{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1564","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"8b1b02695ea1388c1dec14e674631cb550f874bae24330bf8ff3e79d82f80d5a","description":"Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015)\n\nAdversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1564","external_id":"T1564"},{"source_name":"Cybereason OSX Pirrit","description":"Amit Serper. (2016). Cybereason Lab Analysis OSX.Pirrit. Retrieved December 10, 2021.","url":"https://cdn2.hubspot.net/hubfs/3354902/Content%20PDFs/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf"},{"source_name":"MalwareBytes ADS July 2015","description":"Arntz, P. (2015, July 22). Introduction to Alternate Data Streams. Retrieved March 21, 2018.","url":"https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/"},{"source_name":"Sofacy Komplex Trojan","description":"Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.","url":"https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"},{"source_name":"Sophos Ragnar May 2020","description":"SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.","url":"https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"}],"platforms":["ESXi","Linux","macOS","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1564.001","id":"T1564.001","name":"Hidden Files and Directories","page":"techniques/enterprise/T1564.001/"},{"key":"enterprise/T1564.002","id":"T1564.002","name":"Hidden Users","page":"techniques/enterprise/T1564.002/"},{"key":"enterprise/T1564.003","id":"T1564.003","name":"Hidden Window","page":"techniques/enterprise/T1564.003/"},{"key":"enterprise/T1564.004","id":"T1564.004","name":"NTFS File Attributes","page":"techniques/enterprise/T1564.004/"},{"key":"enterprise/T1564.005","id":"T1564.005","name":"Hidden File System","page":"techniques/enterprise/T1564.005/"},{"key":"enterprise/T1564.006","id":"T1564.006","name":"Run Virtual Instance","page":"techniques/enterprise/T1564.006/"},{"key":"enterprise/T1564.007","id":"T1564.007","name":"VBA Stomping","page":"techniques/enterprise/T1564.007/"},{"key":"enterprise/T1564.008","id":"T1564.008","name":"Email Hiding Rules","page":"techniques/enterprise/T1564.008/"},{"key":"enterprise/T1564.009","id":"T1564.009","name":"Resource Forking","page":"techniques/enterprise/T1564.009/"},{"key":"enterprise/T1564.010","id":"T1564.010","name":"Process Argument Spoofing","page":"techniques/enterprise/T1564.010/"},{"key":"enterprise/T1564.011","id":"T1564.011","name":"Ignore Process Interrupts","page":"techniques/enterprise/T1564.011/"},{"key":"enterprise/T1564.012","id":"T1564.012","name":"File/Path Exclusions","page":"techniques/enterprise/T1564.012/"},{"key":"enterprise/T1564.013","id":"T1564.013","name":"Bind Mounts","page":"techniques/enterprise/T1564.013/"},{"key":"enterprise/T1564.014","id":"T1564.014","name":"Extended Attributes","page":"techniques/enterprise/T1564.014/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0059","name":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component","category":"Host state and inventory","description":"File attributes such as path, size, timestamps, ownership and cryptographic hash.","collection_focus":"Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["path","size_bytes","sha256","owner_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","domain":"enterprise","platforms":["ESXi","Linux","macOS","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1564","technique_page":"techniques/enterprise/T1564/","page":"detections/enterprise/T1564/","status":"rule_source_available","counts":{"sigma":10,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"ec52985a-d024-41e3-8ff6-14169039a0b3","title":"Mount Execution With Hidepid Parameter","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/ec52985a-d024-41e3-8ff6-14169039a0b3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"e15b518d-b4ce-4410-a9cd-501f23ce4a18","title":"Suspicious Creation with Colorcpl","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/e15b518d-b4ce-4410-a9cd-501f23ce4a18.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml","author":"frack113","kind":"sigma"},{"id":"74babdd6-a758-4549-9632-26535279e654","title":"Suspicious Executable File Creation","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/74babdd6-a758-4549-9632-26535279e654.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_executable_creation.yml","author":"frack113","kind":"sigma"},{"id":"811e0002-b13b-4a15-9d00-a613fce66e42","title":"PUA - Process Hacker Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/811e0002-b13b-4a15-9d00-a613fce66e42.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_process_hacker.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"5722dff1-4bdd-4949-86ab-fbaf707e767a","title":"PUA - System Informer Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5722dff1-4bdd-4949-86ab-fbaf707e767a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_system_informer.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"69bd9b97-2be2-41b6-9816-fb08757a4d1a","title":"Potentially Suspicious Execution From Parent Process In Public Folder","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/69bd9b97-2be2-41b6-9816-fb08757a4d1a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"bab049ca-7471-4828-9024-38279a4c04da","title":"Virtualbox Driver Installation or Starting of VMs","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bab049ca-7471-4828-9024-38279a4c04da.