{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1573","id":"T1573","name":"Encrypted Channel","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1573","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"cff28990440e87b199dc5edce5a331dd25743842670a8db69b1865fb56a79a49","description":"Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1573","external_id":"T1573"},{"source_name":"SANS Decrypting SSL","description":"Butler, M. (2013, November). Finding Hidden Threats by Decrypting SSL. Retrieved April 5, 2016.","url":"http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840"},{"source_name":"SEI SSL Inspection Risks","description":"Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved April 5, 2016.","url":"https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html"},{"source_name":"University of Birmingham C2","description":"Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.","url":"https://arxiv.org/pdf/1408.1136"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1573.001","id":"T1573.001","name":"Symmetric Cryptography","page":"techniques/enterprise/T1573.001/"},{"key":"enterprise/T1573.002","id":"T1573.002","name":"Asymmetric Cryptography","page":"techniques/enterprise/T1573.002/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1573","id":"T1573","name":"Encrypted Channel","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1573","technique_page":"techniques/enterprise/T1573/","page":"detections/enterprise/T1573/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"a3501e8e-af9e-43c6-8cd6-9360bdaae498","title":"Activity from Suspicious IP Addresses","status":"test","level":"medium","logsource":{"service":"threat_detection","product":"m365"},"data_path":"data/detection-rules/a3501e8e-af9e-43c6-8cd6-9360bdaae498.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"d8b0a4fe-07a8-41be-bd39-b14afa025d95","title":"Activity from Anonymous IP Addresses","status":"test","level":"medium","logsource":{"service":"threat_management","product":"m365"},"data_path":"data/detection-rules/d8b0a4fe-07a8-41be-bd39-b14afa025d95.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"0f2468a2-5055-4212-a368-7321198ee706","title":"Activity from Infrequent Country","status":"test","level":"medium","logsource":{"service":"threat_management","product":"m365"},"data_path":"data/detection-rules/0f2468a2-5055-4212-a368-7321198ee706.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"195626f3-5f1b-4403-93b7-e6cfd4d6a078","title":"Suspicious SSL Connection","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/195626f3-5f1b-4403-93b7-e6cfd4d6a078.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1573-1","technique_id":"T1573","title":"T1573 Encrypted Channel","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#command-and-control","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":167,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L167","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"7d92b6403412207970c57b92a186c72e518111f1ff2669857904946ee9d37ee0","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(certificate_fingerprint OR tls_fingerprint IN denylist) OR MATCH(disallowed_tls_version_or_cipher) -> ALERT","log_sources":[{"title":"TLS and Certificate Metadata Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#71-tls-and-certificate-metadata-logs"},{"title":"Network Metadata Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#59-network-metadata-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1573-1","technique_id":"T1573","title":"Encrypted or obfuscated network channel — T1573 Encrypted Channel","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#encrypted-channel","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":111,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L111","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"c1bd060d9d6bedd2bbb415570ecfd015ca5c57f146e44ff9d8361051438221fa","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"host-destination TLS feature vector.","expected_behavior":"hosts use recurring certificate, protocol, cipher, and destination combinations.","deviation":"first-seen combination or peer-group deviation.","anomaly_types":[{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}],"log_sources":[{"title":"TLS and Certificate Metadata Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#71-tls-and-certificate-metadata-logs"},{"title":"Network Metadata Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#59-network-metadata-logs"}],"context_references":[{"title":"Truebot joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-187a-truebot.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/230707.pdf"}]}],"anomaly_types":[{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}],"strategies":[{"id":"DET0273","name":"Detection Strategy for Encrypted Channel across OS Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0273","stix_id":"x-mitre-detection-strategy--08861418-398c-4972-8850-5e11f2d32944","relationship_id":"relationship--2b484619-c72b-457d-b362-ceb882438231","description":"","analytics":[{"id":"AN0759","name":"Analytic 0759","guidance":"Processes that normally do not initiate network connections establishing outbound encrypted TLS/SSL sessions, especially with asymmetric traffic volumes (client sending more than receiving) or non-standard certificate chains. Defender observations correlate process creation with unexpected network encryption libraries being loaded.","url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0759","platforms":["Windows"],"tuning":[{"field":"AllowedEncryptedProcesses","description":"Whitelist processes expected to use TLS (e.g., browsers, mail clients)."},{"field":"EntropyThreshold","description":"Payload randomness threshold to distinguish C2 encryption from legitimate traffic."},{"field":"TimeWindow","description":"Correlation window between process creation, module load, and encrypted connection."