potential Crypto Mining Activity","status":"stable","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/66c3b204-9f88-4d0a-a7f7-8a57d521ca55.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_crypto_mining_monero.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1496-1","technique_id":"T1496","title":"T1496 Resource Hijacking","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#impact","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":193,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L193","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"a37a71f499fad726a55a44d9f85b74a18601468f97b52bd5d06d3f3d9d42ff0e","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(known_mining_process_or_pool_destination) OR resource_usage >= fixed_threshold FOR fixed_duration -> ALERT","log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"},{"title":"Metrics and Monitoring-System Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#152-metrics-and-monitoring-system-logs"},{"title":"Cloud Billing and Usage Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#117-cloud-billing-and-usage-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1496-1","technique_id":"T1496","title":"Unauthorized computation or resource abuse — T1496 Resource Hijacking","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#resource-hijacking","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":122,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L122","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"676ff1bd02c1714484feff10bdad8a1028732ab15569963c03f10dbe247daf17","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"workload resource-consumption series.","expected_behavior":"compute, power, cost, and network use follow workload schedules.","deviation":"sustained level shift, tail consumption, or emerging upward trend.","anomaly_types":[{"title":"Level-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#23-level-shift-anomaly"},{"title":"Tail Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#41-tail-anomaly"},{"title":"Emerging Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#113-emerging-anomaly"}],"log_sources":[{"title":"Metrics and Monitoring-System Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#152-metrics-and-monitoring-system-logs"},{"title":"Cloud Billing and Usage Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#117-cloud-billing-and-usage-logs"}],"context_references":[{"title":"Sysdig SCARLETEEL investigation — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/sysdig-scarleteel.html"},{"title":"original source","url":"https://www.sysdig.com/blog/cloud-breach-terraform-data-theft"}]}],"anomaly_types":[{"title":"Emerging Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#113-emerging-anomaly"},{"title":"Level-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#23-level-shift-anomaly"},{"title":"Tail Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#41-tail-anomaly"}],"strategies":[{"id":"DET0267","name":"Resource Hijacking Detection Strategy","url":"https://attack.mitre.org/detectionstrategies/DET0267","stix_id":"x-mitre-detection-strategy--440ddaf2-4e80-4699-90d7-0bdccdfeece6","relationship_id":"relationship--c267dfc4-92f8-41f5-a101-177153e674c3","description":"","analytics":[{"id":"AN0741","name":"Analytic 0741","guidance":"Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0741","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Duration threshold for sustained CPU activity (e.g., >15 minutes)"},{"field":"DestinationIPList","description":"Known mining pool IPs or proxy service endpoints"},{"field":"ExecutableNamePatterns","description":"Regex list of suspicious or known mining tools"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0741","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0741","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0018","component":"Host Status","name":"Windows:perfmon","channel":"High sustained CPU usage by a single process","platforms":["Windows"],"analytic_id":"AN0741","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0741","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0741","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0741","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN0742","name":"Analytic 0742","guidance":"Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0742","platforms":["Linux"],"tuning":[{"field":"ProcessPath","description":"Location of resource-heavy binaries (e.g., /tmp/.xmr)"},{"field":"CPUThreshold","description":"Acceptable baseline for CPU overuse"},{"field":"KnownMiningDomains","description":"List of domains/IPs for known cryptomining services"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0742","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0742","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0018","component":"Host Status","name":"linux:procfs","channel":"Sustained high /proc/[pid]/stat usage","platforms":["Linux"],"analytic_id":"AN0742","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0742","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Outbound traffic to mining pools or proxies","platforms":["Linux"],"analytic_id":"AN0742","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0742","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN0743","name":"Analytic 0743","guidance":"Background launch agents/daemons with high CPU use and network access to external mining services.