{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1543","id":"T1543","name":"Create or Modify System Process","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1543","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"037f2fca914026d1365a35e1f948eb31aeeb48f1beac08aa100f3f1c74081e36","description":"Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) \n\nAdversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.  \n\nServices, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection)  ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1543","external_id":"T1543"},{"source_name":"AppleDocs Launch Agent Daemons","description":"Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.","url":"https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"},{"source_name":"TechNet Services","description":"Microsoft. (n.d.). Services. Retrieved June 7, 2016.","url":"https://technet.microsoft.com/en-us/library/cc772408.aspx"},{"source_name":"OSX Malware Detection","description":"Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved November 17, 2024.","url":"https://papers.put.as/papers/macosx/2016/RSA_OSX_Malware.pdf"}],"platforms":["Containers","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1543.001","id":"T1543.001","name":"Launch Agent","page":"techniques/enterprise/T1543.001/"},{"key":"enterprise/T1543.002","id":"T1543.002","name":"Systemd Service","page":"techniques/enterprise/T1543.002/"},{"key":"enterprise/T1543.003","id":"T1543.003","name":"Windows Service","page":"techniques/enterprise/T1543.003/"},{"key":"enterprise/T1543.004","id":"T1543.004","name":"Launch Daemon","page":"techniques/enterprise/T1543.004/"},{"key":"enterprise/T1543.005","id":"T1543.005","name":"Container Service","page":"techniques/enterprise/T1543.005/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0072","name":"Container Creation","page":"telemetry/DC0072/","kind":"attack_component","category":"Container runtime","description":"Creation of a runtime container object.","collection_focus":"Collect runtime create events and image/container IDs; correlate with API audit to establish the initiating identity.","providers":[{"name":"Docker Engine events","scope":"Daemon lifecycle events for containers and images; collect continuously.","source_id":"docker"},{"name":"Kubernetes API audit","scope":"Control-plane context in Kubernetes, not a replacement for runtime observations.","source_id":"k8s"}],"configuration":["Subscribe to the lab daemon event stream with filters for the relevant object/action; send it to a durable collector.","Record runtime/container ID, image digest, action, timestamp and host. Join orchestrator identities where available.","Use a protected collector connection. Docker socket access is privileged; never expose it publicly or grant it to the website."],"configuration_example":null,"required_fields":["container_id","image_digest","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0072","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","image_digest":"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","action":"create"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Runtime event history is bounded and can be lost without continuous collection. Image tags are mutable; pin digests. A lifecycle event is not a full process or file audit.","sources":[{"id":"docker","title":"Docker engine event stream","url":"https://docs.docker.com/reference/cli/docker/system/events/"},{"id":"k8s","title":"Kubernetes audit policies and backends","url":"https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/"}],"association":"attack_component","anomaly_design":"Per workload image and namespace: rare process starts, unexpected image/privilege changes and new network relationships. Use workload/deployment identity, not short-lived container IDs alone."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0060","name":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component","category":"Windows and directory audit","description":"Installation or registration of a service.","collection_focus":"Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["service","action","executable","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1543","id":"T1543","name":"Create or Modify System Process","domain":"enterprise","platforms":["Containers","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem"],"source_url":"https://attack.mitre.org/techniques/T1543","technique_page":"techniques/enterprise/T1543/","page":"detections/enterprise/T1543/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"e4be5675-4a53-426a-8c81-a8bb2387e947","title":"CodeIntegrity - Blocked Image/Driver Load For Policy Violation","status":"test","level":"high","logsource":{"product":"windows","service":"codeintegrity-operational"},"data_path":"data/detection-rules/e4be5675-4a53-426a-8c81-a8bb2387e947.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9b72b82d-f1c5-4632-b589-187159bc6ec1","title":"CodeIntegrity - Blocked Driver Load With Revoked Certificate","status":"test","level":"high","logsource":{"product":"windows","service":"codeintegrity-operational"},"data_path":"data/detection-rules/9b72b82d-f1c5-4632-b589-187159bc6ec1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c4e92a97-a9ff-4392-9d2d-7a4c642768ca","title":"Service Installed By Unusual Client - Security","status":"test","level":"high","logsource":{"service":"security","product":"windows","definition":"Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/c4e92a97-a9ff-4392-9d2d-7a4c642768ca.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml","author":"Tim Rauch (Nextron Systems), Elastic (idea)","kind":"sigma"},{"id":"e97d9903-53b2-41fc-8cb9-889ed4093e80","title":"KrbRelayUp Service Installation","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/e97d9903-53b2-41fc-8cb9-889ed4093e80.