{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1574","id":"T1574","name":"Hijack Execution Flow","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1574","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"03dc723b25e3b5711709697266f56f48184c0078fde081d3f7af7f546bd009f6","description":"Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.\n\nThere are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.(Citation: Execution flow hijack attempt)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1574","external_id":"T1574"},{"source_name":"Execution flow hijack attempt","description":"Prisma Cloud Docs. (n.d.). Execution flow hijack attempt. Retrieved September 2, 2026.","url":"https://docs.prismacloud.io/admin-guide/runtime-defense/incident-types/execution-flow-hijack-attempt"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"},{"key":"enterprise/T1574.004","id":"T1574.004","name":"Dylib Hijacking","page":"techniques/enterprise/T1574.004/"},{"key":"enterprise/T1574.005","id":"T1574.005","name":"Executable Installer File Permissions Weakness","page":"techniques/enterprise/T1574.005/"},{"key":"enterprise/T1574.006","id":"T1574.006","name":"Dynamic Linker Hijacking","page":"techniques/enterprise/T1574.006/"},{"key":"enterprise/T1574.007","id":"T1574.007","name":"Path Interception by PATH Environment Variable","page":"techniques/enterprise/T1574.007/"},{"key":"enterprise/T1574.008","id":"T1574.008","name":"Path Interception by Search Order Hijacking","page":"techniques/enterprise/T1574.008/"},{"key":"enterprise/T1574.009","id":"T1574.009","name":"Path Interception by Unquoted Path","page":"techniques/enterprise/T1574.009/"},{"key":"enterprise/T1574.010","id":"T1574.010","name":"Services File Permissions Weakness","page":"techniques/enterprise/T1574.010/"},{"key":"enterprise/T1574.011","id":"T1574.011","name":"Services Registry Permissions Weakness","page":"techniques/enterprise/T1574.011/"},{"key":"enterprise/T1574.012","id":"T1574.012","name":"COR_PROFILER","page":"techniques/enterprise/T1574.012/"},{"key":"enterprise/T1574.013","id":"T1574.013","name":"KernelCallbackTable","page":"techniques/enterprise/T1574.013/"},{"key":"enterprise/T1574.014","id":"T1574.014","name":"AppDomainManager","page":"techniques/enterprise/T1574.014/"}],"telemetry":[{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0041","name":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component","category":"Host state and inventory","description":"Service configuration and current state at observation time.","collection_focus":"Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["service","executable","start_mode","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1574","id":"T1574","name":"Hijack Execution Flow","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1574","technique_page":"techniques/enterprise/T1574/","page":"detections/enterprise/T1574/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c","title":"Potential Initial Access via DLL Search Order Hijacking","status":"test","level":"medium","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml","author":"Tim Rauch (rule), Elastic (idea)","kind":"sigma"},{"id":"a2910908-e86f-4687-aeba-76a5f996e652","title":"DLL Execution Via Register-cimprovider.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a2910908-e86f-4687-aeba-76a5f996e652.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml","author":"Ivan Dyachkov, Yulia Fomina, oscd.community","kind":"sigma"},{"id":"50919691-7302-437f-8e10-1fe088afa145","title":"Regsvr32 DLL Execution With Uncommon Extension","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/50919691-7302-437f-8e10-1fe088afa145.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_regsvr32_uncommon_extension.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"9827ae57-3802-418f-994b-d5ecf5cd974b","title":"Potential Registry Persistence Attempt Via DbgManagedDebugger","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/9827ae57-3802-418f-994b-d5ecf5cd974b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_dbgmanageddebugger_persistence.yml","author":"frack113","kind":"sigma"},{"id":"e0813366-0407-449a-9869-a2db1119dc41","title":"Suspicious Printer Driver Empty Manufacturer","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/e0813366-0407-449a-9869-a2db1119dc41.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_susp_printer_driver.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0218","name":"Detection Strategy for Hijack Execution Flow across OS platforms.","url":"https://attack.mitre.org/detectionstrategies/DET0218","stix_id":"x-mitre-detection-strategy--07669925-383b-455b-a3e2-3a79e18eed27","relationship_id":"relationship--978cce2b-4185-4d79-87c9-4754712b5623","description":"","analytics":[{"id":"AN0609","name":"Analytic 0609","guidance":"Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.","url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0609","platforms":["Windows"],"tuning":[{"field":"ServiceBaseline","description":"Expected registry keys and service paths for comparison."