{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1587","id":"T1587","name":"Develop Capabilities","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1587","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"fb60e8b6ea9ac993883ba9c895c527d9687b2c11f68be5dbcb011c656dce8030","description":"Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)\n\nAs with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. Adversaries may also employ the use of [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007) for development.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1587","external_id":"T1587"},{"source_name":"Kaspersky Sofacy","description":"Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.","url":"https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"},{"source_name":"Mandiant APT1","description":"Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"},{"source_name":"Talos Promethium June 2020","description":"Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source_name":"Bitdefender StrongPity June 2020","description":"Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1587.001","id":"T1587.001","name":"Malware","page":"techniques/enterprise/T1587.001/"},{"key":"enterprise/T1587.002","id":"T1587.002","name":"Code Signing Certificates","page":"techniques/enterprise/T1587.002/"},{"key":"enterprise/T1587.003","id":"T1587.003","name":"Digital Certificates","page":"techniques/enterprise/T1587.003/"},{"key":"enterprise/T1587.004","id":"T1587.004","name":"Exploits","page":"techniques/enterprise/T1587.004/"}],"telemetry":[{"id":"DC0011","name":"Malware Content","page":"telemetry/DC0011/","kind":"attack_component","category":"Sample analysis and intelligence","description":"The bytes or extracted content of a malware sample used in analysis, rather than only its filename or verdict.","collection_focus":"Use an isolated sample repository and authorized analysis tooling; preserve hashes, extraction method and custody. Do not execute samples to populate this page.","providers":[{"name":"YARA","scope":"Static rule matches and matched strings on authorized files; not proof of execution or attribution.","source_id":"yara"},{"name":"Authorized sample repositories / STIX analysis reports","scope":"Sample identity, provenance and analysis observations; access and retention are separately controlled.","source_id":"stix"}],"configuration":["Work offline with an authorized sample or benign fixture; record its SHA-256, origin and custody before analysis.","For static matching, pin reviewed YARA rules/tool version and capture match IDs and offsets where needed. Treat untrusted rules and samples as untrusted input.","Store sanitized findings separately from restricted sample bytes. Label static observations, verdicts and any independently obtained dynamic results distinctly."],"configuration_example":null,"required_fields":["sample_sha256","artifact_kind","content","offset"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0011","collector":"illustrative-lab-collector","observation":{"sample_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","artifact_kind":"extracted_string","content":"BENIGN LAB MARKER","offset":4096}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A rule match is not a confirmed infection. Metadata is not payload content, and static analysis does not prove a behavior occurred on a victim. No samples are executed by this module.","sources":[{"id":"yara","title":"YARA command-line analysis","url":"https://yara.readthedocs.io/en/stable/commandline.html"},{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"}],"association":"attack_component","anomaly_design":"Compare sample metadata, behavior traces and structural characteristics against an appropriate analysis corpus. Sample availability and sandbox execution differ from observing a compromise on a protected asset."},{"id":"DC0003","name":"Malware Metadata","page":"telemetry/DC0003/","kind":"attack_component","category":"Sample analysis and intelligence","description":"Descriptive attributes of a suspicious software sample or malware analysis record.","collection_focus":"Ingest permitted analysis metadata with sample hash, tool/version, submission provenance and confidence; keep verdicts separate from observed facts.","providers":[{"name":"YARA","scope":"Static rule matches and matched strings on authorized files; not proof of execution or attribution.","source_id":"yara"},{"name":"Authorized sample repositories / STIX analysis reports","scope":"Sample identity, provenance and analysis observations; access and retention are separately controlled.","source_id":"stix"}],"configuration":["Work offline with an authorized sample or benign fixture; record its SHA-256, origin and custody before analysis.","For static matching, pin reviewed YARA rules/tool version and capture match IDs and offsets where needed. Treat untrusted rules and samples as untrusted input.","Store sanitized findings separately from restricted sample bytes. Label static observations, verdicts and any independently obtained dynamic results distinctly."],"configuration_example":null,"required_fields":["sample_sha256","file_type","analysis_status","verdict"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0003","collector":"illustrative-lab-collector","observation":{"sample_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","file_type":"PE32","analysis_status":"static_only","verdict":"undetermined"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A rule match is not a confirmed infection. Metadata is not payload content, and static analysis does not prove a behavior occurred on a victim. No samples are executed by this module.","sources":[{"id":"yara","title":"YARA command-line analysis","url":"https://yara.readthedocs.io/en/stable/commandline.html"},{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"}],"association":"attack_component","anomaly_design":"Compare sample metadata, behavior traces and structural characteristics against an appropriate analysis corpus. Sample availability and sandbox execution differ from observing a compromise on a protected asset."},{"id":"DC0104","name":"Response Content","page":"telemetry/DC0104/","kind":"attack_component","category":"Network and protocol telemetry","description":"Content returned by a queried service, such as an HTTP response body or banner.","collection_focus":"Capture responses only from authorized lab services or approved datasets; retain request context, response hash and a sanitized bounded excerpt.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["service","response_excerpt","content_type","body_truncated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1587","id":"T1587","name":"Develop Capabilities","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1587","technique_page":"techniques/enterprise/T1587/","page":"detections/enterprise/T1587/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc","title":"Program Executions in Suspicious Folders","status":"test","level":"medium","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"a015e032-146d-4717-8944-7a1884122111","title":"Linux HackTool Execution","status":"test","level":"high","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/a015e032-146d-4717-8944-7a1884122111.