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0743","platforms":["macOS"],"tuning":[{"field":"launchdLabel","description":"Suspicious or unknown launch agents"},{"field":"TrafficVolumeThreshold","description":"Outbound bandwidth usage thresholds"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"launchctl activity and process creation","platforms":["macOS"],"analytic_id":"AN0743","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0743","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"macos:unifiedlog","channel":"Persistent outbound traffic to mining domains","platforms":["macOS"],"analytic_id":"AN0743","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0743","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0744","name":"Analytic 0744","guidance":"Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0744","platforms":["IaaS"],"tuning":[{"field":"CPUUtilizationThreshold","description":"CloudWatch alarm trigger for sustained CPU"},{"field":"UnusualRegionList","description":"Instances launched in unexpected regions"}],"log_sources":[{"component_id":"DC0080","component":"Instance Start","name":"AWS:CloudTrail","channel":"RunInstances","platforms":["IaaS"],"analytic_id":"AN0744","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0744","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0080/"},{"component_id":"DC0018","component":"Host Status","name":"AWS:CloudWatch","channel":"Sustained EC2 CPU usage above normal baseline","platforms":["IaaS"],"analytic_id":"AN0744","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0744","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"AWS:VPCFlowLogs","channel":"Outbound flow logs to known mining pools","platforms":["IaaS"],"analytic_id":"AN0744","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0744","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN0745","name":"Analytic 0745","guidance":"High CPU usage by unauthorized containers running mining binaries or public proxy tools.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0745","platforms":["Containers"],"tuning":[{"field":"ImageName","description":"Suspicious or unknown container image used"},{"field":"CPUQuotaThreshold","description":"Container-level resource limits"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"containerd:events","channel":"New container with suspicious image name or high resource usage","platforms":["Containers"],"analytic_id":"AN0745","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0745","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0018","component":"Host Status","name":"prometheus:metrics","channel":"Container CPU/Memory usage exceeding threshold","platforms":["Containers"],"analytic_id":"AN0745","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0745","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"container:cni","channel":"Outbound network traffic to mining proxies","platforms":["Containers"],"analytic_id":"AN0745","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0745","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN0746","name":"Analytic 0746","guidance":"Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0746","platforms":["SaaS"],"tuning":[{"field":"MessageRateThreshold","description":"Max allowable outbound message rate per user/account"},{"field":"APIKeyList","description":"Known authorized API clients for messaging usage"}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"m365:unified","channel":"SendMessage","platforms":["SaaS"],"analytic_id":"AN0746","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0746","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"},{"component_id":"DC0038","component":"Application Log Content","name":"saas:application","channel":"High-volume API calls or traffic via messaging or webhook service","platforms":["SaaS"],"analytic_id":"AN0746","source_url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0746","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"},{"id":"DC0018","name":"Host Status","tag":"Host Status","page":"telemetry/DC0018/","kind":"attack_component"},{"id":"DC0080","name":"Instance Start","tag":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[],"candidates":[{"id":"44315fb0-f78d-4cef-b10f-cf21c1fe2c75","name":"Windows - Simulate CPU Load with PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1496/T1496.yaml","description":"This test simulates high CPU load using PowerShell, commonly seen in resource hijacking.\nSpawns background jobs to stress CPU cores for a specified duration.\n","inputs":{"duration_seconds":{"description":"Duration in seconds to run the CPU stress test","type":"integer","default":30},"cpu_threads":{"description":"Number of threads to stress (default 4)","type":"integer","default":4}},"dependencies":[],"source_definition_sha256":"96bdb490b3cebe70bf5240bcab5d028da5353934088e3e1e23d32caa1e46c266"},{"id":"904a5a0e-fb02-490d-9f8d-0e256eb37549","name":"FreeBSD/macOS/Linux - Simulate CPU Load with Yes","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1496/T1496.yaml","description":"This test simulates a high CPU load as you might observe during cryptojacking attacks.\nEnd the test by using CTRL/CMD+C to break.\n","inputs":{},"dependencies":[],"source_definition_sha256":"18c38831fe3a6a04d50f22b93797045edb512599babec0d2e5debb673b8c0411"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1496":"/ttp-simulation/techniques/enterprise/T1496/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1496","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}