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_krbrelayup_service_installation.yml","author":"Sittikorn S, Tim Shelton","kind":"sigma"},{"id":"71c276aa-49cd-43d2-b920-2dcd3e6962d5","title":"Service Installed By Unusual Client - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/71c276aa-49cd-43d2-b920-2dcd3e6962d5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_service_install_sups_unusal_client.yml","author":"Tim Rauch (Nextron Systems), Elastic (idea)","kind":"sigma"},{"id":"67add051-9ee7-4ad3-93ba-42935615ae8d","title":"PUA - Process Hacker Driver Load","status":"test","level":"high","logsource":{"category":"driver_load","product":"windows"},"data_path":"data/detection-rules/67add051-9ee7-4ad3-93ba-42935615ae8d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/driver_load/driver_load_win_pua_process_hacker.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"10cb6535-b31d-4512-9962-513dcbc42cc1","title":"PUA - System Informer Driver Load","status":"test","level":"medium","logsource":{"category":"driver_load","product":"windows"},"data_path":"data/detection-rules/10cb6535-b31d-4512-9962-513dcbc42cc1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/driver_load/driver_load_win_pua_system_informer.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"811e0002-b13b-4a15-9d00-a613fce66e42","title":"PUA - Process Hacker Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/811e0002-b13b-4a15-9d00-a613fce66e42.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_process_hacker.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"5722dff1-4bdd-4949-86ab-fbaf707e767a","title":"PUA - System Informer Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5722dff1-4bdd-4949-86ab-fbaf707e767a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_system_informer.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1543-1","technique_id":"T1543","title":"T1543 Create or Modify System Process","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#persistence","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":75,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L75","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"bbfa40109503b048474f07a24d8156a52b90181c10ad6a85a3502ada9416b79a","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(service_created_or_modified) AND service_binary NOT_IN approved_service_binaries -> ALERT","log_sources":[{"title":"Service and Daemon Management Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#16-service-and-daemon-management-logs"},{"title":"Windows System Event Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#24-windows-system-event-logs"},{"title":"Linux System Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#30-linux-system-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1543-1","technique_id":"T1543","title":"New or modified system service — T1543 Create or Modify System Process","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#service-persistence","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":57,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L57","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"6a98ed8a3fb3cbde17c4fb4ec01b37c1960309ad446232d01ad510500d68b4fe","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"host-service-binary relationship.","expected_behavior":"services and binary paths remain stable for a host class.","deviation":"new edge or service configuration unlike peers.","anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"}],"log_sources":[{"title":"Service and Daemon Management Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#16-service-and-daemon-management-logs"},{"title":"Windows System Event Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#24-windows-system-event-logs"}],"context_references":[{"title":"Volt Typhoon joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa24-038a-volt-typhoon.pdf"},{"title":"original source","url":"https://www.fbi.gov/file-repository/cyber-alerts/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure.pdf"}]}],"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}],"strategies":[{"id":"DET0571","name":"Detection of System Process Creation or Modification Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0571","stix_id":"x-mitre-detection-strategy--dab6c58b-2f44-4539-93e1-b03990fc1649","relationship_id":"relationship--f2f4bc4a-1f7a-4cb8-8635-d8461de4480c","description":"","analytics":[{"id":"AN1575","name":"Analytic 1575","guidance":"Detects command-line or API-based creation/modification of Windows Services via `sc.exe`, `powershell.exe`, `services.exe`, or `ChangeServiceConfig`. Looks for creation/modification of autostart services via registry changes, file drops to `System32\\services`, and anomalous parent-child process trees.","url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1575","platforms":["Windows"],"tuning":[{"field":"ServiceNamePattern","description":"Regex patterns to flag unusual service names or binaries"},{"field":"ParentProcessFilter","description":"List of non-administrative processes starting service management tools"},{"field":"RegistryPathList","description":"Monitored autorun locations (e.g., `HKLM\\System\\CurrentControlSet\\Services`)"}],"log_sources":[{"component_id":"DC0060","component":"Service Creation","name":"WinEventLog:Security","channel":"EventCode=4697","platforms":["Windows"],"analytic_id":"AN1575","source_url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1575","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0060/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1575","source_url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1575","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN1575","source_url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1575","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN1576","name":"Analytic 