},{"field":"AllowedDllPaths","description":"Directories considered valid for DLL loading."},{"field":"TimeWindow","description":"Correlation interval between registry/file modification and process execution."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0609","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0609","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0609","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0609","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Security","channel":"EventCode=4657","platforms":["Windows"],"analytic_id":"AN0609","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0609","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0609","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0609","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]},{"id":"AN0610","name":"Analytic 0610","guidance":"Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.","url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0610","platforms":["Linux"],"tuning":[{"field":"MonitoredDirectories","description":"Directories where binary replacement should trigger alerts."},{"field":"EnvVarMonitors","description":"Environment variables like LD_PRELOAD or PATH to monitor."}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin","platforms":["Linux"],"analytic_id":"AN0610","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0610","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0041","component":"Service Metadata","name":"linux:syslog","channel":"Service restart with modified executable path","platforms":["Linux"],"analytic_id":"AN0610","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0610","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"},{"component_id":"DC0032","component":"Process Creation","name":"linux:osquery","channel":"Process execution with LD_PRELOAD or modified library path","platforms":["Linux"],"analytic_id":"AN0610","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0610","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0611","name":"Analytic 0611","guidance":"Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0611","platforms":["macOS"],"tuning":[{"field":"AllowedDylibPaths","description":"Baseline directories for dylib loading."},{"field":"PlistMonitors","description":"Specific plist files used for persistence monitoring."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Execution of process with DYLD_INSERT_LIBRARIES set","platforms":["macOS"],"analytic_id":"AN0611","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0611","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0061","component":"File Modification","name":"macos:unifiedlog","channel":"Modified application plist or binary replacement in /Applications","platforms":["macOS"],"analytic_id":"AN0611","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0611","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0016","component":"Module Load","name":"macos:unifiedlog","channel":"Dylib loaded from abnormal location","platforms":["macOS"],"analytic_id":"AN0611","source_url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0611","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]}]}],"telemetry_references":[{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0041","name":"Service Metadata","tag":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0354","name":"Denis","url":"https://attack.mitre.org/software/S0354","kind":"malware","description":"[Denis](https://attack.mitre.org/software/S0354) replaces the nonexistent Windows DLL \"msfte.dll\" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--70ed2026-90af-4236-8180-2c095bbce0fe","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0444","name":"ShimRat","url":"https://attack.mitre.org/software/S0444","kind":"malware","description":"[ShimRat](https://attack.mitre.org/software/S0444) can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--58238854-4649-4cea-a43d-aae442dc60a6","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0567","name":"Dtrack","url":"https://attack.mitre.org/software/S0567","kind":"malware","description":"One of [Dtrack](https://attack.mitre.org/software/S0567) can replace the normal flow of a program execution with malicious code.(Citation: CyberBit Dtrack)","relationship_id":"relationship--28291398-1281-404e-9603-8aae5a5a9919","references":[{"source_name":"CyberBit Dtrack","description":"Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) will use the malicious file <code>slideshow.mp4</code> if present to load the core API provided by <code>ntdll.dll</code> to avoid any hooks placed on calls to the original <code>ntdll.dll</code> file by endpoint detection and response or antimalware software.