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml","author":"Janantha Marasinghe","kind":"sigma"},{"id":"2ff692c2-4594-41ec-8fcb-46587de769e0","title":"CrashControl CrashDump Disabled","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/2ff692c2-4594-41ec-8fcb-46587de769e0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_crashdump_disabled.yml","author":"Tobias Michalski (Nextron Systems)","kind":"sigma"},{"id":"815cd91b-7dbc-4247-841a-d7dd1392b0a8","title":"Sysmon Configuration Error","status":"test","level":"high","logsource":{"product":"windows","category":"sysmon_error"},"data_path":"data/detection-rules/815cd91b-7dbc-4247-841a-d7dd1392b0a8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/sysmon/sysmon_config_modification_error.yml","author":"frack113","kind":"sigma"},{"id":"1f2b5353-573f-4880-8e33-7d04dcf97744","title":"Sysmon Configuration Modification","status":"test","level":"high","logsource":{"product":"windows","category":"sysmon_status"},"data_path":"data/detection-rules/1f2b5353-573f-4880-8e33-7d04dcf97744.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/sysmon/sysmon_config_modification_status.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0502","name":"Detection Strategy for Hidden Artifacts Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0502","stix_id":"x-mitre-detection-strategy--bd2348f8-acef-4310-bd03-cf7b866d2592","relationship_id":"relationship--cd3ee69c-01d3-41a0-9e5e-caebaf1776c7","description":"","analytics":[{"id":"AN1384","name":"Analytic 1384","guidance":"Abuse of file/registry attributes to hide malicious files, directories, or services. Defender view: detection of attrib.exe setting hidden/system flags, creation of Alternate Data Streams, or registry keys altering file visibility.","url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1384","platforms":["Windows"],"tuning":[{"field":"FileExtensions","description":"Filter for sensitive file types likely targeted for hiding."},{"field":"ADSDetection","description":"Enable or disable detection of Alternate Data Streams depending on business use."}],"log_sources":[{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1384","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1384","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1384","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1384","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN1384","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1384","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN1385","name":"Analytic 1385","guidance":"Hidden file creation using leading '.' or file attribute changes with chattr (immutable/hidden flags). Defender view: detect execution of chattr, lsattr anomalies, and unusual hidden files appearing in system directories.","url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1385","platforms":["Linux"],"tuning":[{"field":"DirectoryScope","description":"Restrict hidden file detection to privileged system directories."},{"field":"AttributeFlags","description":"Tune for specific chattr flags (+i immutable, +a append-only) most abused for persistence."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"auditd:EXECVE","channel":"Execution of chattr to set +i or +a attributes","platforms":["Linux"],"analytic_id":"AN1385","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1385","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0039","component":"File Creation","name":"auditd:FILE","channel":"Creation of hidden files (.*) in sensitive directories (/etc, /var, /usr/bin)","platforms":["Linux"],"analytic_id":"AN1385","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1385","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]},{"id":"AN1386","name":"Analytic 1386","guidance":"Hidden files via 'chflags hidden' or Apple-specific attributes, LaunchAgents/LaunchDaemons placed in non-standard hidden directories. Defender view: detect command execution modifying file flags and unusual plist creation in hidden paths.","url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1386","platforms":["macOS"],"tuning":[{"field":"HiddenDirectories","description":"List of directories monitored for hidden plist or agent placement."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"Execution of chflags hidden or setfile -a V","platforms":["macOS"],"analytic_id":"AN1386","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1386","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0039","component":"File Creation","name":"macos:unifiedlog","channel":"Creation of LaunchAgents/LaunchDaemons in hidden or non-standard directories","platforms":["macOS"],"analytic_id":"AN1386","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1386","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]},{"id":"AN1387","name":"Analytic 1387","guidance":"Abuse of VMFS or ESXi shell to hide datastore files, renaming/moving VMDK or VMX files into hidden directories. Defender view: anomalous ESXi shell commands or file operations obscuring VM artifacts.","url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1387","platforms":["ESXi"],"tuning":[{"field":"VMFileScope","description":"Restrict to VMDK, VMX, or log files critical for VM operations."