{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1688","id":"T1688","name":"Safe Mode Boot","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1688","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"63141f66e5165b409cf6d8ef47ef3a1e1fbf79f75d9a409173472ccc66535ba9","description":"Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Windows Startup Settings)(Citation: Sophos Safe Mode Boot)\n\nAdversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit)\n\nAdversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason safe mode boot)(Citation: BleepingComputer REvil 2021)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1688","external_id":"T1688"},{"source_name":"BleepingComputer REvil 2021","description":"Abrams, L. (2021, March 19). REvil ransomware has a new ‘Windows Safe Mode’ encryption mode. Retrieved June 23, 2021.","url":"https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/"},{"source_name":"Sophos Safe Mode Boot","description":"Andrew Brandt. (2019, December 9). Snatch ransomware reboots PCs into Safe Mode to bypass protection. Retrieved April 15, 2026.","url":"https://www.sophos.com/en-us/blog/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection"},{"source_name":"Cybereason safe mode boot","description":"Cybereason Nocturnus. (n.d.). Cybereason vs. MedusaLocker Ransomware. Retrieved April 15, 2026.","url":"https://www.cybereason.com/blog/research/medusalocker-ransomware"},{"source_name":"Microsoft Windows Startup Settings","description":"Microsoft. (n.d.). Retrieved April 15, 2026.","url":"https://support.microsoft.com/en-us/windows/windows-startup-settings-1af6ec8c-4d4a-4b23-adb7-e76eef0b847f"},{"source_name":"Microsoft bcdedit","description":"Microsoft. (n.d.). Retrieved April 15, 2026.","url":"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit"},{"source_name":"CyberArk Labs Safe Mode 2016","description":"Naim, D.. (2016, September 15). CyberArk Labs: From Safe Mode to Domain Compromise. Retrieved June 23, 2021.","url":"https://www.cyberark.com/resources/blog/cyberark-labs-from-safe-mode-to-domain-compromise"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0056","name":"Windows Registry Key Creation","page":"telemetry/DC0056/","kind":"attack_component","category":"Endpoint activity","description":"Creation of Windows registry keys or values.","collection_focus":"Use RegistryEvent (12) and filter CreateKey/CreateValue as available; retain target object and process identity.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","process_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0056","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Demo","event_type":"CreateKey","process_id":4200}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1688","id":"T1688","name":"Safe Mode Boot","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1688","technique_page":"techniques/enterprise/T1688/","page":"detections/enterprise/T1688/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0116","name":"Detection Strategy for Safe Mode Boot Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0116","stix_id":"x-mitre-detection-strategy--8c92a33f-ac2f-4ae9-9258-7a6a67922ad4","relationship_id":"relationship--4d94e952-43b7-490e-9e2a-6d07235952b9","description":"","analytics":[{"id":"AN0323","name":"Analytic 0323","guidance":"Abuse of safe mode via BCD modification, boot configuration utilities (bcdedit.exe, bootcfg.exe), and registry persistence under SafeBoot keys. Defender view: suspicious boot configuration changes correlated with registry edits that enable adversary persistence or disable defenses.","url":"https://attack.mitre.org/detectionstrategies/DET0116#AN0323","platforms":["Windows"],"tuning":[{"field":"SafeBootRegistryPaths","description":"Customize monitored registry paths for safe mode service additions."},{"field":"AllowedAdminTools","description":"Whitelist legitimate administrative use of bcdedit/bootcfg for troubleshooting."},{"field":"TimeWindow","description":"Correlate registry modifications and boot configuration commands within a short timeframe."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0323","source_url":"https://attack.mitre.org/detectionstrategies/DET0116#AN0323","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN0323","source_url":"https://attack.mitre.org/detectionstrategies/DET0116#AN0323","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"},{"component_id":"DC0056","component":"Windows Registry Key Creation","name":"WinEventLog:Sysmon","channel":"EventCode=12","platforms":["Windows"],"analytic_id":"AN0323","source_url":"https://attack.mitre.org/detectionstrategies/DET0116#AN0323","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0056/"}]}]}],"telemetry_references":[{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0056","name":"Windows Registry Key Creation","tag":"Windows Registry Key Creation","page":"telemetry/DC0056/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can force a reboot in safe mode with networking.(Citation: BleepingComputer REvil 2021)","relationship_id":"relationship--ac61af37-72e0-410f-96a9-453519a20747","references":[{"source_name":"BleepingComputer REvil 2021","description":"Abrams, L. (2021, March 19). REvil ransomware has a new ‘Windows Safe Mode’ encryption mode. Retrieved June 23, 2021.","url":"https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) can restart a compromised machine in safe mode.