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--def2b383-6cea-4c69-ada2-b3e0e58c43e5","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1105","name":"COATHANGER","url":"https://attack.mitre.org/software/S1105","kind":"malware","description":"[COATHANGER](https://attack.mitre.org/software/S1105) will remove and write malicious shared objects associated with legitimate system functions such as `read(2)`.(Citation: NCSC-NL COATHANGER Feb 2024)","relationship_id":"relationship--a2165d87-3372-4d1d-b622-9705a4eb9b41","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","description":"Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) edits the Registry key <code>HKCU\\Software\\Classes\\mscfile\\shell\\open\\command</code> to execute a malicious AutoIt script.(Citation: Ensilo Darkgate 2018) When eventvwr.exe is executed, this will call the Microsoft Management Console (mmc.exe), which in turn references the modified Registry key.","relationship_id":"relationship--1bb9c007-9110-45c8-9d86-b6c20d408308","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) will drop a copy of itself to a subfolder in <code>%Program Data%</code> or <code>%Program Data%\\\\Microsoft\\\\</code> to attempt privilege elevation and defense evasion if not running in Session 0.(Citation: TrendMicro RaspberryRobin 2022)","relationship_id":"relationship--59720c1c-115a-4206-aaa0-42ec4b03f6eb","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"}]},{"id":"S1147","name":"Nightdoor","url":"https://attack.mitre.org/software/S1147","kind":"malware","description":"[Nightdoor](https://attack.mitre.org/software/S1147) uses a legitimate executable to load a malicious DLL file for installation.(Citation: Symantec Daggerfly 2024)","relationship_id":"relationship--75b9ee03-bb9d-49a9-97e4-1979ff6ecbbf","references":[{"source_name":"Symantec Daggerfly 2024","description":"Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset"}]},{"id":"S9024","name":"SPAWNCHIMERA","url":"https://attack.mitre.org/software/S9024","kind":"malware","description":"[SPAWNCHIMERA](https://attack.mitre.org/software/S9024) can persist across system upgrades by hijacking the execution flow of dspkginstall, a binary used during the system upgrade process.(Citation: Google UNC5221 Ivanti January 2025)(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024)","relationship_id":"relationship--3270c057-e0ee-4a0c-a503-cad4782b6dc2","references":[{"source_name":"Google UNC5221 Ivanti January 2025","description":"John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","description":"Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"}]}],"actors":[],"mitigations":[{"id":"M1013","name":"Application Developer Guidance","url":"https://attack.mitre.org/mitigations/M1013","kind":"course-of-action","description":"When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.(Citation: FireEye DLL Side-Loading)","relationship_id":"relationship--4f806196-7c20-4923-ae01-8f0f7f27a4a7","references":[{"source_name":"FireEye DLL Side-Loading","description":"Amanda Steward. (2014). FireEye DLL Side-Loading: A Thorn in the Side of the Anti-Virus Industry. Retrieved March 13, 2020.","url":"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf"}]},{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able.\n\nEnsure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory <code>C:</code> and system directories, such as <code>C:\\Windows\\</code>, to reduce places where malicious files could be placed for execution.","relationship_id":"relationship--523ef32d-7463-4774-a473-fcccb5b0dadd","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Install software in write-protected locations. Set directory access controls to prevent file writes to the search paths for applications, both in the folders where applications are run from and the standard library folders.","relationship_id":"relationship--7253ab74-8fbb-422b-bf37-258981865b87","references":[]},{"id":"M1024","name":"Restrict Registry Permissions","url":"https://attack.mitre.org/mitigations/M1024","kind":"course-of-action","description":"Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.","relationship_id":"relationship--85422378-e9d7-4bd2-8b57-73fba0641448","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.","relationship_id":"relationship--6fa01dcb-e06c-4f8b-b6a2-c301f0198df4","references":[]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"Some endpoint security solutions can be configured to block some types of behaviors related to process injection/memory tampering based on common sequences of indicators (ex: execution of specific API functions).","relationship_id":"relationship--39acd21f-8be0-4116-9449-09d1f4dd91fd","references":[]},{"id":"M1044","name":"Restrict Library Loading","url":"https://attack.mitre.org/mitigations/M1044","kind":"course-of-action","description":"Disallow loading of remote DLLs. This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+.