1576","guidance":"Detects creation or modification of `systemd` service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to `/etc/init.d/`. Monitors `chmod +x` and `systemctl` execution paths, especially from non-root parent processes.","url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1576","platforms":["Linux"],"tuning":[{"field":"ServicePathRegex","description":"Path-based filters to identify service unit files or init scripts"},{"field":"UserContextList","description":"List of expected user contexts that normally perform service changes"},{"field":"CommandNameList","description":"Binaries used to register/modify services"}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"write or rename to /etc/systemd/system or /etc/init.d","platforms":["Linux"],"analytic_id":"AN1576","source_url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1576","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"execution of systemctl or service with enable/start/modify","platforms":["Linux"],"analytic_id":"AN1576","source_url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1576","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1577","name":"Analytic 1577","guidance":"Detects creation or modification of `LaunchDaemon` or `LaunchAgent` plist files under `/Library/LaunchDaemons/`, `~/Library/LaunchAgents/`, or similar. Monitors execution of `launchctl`, property list edits, and file permission changes.","url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1577","platforms":["macOS"],"tuning":[{"field":"PlistPathList","description":"Watched directories for LaunchDaemons and LaunchAgents"},{"field":"PlistKeyMonitor","description":"Monitored keys such as `RunAtLoad`, `KeepAlive`, or `ProgramArguments`"},{"field":"UnsignedBinaryAlert","description":"Flag execution of unsigned or non-Apple-signed binaries within plist"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"launchctl load/unload or plist file modification","platforms":["macOS"],"analytic_id":"AN1577","source_url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1577","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0061","component":"File Modification","name":"fs:fsusage","channel":"file write to launchd plist paths","platforms":["macOS"],"analytic_id":"AN1577","source_url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1577","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN1578","name":"Analytic 1578","guidance":"Detects creation of new container system processes via `docker run --restart`, `kubectl exec` to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.","url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1578","platforms":["Containers"],"tuning":[{"field":"EntrypointOverridePattern","description":"Patterns used to detect modified container start scripts"},{"field":"RestartPolicyMatch","description":"Policy values triggering alert (e.g., always, on-failure)"},{"field":"KubeInitModPath","description":"Path filters for `/etc/init.d/`-like behaviors inside containers"}],"log_sources":[{"component_id":"DC0072","component":"Container Creation","name":"docker:events","channel":"docker run with restart=always or modifying init","platforms":["Containers"],"analytic_id":"AN1578","source_url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1578","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0072/"},{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"modification of entrypoint scripts or init containers","platforms":["Containers"],"analytic_id":"AN1578","source_url":"https://attack.mitre.org/detectionstrategies/DET0571#AN1578","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0072","name":"Container Creation","tag":"Container Creation","page":"telemetry/DC0072/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0060","name":"Service Creation","tag":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0401","name":"Exaramel for Linux","url":"https://attack.mitre.org/software/S0401","kind":"malware","description":"[Exaramel for Linux](https://attack.mitre.org/software/S0401) has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.(Citation: ANSSI Sandworm January 2021)","relationship_id":"relationship--5a832b2f-7aa5-4a11-a06a-5cd22fb7f457","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"id":"S1121","name":"LITTLELAMB.WOOLTEA","url":"https://attack.mitre.org/software/S1121","kind":"malware","description":"[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) can initialize itself as a daemon to run persistently in the background.(Citation: Mandiant Cutting Edge Part 3 February 2024)","relationship_id":"relationship--e2c96d0e-4f0c-473a-8cc1-164cc89ce019","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","description":"Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}]},{"id":"S1142","name":"LunarMail","url":"https://attack.mitre.org/software/S1142","kind":"malware","description":"[LunarMail](https://attack.mitre.org/software/S1142) can create an arbitrary process with a specified command line and redirect its output to a staging directory.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--e33671e8-2a3c-4ec9-997f-c5275f5299d2","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1152","name":"IMAPLoader","url":"https://attack.mitre.org/software/S1152","kind":"malware","description":"[IMAPLoader](https://attack.mitre.org/software/S1152) modifies Windows tasks on the victim machine to reference a retrieved PE file through a path modification.