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"mv, rename, or chmod commands moving VM files into hidden directories","platforms":["ESXi"],"analytic_id":"AN1387","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1387","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0059","component":"File Metadata","name":"esxi:syslog","channel":"Datastore file hidden or renamed unexpectedly","platforms":["ESXi"],"analytic_id":"AN1387","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1387","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"}]},{"id":"AN1388","name":"Analytic 1388","guidance":"Malicious macros or embedded objects hidden within Office documents by renaming streams or using hidden OLE objects. Defender view: detection of hidden macro streams or objects in documents correlated with anomalous execution.","url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1388","platforms":["Office Suite"],"tuning":[{"field":"MacroScope","description":"Tune detection to specific Office apps and document types where macros are disallowed."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"Detection of hidden macro streams or SetHiddenAttribute actions","platforms":["Office Suite"],"analytic_id":"AN1388","source_url":"https://attack.mitre.org/detectionstrategies/DET0502#AN1388","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0059","name":"File Metadata","tag":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) can modify file attributes to hide the file.(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--ca824912-36d7-4fa9-a2ea-b9b3da431b15","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0402","name":"OSX/Shlayer","url":"https://attack.mitre.org/software/S0402","kind":"malware","description":"[OSX/Shlayer](https://attack.mitre.org/software/S0402) has used the <code>mktemp</code> utility to make random and unique filenames for payloads, such as <code>export tmpDir=\"$(mktemp -d /tmp/XXXXXXXXXXXX)\"</code> or <code>mktemp -t Installer</code>.(Citation: sentinelone shlayer to zshlayer)(Citation: 20 macOS Common Tools and Techniques)(Citation: Shlayer jamf gatekeeper bypass 2021)","relationship_id":"relationship--08e05216-9133-4056-bbc9-b91ea0a7c6f5","references":[{"source_name":"Shlayer jamf gatekeeper bypass 2021","description":"Jaron Bradley. (2021, April 26). Shlayer malware abusing Gatekeeper bypass on macOS. Retrieved September 22, 2021.","url":"https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/"},{"source_name":"sentinelone shlayer to zshlayer","description":"Phil Stokes. (2020, September 8). Coming Out of Your Shell: From Shlayer to ZShlayer. Retrieved September 13, 2021.","url":"https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/"},{"source_name":"20 macOS Common Tools and Techniques","description":"Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.","url":"https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"}]},{"id":"S0482","name":"Bundlore","url":"https://attack.mitre.org/software/S0482","kind":"malware","description":"[Bundlore](https://attack.mitre.org/software/S0482) uses the <code>mktemp</code> utility to make unique file and directory names for payloads, such as <code>TMP_DIR=`mktemp -d -t x</code>.(Citation: 20 macOS Common Tools and Techniques)","relationship_id":"relationship--2a4447dc-811d-487a-ade9-ef11e6e24e16","references":[{"source_name":"20 macOS Common Tools and Techniques","description":"Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.","url":"https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can masquerade the Process Environment Block on a compromised host to hide its attempts to elevate privileges through `IFileOperation`.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--5bceaa15-bfcf-464f-a3d3-030d389080b5","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S1011","name":"Tarrask","url":"https://attack.mitre.org/software/S1011","kind":"malware","description":"[Tarrask](https://attack.mitre.org/software/S1011) is able to create “hidden” scheduled tasks by deleting the Security Descriptor (`SD`) registry value.(Citation: Tarrask scheduled task)","relationship_id":"relationship--d507bcd4-bd22-4d39-b098-20c109ee9cda","references":[{"source_name":"Tarrask scheduled task","description":"Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022.","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) has used `%HiddenReg%` and `%HiddenKey%` as part of its persistence via the Windows registry.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--662dd798-61ce-4463-8567-9acdecade943","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S9025","name":"NOOPLDR","url":"https://attack.mitre.org/software/S9025","kind":"malware","description":"[NOOPLDR](https://attack.mitre.org/software/S9025) can hide services used to aid execution.