\n\nEnable Safe DLL Search Mode to force search for system DLLs in directories with greater restrictions (e.g. <code>%SYSTEMROOT%</code>)to be used before local directory DLLs (e.g. a user's home directory)\n\nThe Safe DLL Search Mode can be enabled via Group Policy at Computer Configuration > [Policies] > Administrative Templates > MSS (Legacy): MSS: (SafeDllSearchMode) Enable Safe DLL search mode. The associated Windows Registry key for this is located at <code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\SafeDLLSearchMode</code>(Citation: Microsoft More information about DLL)(Citation: Microsoft Dynamic Link Library Search Order)","relationship_id":"relationship--46eeb6fa-2dcb-4c86-b79e-8891b2e72566","references":[{"source_name":"Microsoft More information about DLL","description":"Microsoft. (2010, August 12). More information about the DLL Preloading remote attack vector. Retrieved December 5, 2014.","url":"https://msrc-blog.microsoft.com/2010/08/23/more-information-about-the-dll-preloading-remote-attack-vector/"},{"source_name":"Microsoft Dynamic Link Library Search Order","description":"Microsoft. (2018, May 31). Dynamic-Link Library Search Order. Retrieved November 30, 2014.","url":"https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Use auditing tools capable of detecting hijacking opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for hijacking weaknesses.(Citation: Powersploit)\n\nUse the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-loading vulnerabilities in software.\n\nFind and eliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them. Be aware of the search order Windows uses for executing or loading binaries and use fully qualified paths wherever appropriate.\n\nClean up old Windows Registry keys when software is uninstalled to avoid keys with no associated legitimate binaries. Periodically search for and correct or report path interception weaknesses on systems that may have been introduced using custom or available tools that report software using insecure path configurations.(Citation: Microsoft CreateProcess)(Citation: Microsoft Dynamic-Link Library Security)(Citation: Vulnerability and Exploit Detector)","relationship_id":"relationship--4cc78773-df9f-40d8-a2e5-eb2eadb05409","references":[{"source_name":"Vulnerability and Exploit Detector","description":"Kanthak, S.. (2016, July 20). Vulnerability and Exploit Detector. Retrieved February 3, 2017.","url":"https://skanthak.homepage.t-online.de/sentinel.html"},{"source_name":"Microsoft CreateProcess","description":"Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024.","url":"https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa"},{"source_name":"Microsoft Dynamic-Link Library Security","description":"Microsoft. (n.d.). Dynamic-Link Library Security. Retrieved July 25, 2016.","url":"https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-security?redirectedfrom=MSDN"},{"source_name":"Powersploit","description":"PowerSploit. (n.d.). Retrieved December 4, 2014.","url":"https://github.com/mattifestation/PowerSploit"}]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Update software regularly to include patches that fix DLL side-loading vulnerabilities.","relationship_id":"relationship--62c9a1c7-557e-433b-b422-3427a308f34e","references":[]},{"id":"M1052","name":"User Account Control","url":"https://attack.mitre.org/mitigations/M1052","kind":"course-of-action","description":"Turn off UAC's privilege elevation for standard users <code>[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System]</code> to automatically deny elevation requests, add: <code>\"ConsentPromptBehaviorUser\"=dword:00000000</code>. Consider enabling installer detection for all users by adding: <code>\"EnableInstallerDetection\"=dword:00000001</code>. This will prompt for a password for installation and also log the attempt. To disable installer detection, instead add: <code>\"EnableInstallerDetection\"=dword:00000000</code>. This may prevent potential elevation of privileges through exploitation during the process of UAC detecting the installer, but will allow the installation process to continue without being logged.  (Citation: Executable Installers are Vulnerable)","relationship_id":"relationship--214e4329-960c-4c25-8620-b9573a6e06dc","references":[{"source_name":"Executable Installers are Vulnerable","description":"Stefan Kanthak. (2015, December 8). Executable installers are vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation of privilege. Retrieved December 4, 2014.","url":"https://seclists.org/fulldisclosure/2015/Dec/34"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1574":"/ttp-simulation/techniques/enterprise/T1574/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1574","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}