(Citation: PWC Yellow Liderc 2023)","relationship_id":"relationship--23261347-60b6-446b-8eac-4168a7a8e8a8","references":[{"source_name":"PWC Yellow Liderc 2023","description":"PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024.","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"id":"S1184","name":"BOLDMOVE","url":"https://attack.mitre.org/software/S1184","kind":"malware","description":"[BOLDMOVE](https://attack.mitre.org/software/S1184) can free all resources and terminate itself on victim machines.(Citation: Google Cloud BOLDMOVE 2023)","relationship_id":"relationship--4b992403-58a0-455c-a028-83743f0885b9","references":[{"source_name":"Google Cloud BOLDMOVE 2023","description":"Scott Henderson, Cristiana Kittner, Sarah Hawley & Mark Lechtik, Google Cloud. (2023, January 19). Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475). Retrieved December 31, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/"}]},{"id":"S1194","name":"Akira _v2","url":"https://attack.mitre.org/software/S1194","kind":"malware","description":"\n[Akira _v2](https://attack.mitre.org/software/S1194) can create a child process for encryption.(Citation: CISA Akira Ransomware APR 2024)","relationship_id":"relationship--4320c156-79a0-40fb-869f-32a574dcef0b","references":[{"source_name":"CISA Akira Ransomware APR 2024","description":"CISA et al. (2024, April 18). #StopRansomware: Akira Ransomware. Retrieved December 10, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"}]},{"id":"S9015","name":"BRICKSTORM","url":"https://attack.mitre.org/software/S9015","kind":"malware","description":"[BRICKSTORM](https://attack.mitre.org/software/S9015) has created a new background session and has spawned a child process of a parent process when it determines it is not running in its intended state.(Citation: CISA BRICKSTORM UNC5221 AR25-338A February 2026)","relationship_id":"relationship--85a03500-f954-487e-ba86-3ae696cb4736","references":[{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","description":"DHS/CISA. (2026, February 11). AR25-338A: BRICKSTORM Backdoor. Retrieved April 16, 2026.","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) can establish persistence in CI/CD environments by launching a background process (deploy.js) with stolen tokens.(Citation: Aikido TeamPCP Trivy MAR 2026)","relationship_id":"relationship--8ee9e5f2-1030-475f-892d-62d082f70553","references":[{"source_name":"Aikido TeamPCP Trivy MAR 2026","description":"Eriksen, C. (2026, March 20). TeamPCP deploys CanisterWorm on NPM following Trivy compromise. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has created the RegAsm.exe process in a suspended state.(Citation: Cyfirma_Vidar_June2024)","relationship_id":"relationship--f83dbb6c-a680-427a-a425-d1310831f36a","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"}]}],"actors":[],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Limit privileges of user accounts and groups so that only authorized administrators can interact with system-level process changes and service configurations.","relationship_id":"relationship--06ef2810-b641-4142-83af-bbb00a598c11","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Restrict read/write access to system-level process files to only select privileged users who have a legitimate need to manage system services.","relationship_id":"relationship--9e93d680-0e33-4577-97f6-da4e53f8ab78","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.","relationship_id":"relationship--44f0fc9b-82bf-4820-a4c4-8e96fc25107c","references":[]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed. ","relationship_id":"relationship--5eb23e3a-c1fb-4d96-99d1-65be2e0a76ca","references":[]},{"id":"M1033","name":"Limit Software Installation","url":"https://attack.mitre.org/mitigations/M1033","kind":"course-of-action","description":"Restrict software installation to trusted repositories only and be cautious of orphaned software packages.","relationship_id":"relationship--43d69d89-df36-44fa-a09e-c66aa9fa5918","references":[]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system.(Citation: Malicious Driver Reporting Center) On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed drivers.(Citation: Microsoft driver block rules)  ","relationship_id":"relationship--3633dab7-324d-4726-af7c-226022996785","references":[{"source_name":"Malicious Driver Reporting Center","description":"Azure Edge and Platform Security Team & Microsoft 365 Defender Research Team. (2021, December 8). Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center. Retrieved April 6, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/"},{"source_name":"Microsoft driver block rules","description":"Jordan Geurten et al. . (2022, March 29). Microsoft recommended driver block rules. Retrieved April 7, 2022.","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"}]},{"id":"M1045","name":"Code Signing","url":"https://attack.mitre.org/mitigations/M1045","kind":"course-of-action","description":"Enforce registration and execution of only legitimately signed service drivers where possible.","relationship_id":"relationship--a8e16c31-b516-4e64-ac0b-27d6b87bb82c","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them.","relationship_id":"relationship--65b98884-b04d-424a-a89c-c4f52565e160","references":[]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container.","relationship_id":"relationship--99f3e59e-6e6e-4602-83df-52de4cbf6abd","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1543.004":"/ttp-simulation/techniques/enterprise/T1543.004/","T1543.001":"/ttp-simulation/techniques/enterprise/T1543.001/","T1543":"/ttp-simulation/techniques/enterprise/T1543/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1543","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0072","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","image_digest":"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","action":"create"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}