(Citation: Trend Micro AvosLocker Apr 2022)(Citation: Costa AvosLocker May 2022) ","relationship_id":"relationship--3b089236-9b2f-40ee-9230-6961de8a60be","references":[{"source_name":"Costa AvosLocker May 2022","description":"Costa, F. (2022, May 1). RaaS AvosLocker Incident Response Analysis. Retrieved January 11, 2023.","url":"https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory"},{"source_name":"Trend Micro AvosLocker Apr 2022","description":"Trend Micro Research. (2022, April 4). Ransomware Spotlight AvosLocker. Retrieved January 11, 2023.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) can reboot victim machines in safe mode with networking via `bcdedit /set safeboot network`.(Citation: Minerva Labs Black Basta May 2022)(Citation: Cyble Black Basta May 2022)(Citation: Trend Micro Black Basta May 2022)(Citation: Avertium Black Basta June 2022)(Citation: Palo Alto Networks Black Basta August 2022)","relationship_id":"relationship--bce6eb76-c438-41b0-8dca-6a2d29844abd","references":[{"source_name":"Avertium Black Basta June 2022","description":"Avertium. (2022, June 1). AN IN-DEPTH LOOK AT BLACK BASTA RANSOMWARE. Retrieved March 7, 2023.","url":"https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware"},{"source_name":"Cyble Black Basta May 2022","description":"Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Palo Alto Networks Black Basta August 2022","description":"Elsad, A. (2022, August 25). Threat Assessment: Black Basta Ransomware. Retrieved March 8, 2023.","url":"https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware"},{"source_name":"Trend Micro Black Basta May 2022","description":"Gonzalez, I., Chavez I., et al. (2022, May 9). Examining the Black Basta Ransomware’s Infection Routine. Retrieved March 7, 2023.","url":"https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html"},{"source_name":"Minerva Labs Black Basta May 2022","description":"Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023.","url":"https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can reboot the infected host into Safe Mode.(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)","relationship_id":"relationship--e683db23-0a9e-408f-8197-7d88c52f360a","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) can reboot targeted systems into Safe Mode prior to encryption.(Citation: Group-IB RansomHub FEB 2025)","relationship_id":"relationship--ee04cde4-5567-4e30-b316-ead0c20e3f86","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can reboot targeted systems in safe mode to avoid detection.(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: BushidoToken Qilin RaaS JUN 2024)","relationship_id":"relationship--d6c69c31-f292-4939-82e2-addbd84604e9","references":[{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"BushidoToken Qilin RaaS JUN 2024","description":"Thomas, W. (2024, June 12). Tracking Adversaries: The Qilin RaaS. Retrieved September 26, 2025.","url":"https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has used a DLL variant of MDeployer to disable security solutions through Safe Mode.(Citation: ESET Embargo Ransomware October 2024)","relationship_id":"relationship--23c9b72a-ae73-4d2d-a127-34c33ae0311d","references":[{"source_name":"ESET Embargo Ransomware October 2024","description":"Jan Holman, Tomas Zvara. (2024, October 23). Embargo ransomware: Rock’n’Rust. Retrieved October 19, 2025.","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}]}],"actors":[],"mitigations":[{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Restrict administrator accounts to as few individuals as possible, following least privilege principles, that may be abused to remotely boot a machine in safe mode.(Citation: CyberArk Labs Safe Mode 2016)","relationship_id":"relationship--50484fcd-8b37-4a95-9705-49006ba0edd5","references":[{"source_name":"CyberArk Labs Safe Mode 2016","description":"Naim, D.. (2016, September 15). CyberArk Labs: From Safe Mode to Domain Compromise. Retrieved June 23, 2021.","url":"https://www.cyberark.com/resources/blog/cyberark-labs-from-safe-mode-to-domain-compromise"}]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Ensure that endpoint defenses run in safe mode.(Citation: CyberArk Labs Safe Mode 2016)","relationship_id":"relationship--07969240-a4ee-44e7-a9ee-b3386c6222cd","references":[{"source_name":"CyberArk Labs Safe Mode 2016","description":"Naim, D.. (2016, September 15). CyberArk Labs: From Safe Mode to Domain Compromise. Retrieved June 23, 2021.","url":"https://www.cyberark.com/resources/blog/cyberark-labs-from-safe-mode-to-domain-compromise"}]}],"candidates":[{"id":"2a78362e-b79a-4482-8e24-be397bce4d85","name":"Safe Mode Boot","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1688/T1688.yaml","description":"Allows adversaries to abuse safe mode to disable endpoint defenses that may not start with limited boot","inputs":{},"dependencies":[],"source_definition_sha256":"73e792e9669a146682492065a59333fcc811338557cc7282170de737ba3cb8c9"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1112":"/ttp-simulation/techniques/enterprise/T1112/","T1559.001":"/ttp-simulation/techniques/enterprise/T1559.001/","T1688":"/ttp-simulation/techniques/enterprise/T1688/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1688","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0056","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Demo","event_type":"CreateKey","process_id":4200}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}