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0759","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0759","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0759","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0759","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN0760","name":"Analytic 0760","guidance":"Processes like curl, wget, python, socat, or custom binaries initiating TLS/SSL sessions to non-standard destinations. Defender sees abnormal syscalls for connect(), loading of libssl libraries, and persistent outbound encrypted traffic from daemons not normally communicating externally.","url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0760","platforms":["Linux"],"tuning":[{"field":"WhitelistedDaemons","description":"Legitimate system services expected to use TLS (e.g., package updates)."},{"field":"CertificateAuthorities","description":"Trusted CAs; flag self-signed or unrecognized certs."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"socket/connect with TLS context by unexpected process","platforms":["Linux"],"analytic_id":"AN0760","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0760","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0038","component":"Application Log Content","name":"linux:syslog","channel":"system daemons initiating TLS sessions outside expected services","platforms":["Linux"],"analytic_id":"AN0760","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0760","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"linux:osquery","channel":"Processes linked with libssl or crypto libraries making outbound connections","platforms":["Linux"],"analytic_id":"AN0760","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0760","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0761","name":"Analytic 0761","guidance":"Applications or launchd jobs initiating encrypted TLS traffic to rare external hosts. Defender observes unified logs showing ssl/TLS API calls by processes not baseline-approved, and payload entropy suggesting encrypted C2 sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0761","platforms":["macOS"],"tuning":[{"field":"DoHResolvers","description":"Known legitimate DoH endpoints to reduce false positives."},{"field":"PayloadEntropyThreshold","description":"High-entropy traffic deviations used to detect concealed channels."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"macos:unifiedlog","channel":"Encrypted session initiation by unexpected binary","platforms":["macOS"],"analytic_id":"AN0761","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0761","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Process invoking SSL routines from Security framework","platforms":["macOS"],"analytic_id":"AN0761","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0761","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0762","name":"Analytic 0762","guidance":"VMware management daemons or guest processes initiating encrypted connections outside expected vCenter, update servers, or internal comms. Defender identifies hostd or vpxa initiating outbound TLS flows with uncommon destinations.","url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0762","platforms":["ESXi"],"tuning":[{"field":"AllowedMgmtHosts","description":"Baseline approved endpoints for vCenter or update services."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"esxi:vpxd","channel":"TLS session established by ESXi service to unapproved endpoint","platforms":["ESXi"],"analytic_id":"AN0762","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0762","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"esxi:vmkernel","channel":"Inspection of sockets showing encrypted sessions from non-baseline processes","platforms":["ESXi"],"analytic_id":"AN0762","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0762","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0763","name":"Analytic 0763","guidance":"Unusual TLS tunnels through ports not normally encrypted (e.g., TLS on port 8080, 53). Defender sees NetFlow/IPFIX or packet inspection indicating high-entropy traffic volumes and asymmetric client/server exchange ratios.","url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0763","platforms":["Network Devices"],"tuning":[{"field":"PortProfiles","description":"Define expected TLS port usage to flag anomalies."},{"field":"TrafficAsymmetryRatio","description":"Sent/received byte thresholds to catch hidden C2."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Session records with TLS-like byte patterns","platforms":["Network Devices"],"analytic_id":"AN0763","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0763","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Connections","channel":"Abnormal certificate chains or non-standard ports carrying TLS","platforms":["Network Devices"],"analytic_id":"AN0763","source_url":"https://attack.mitre.org/detectionstrategies/DET0273#AN0763","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) has encrypted TCP communications to evade detection.(Citation: Gh0stRAT ATT March 2019)","relationship_id":"relationship--cc2de45c-a1f3-4085-ac35-dffa8a86e9b3","references":[{"source_name":"Gh0stRAT ATT March 2019","description":"Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) can encrypt C2 communications.(Citation: Red Canary NETWIRE January 2020)","relationship_id":"relationship--ee35c721-0b74-4811-8d41-507270d0b9c7","references":[{"source_name":"Red Canary NETWIRE January 2020","description":"Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}]},{"id":"S0367","name":"Emotet","url":"https://attack.mitre.org/software/S0367","kind":"malware","description":"[Emotet](https://attack.mitre.org/software/S0367) has encrypted data before sending to the C2 server.(Citation: Fortinet Emotet May 2017)","relationship_id":"relationship--f18b11ea-4604-4c9e-8f12-6cfb526ef58c","references":[{"source_name":"Fortinet Emotet May 2017","description":"Xiaopeng Zhang. (2017, May 3). Deep Analysis of New Emotet Variant – Part 1. Retrieved April 1, 2019.","url":"https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1.html"}]},{"id":"S0498","name":"Cryptoistic","url":"https://attack.mitre.org/software/S0498","kind":"malware","description":"[Cryptoistic](https://attack.mitre.org/software/S0498) can engage in encrypted communications with C2.(Citation: SentinelOne Lazarus macOS July 2020)","relationship_id":"relationship--0d6e04e8-8e4c-4ef6-ab6a-12ddb498e93a","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","description":"Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}]},{"id":"S0631","name":"Chaes","url":"https://attack.mitre.org/software/S0631","kind":"malware","description":"[Chaes](https://attack.mitre.org/software/S0631) has used encryption for its C2 channel.