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])","kind":"sigma"},{"id":"ff23ffbc-3378-435e-992f-0624dcf93ab4","title":"HackTool - PurpleSharp Execution","status":"test","level":"critical","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ff23ffbc-3378-435e-992f-0624dcf93ab4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_purplesharp_indicators.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0853","name":"Detection of Develop Capabilities","url":"https://attack.mitre.org/detectionstrategies/DET0853","stix_id":"x-mitre-detection-strategy--7ad9b54d-cd23-4ec3-a5b2-db5e58e82a02","relationship_id":"relationship--3df2d4e2-f5f0-4c63-9d8f-d70b5722fe70","description":"","analytics":[{"id":"AN1985","name":"Analytic 1985","guidance":"Consider analyzing malware for features that may be associated with the adversary and/or their developers, such as compiler used, debugging artifacts, or code similarities. Malware repositories can also be used to identify additional samples associated with the adversary and identify development patterns over time. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.\nMonitor for contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.\nConsider use of services that may aid in the tracking of capabilities, such as certificates, in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of information to uncover other adversary infrastructure. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.","url":"https://attack.mitre.org/detectionstrategies/DET0853#AN1985","platforms":["PRE"],"tuning":[],"log_sources":[{"component_id":"DC0011","component":"Malware Content","name":"Malware Repository","channel":"None","platforms":["PRE"],"analytic_id":"AN1985","source_url":"https://attack.mitre.org/detectionstrategies/DET0853#AN1985","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0011/"},{"component_id":"DC0003","component":"Malware Metadata","name":"Malware Repository","channel":"None","platforms":["PRE"],"analytic_id":"AN1985","source_url":"https://attack.mitre.org/detectionstrategies/DET0853#AN1985","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0003/"},{"component_id":"DC0104","component":"Response Content","name":"Internet Scan","channel":"None","platforms":["PRE"],"analytic_id":"AN1985","source_url":"https://attack.mitre.org/detectionstrategies/DET0853#AN1985","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0104/"}]}]}],"telemetry_references":[{"id":"DC0011","name":"Malware Content","tag":"Malware Content","page":"telemetry/DC0011/","kind":"attack_component"},{"id":"DC0003","name":"Malware Metadata","tag":"Malware Metadata","page":"telemetry/DC0003/","kind":"attack_component"},{"id":"DC0104","name":"Response Content","tag":"Response Content","page":"telemetry/DC0104/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) created and used a mailing toolkit to use in spearphishing attacks.(Citation: VirusBulletin Kimsuky October 2019)","relationship_id":"relationship--2098e2bc-2b20-463a-9862-20fe68268cfc","references":[{"source_name":"VirusBulletin Kimsuky October 2019","description":"Kim, J. et al. (2019, October). KIMSUKY GROUP: TRACKING THE KING OF THE SPEAR PHISHING. Retrieved November 2, 2020.","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"}]},{"id":"G1036","name":"Moonstone Sleet","url":"https://attack.mitre.org/groups/G1036","kind":"intrusion-set","description":"[Moonstone Sleet](https://attack.mitre.org/groups/G1036) developed malicious npm packages for delivery to or retrieval by victims.(Citation: Microsoft Moonstone Sleet 2024)","relationship_id":"relationship--f6072bdd-734e-4fa0-b11a-d02fed4f19ec","references":[{"source_name":"Microsoft Moonstone Sleet 2024","description":"Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has hosted and attended formal training programs for foreign-made IT products to include Cisco Network Academy.(Citation: CarySentinelLabs_CiscoSaltTyphoon_Dec2025)  ","relationship_id":"relationship--b23aa7d1-3752-423f-bf19-8595230406dc","references":[{"source_name":"CarySentinelLabs_CiscoSaltTyphoon_Dec2025","description":"Cary, D. (2025, December 10). Malicious Apprentice | How Two Hackers Went From Cisco Academy to Cisco CVEs. Retrieved September 22, 2026.","url":"https://www.sentinelone.com/labs/malicious-apprentice-how-two-hackers-went-from-cisco-academy-to-cisco-cves/"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) developed malicious NPM packages for delivery to or retrieval by victims.(Citation: Sentinel One Contagious Interview ClickFix September 2025)(Citation: Validin Contagious Interview North Korea ClickFix January 2025)(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: Socket Contagious Interview NPM April 2025)(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)","relationship_id":"relationship--697ba5b6-f90a-45f2-a205-d0db15d39961","references":[{"source_name":"Sentinel One Contagious Interview ClickFix September 2025","description":"Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion. (2025, September 4). Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Retrieved October 20, 2025.","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source_name":"Validin Contagious Interview North Korea ClickFix January 2025","description":"Efstratios Lontzetidis. (2025, January 16). Lazarus APT: Techniques for Hunting Contagious Interview. Retrieved October 20, 2025.","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"Socket Contagious Interview NPM April 2025","description":"Kirill Boychenko. (2025, April 4). Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads. Retrieved October 20, 2025.","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","description":"Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]}],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.","relationship_id":"relationship--17fde86e-66f2-4432-881c-b162c0501204","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1588.007":"/ttp-simulation/techniques/enterprise/T1588.007/","T1587":"/ttp-simulation/techniques/enterprise/T1587/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1587","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0011","collector":"illustrative-lab-collector","observation":{"sample_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","artifact_kind":"extracted_string","content":"BENIGN LAB MARKER","offset":4096}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0003","collector":"illustrative-lab-collector","observation":{"sample_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","file_type":"PE32","analysis_status":"static_only","verdict":"undetermined"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}}]}}