(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--d6a855be-0b7c-4a30-8759-e9506ca420b7","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]}],"actors":[],"mitigations":[{"id":"M1013","name":"Application Developer Guidance","url":"https://attack.mitre.org/mitigations/M1013","kind":"course-of-action","description":"Application developers should consider limiting the requirements for custom or otherwise difficult to manage file/folder exclusions. Where possible, install applications to trusted system folder paths that are already protected by restricted file and directory permissions.","relationship_id":"relationship--508cef53-f7ff-4e64-9ab3-dedefbba697b","references":[]},{"id":"M1033","name":"Limit Software Installation","url":"https://attack.mitre.org/mitigations/M1033","kind":"course-of-action","description":"Restrict the installation of software that may be abused to create hidden desktops, such as hVNC, to user groups that require it.","relationship_id":"relationship--2d30c053-3994-4a3b-b129-870f32edb008","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Periodically audit virtual machines for abnormalities.","relationship_id":"relationship--61e737e5-58d1-4a65-86e2-061466f2ff54","references":[]},{"id":"M1049","name":"Antivirus/Antimalware","url":"https://attack.mitre.org/mitigations/M1049","kind":"course-of-action","description":"Review and audit file/folder exclusions, and limit scope of exclusions to only what is required where possible.(Citation: Microsoft File Folder Exclusions)","relationship_id":"relationship--a4139ea2-b04d-472a-9daa-0ff3eb5586ce","references":[{"source_name":"Microsoft File Folder Exclusions","description":"Microsoft. (2024, February 27). Contextual file and folder exclusions. Retrieved March 29, 2024.","url":"https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-contextual-file-folder-exclusions-microsoft-defender-antivirus"}]}],"candidates":[{"id":"2748ab4a-1e0b-4cf2-a2b0-8ef765bec7be","name":"Command Execution with NirCmd","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1564/T1564.yaml","description":"NirCmd is used by threat actors to execute commands, which can include recon and privilege escalation via running commands via the SYSTEM account\nSee https://www.kroll.com/en/insights/publications/cyber/black-basta-technical-analysis\n","inputs":{"nircmd_location":{"description":"Location of nircmd executable","type":"Path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\nircmd.exe"},"command_to_execute":{"description":"Command for nircmd to execute","type":"Path","default":"win child class \"Shell_TrayWnd\" hide class \"TrayClockWClass\""},"cleanup_command_to_execute":{"description":"Cleanup command to undo the arbitrary command ran by nircmd","type":"Path","default":"win child class \"Shell_TrayWnd\" show class \"TrayClockWClass\""}},"dependencies":[{"description":"The Nircmd executable must exist at (#{nircmd_location})\n"}],"source_definition_sha256":"7fd221a4f46d1d31e78ce38f940c52570fc1a16bfe22b384d64128e6c757011b"},{"id":"2ec63cc2-4975-41a6-bf09-dffdfb610778","name":"Create a Hidden User Called \"$\"","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1564/T1564.yaml","description":"Creating a user with a username containing \"$\"","inputs":{},"dependencies":[],"source_definition_sha256":"e655bf03ed505727e176fb30746b720befa17fdc1ad4081fe353d36ed8275b80"},{"id":"333c7de0-6fbe-42aa-ac2b-c7e40b18246a","name":"Create and Hide a Service with sc.exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1564/T1564.yaml","description":"The following technique utilizes sc.exe and sdset to change the security descriptor of a service and \"hide\" it from Get-Service or sc query.\n\nUpon successful execution, sc.exe creates a new service changes the security descriptor.\n\nhttps://twitter.com/Alh4zr3d/status/1580925761996828672\nhttps://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-string-format\n","inputs":{"service_name":{"description":"Name of service to create","type":"string","default":"AtomicService"},"executable_command":{"description":"Command to execute as a service","type":"string","default":"C:\\Windows\\System32\\calc.exe"}},"dependencies":[],"source_definition_sha256":"c5986e2c1a7b85c8a52bdfc018597e1f6c94e011c464e3354fe021cc5cb0c603"},{"id":"5bb20389-39a5-4e99-9264-aeb92a55a85c","name":"Create an \"Administrator \" user (with a space on the end)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1564/T1564.yaml","description":"Creating a user with a username containing with a space on the end","inputs":{},"dependencies":[],"source_definition_sha256":"0dad9206f5a82e4d7bc896b6b209e9e69a59ebd7409949fe042451208d48346a"},{"id":"6afe288a-8a8b-4d33-a629-8d03ba9dad3a","name":"Extract binary files via VBA","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1564/T1564.yaml","description":"This module extracts a binary (calc.exe) from inside of another binary. \n\nIn the wild maldoc authors will use this technique to hide binaries inside of files stored \nwithin the office document itself. An example of this technique can be seen in sample\n\nf986040c7dd75b012e7dfd876acb33a158abf651033563ab068800f07f508226\n\nThis sample contains a document inside of itself. Document 1 is the actual maldoc itself, document 2\nis the same document without all the malicious code. Document 1 will copy Document 2 to the file system\nand then \"peek\" inside of this document and pull out the oleObject.bin file. Contained inside of this\noleObject.bin file is a payload that is parsed out and executed on the file system.\n","inputs":{},"dependencies":[{"description":"Microsoft Word must be installed\n"}],"source_definition_sha256":"03e653bec471e5fc6f2c3bfba0c72b1dfbe96e0280661f291fde48e086a1b888"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1564":"/ttp-simulation/techniques/enterprise/T1564/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1564","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}