(Citation: Cybereason Chaes Nov 2020) ","relationship_id":"relationship--1d182249-ed44-4e5b-877c-178760379015","references":[{"source_name":"Cybereason Chaes Nov 2020","description":"Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}]},{"id":"S0662","name":"RCSession","url":"https://attack.mitre.org/software/S0662","kind":"malware","description":"[RCSession](https://attack.mitre.org/software/S0662) can use an encrypted beacon to check in with C2.(Citation: Secureworks BRONZE PRESIDENT December 2019)","relationship_id":"relationship--0a47636e-8260-414d-aff7-7b1120778a51","references":[{"source_name":"Secureworks BRONZE PRESIDENT December 2019","description":"Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) can support encrypted communications between the client and server.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021)(Citation: Cocomazzi FIN7 Reboot)","relationship_id":"relationship--c77046c5-1ea2-4d3f-a19e-0ea7141d7e9c","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"},{"source_name":"Cocomazzi FIN7 Reboot","description":"Cocomazzi, Antonio. (2024, July 17). FIN7 Reboot | Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks. Retrieved September 24, 2025.","url":"https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/"},{"source_name":"Threatpost Lizar May 2021","description":"Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022.","url":"https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/"}]},{"id":"S1012","name":"PowerLess","url":"https://attack.mitre.org/software/S1012","kind":"malware","description":"[PowerLess](https://attack.mitre.org/software/S1012) can use an encrypted channel for C2 communications.(Citation: Cybereason PowerLess February 2022)","relationship_id":"relationship--7340fcbe-e87b-4f16-bdac-e429a0ba7714","references":[{"source_name":"Cybereason PowerLess February 2022","description":"Cybereason Nocturnus. (2022, February 1). PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage. Retrieved June 1, 2022.","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) has used TLS encryption to initialize a custom protocol for C2 communications.(Citation: ESET DazzleSpy Jan 2022)","relationship_id":"relationship--f04dbb1e-bf75-4eee-9222-374c704bc07b","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}]},{"id":"S1046","name":"PowGoop","url":"https://attack.mitre.org/software/S1046","kind":"malware","description":"[PowGoop](https://attack.mitre.org/software/S1046) can receive encrypted commands from C2.(Citation: DHS CISA AA22-055A MuddyWater February 2022)","relationship_id":"relationship--3c5b31ff-ba6a-47c0-adbe-ddd18845f684","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","description":"FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"id":"S1198","name":"Gomir","url":"https://attack.mitre.org/software/S1198","kind":"malware","description":"[Gomir](https://attack.mitre.org/software/S1198) uses a custom encryption algorithm for content sent to command and control infrastructure.(Citation: Symantec Troll Stealer 2024)","relationship_id":"relationship--1532b910-6bf8-4622-a183-0bb7fd18c4ae","references":[{"source_name":"Symantec Troll Stealer 2024","description":"Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}]}],"actors":[{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) has used multiple layers of encryption within malware to protect C2 communication.(Citation: Secureworks IRON HEMLOCK Profile)","relationship_id":"relationship--a8981fca-0584-4e9e-8f92-83843e1e4462","references":[{"source_name":"Secureworks IRON HEMLOCK Profile","description":"Secureworks CTU. (n.d.). IRON HEMLOCK. Retrieved February 22, 2022.","url":"http://www.secureworks.com/research/threat-profiles/iron-hemlock"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has used an encrypted http proxy in C2 communications.(Citation: DFIR Phosphorus November 2021)","relationship_id":"relationship--665e5a7f-e575-44c7-839d-4c69f14238d2","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) has encrypted traffic with the C2 to prevent network detection.(Citation: TrendMicro Tropic Trooper May 2020)","relationship_id":"relationship--3089fe6b-36d6-4890-b70b-1a76f55c84ff","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"G1002","name":"BITTER","url":"https://attack.mitre.org/groups/G1002","kind":"intrusion-set","description":"[BITTER](https://attack.mitre.org/groups/G1002) has encrypted their C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)","relationship_id":"relationship--79192884-411c-490d-a28e-f923be7070e3","references":[{"source_name":"Forcepoint BITTER Pakistan Oct 2016","description":"Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022.","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]}],"mitigations":[{"id":"M1020","name":"SSL/TLS Inspection","url":"https://attack.mitre.org/mitigations/M1020","kind":"course-of-action","description":"SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.","relationship_id":"relationship--d62449f0-cecd-466f-b3e8-c6908f48cfaa","references":[]},{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.","relationship_id":"relationship--c1b721af-9d2b-47a2-a712-3bff64628148","references":[]}],"candidates":[{"id":"21caf58e-87ad-440c-a6b8-3ac259964003","name":"OpenSSL C2","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1573/T1573.yaml","description":"Thanks to @OrOneEqualsOne for this quick C2 method.\nThis is to test to see if a C2 session can be established using an SSL socket.\nMore information about this technique, including how to set up the listener, can be found here:\nhttps://medium.com/walmartlabs/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926\n\nUpon successful execution, powershell will make a network connection to 127.0.0.1 over 443.\n","inputs":{"server_ip":{"description":"IP of the external server","type":"string","default":"127.0.0.1"},"server_port":{"description":"The port to connect to on the external server","type":"string","default":"443"}},"dependencies":[],"source_definition_sha256":"118189948424850fab1f682a6e4918e1ed7107e2c8583f74e2d5e05fc40f3dc2"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1573":"/ttp-simulation/techniques/enterprise/T1573/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1573","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}