Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
File Creation · source-mapped
DC0039 collection page — Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: process_id, path, action, size_bytes.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0039",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"path": "C:\\Lab\\demo.txt",
"action": "create",
"size_bytes": 64
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Network Connection Creation · source-mapped
DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0082",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"destination_ip": "198.51.100.20",
"destination_port": 443,
"protocol": "tcp",
"initiated": true
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Process Creation · source-mapped
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>
This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Service Creation · source-mapped
DC0060 collection page — Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.
Providers and collection configuration
- Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
- For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
- Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.
Required normalized fields: service, action, executable, actor.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0060",
"collector": "illustrative-lab-collector",
"observation": {
"service": "LabService",
"action": "install",
"executable": "C:\\Lab\\service.exe",
"actor": "lab-admin"
}
}
Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
Windows Registry Key Creation · source-mapped
DC0056 collection page — Use RegistryEvent (12) and filter CreateKey/CreateValue as available; retain target object and process identity.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.
Required normalized fields: registry_path, event_type, process_id.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0056",
"collector": "illustrative-lab-collector",
"observation": {
"registry_path": "HKCU\\Software\\Lab\\Demo",
"event_type": "CreateKey",
"process_id": 4200
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Windows Registry Key Modification · source-mapped
DC0063 collection page — Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.
Required normalized fields: registry_path, event_type, value_type, value.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0063",
"collector": "illustrative-lab-collector",
"observation": {
"registry_path": "HKCU\\Software\\Lab\\Mode",
"event_type": "SetValue",
"value_type": "DWORD",
"value": 1
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Simulation design and documented procedures
Atomic evidence: 15 compatible documented candidates. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
Ammyy Admin Software Execution
An adversary may attempt to trick the user into downloading Ammyy Admin Remote Desktop Software for use as a C2 channel.
Upon successful execution, Ammyy Admin will be executed.
Pinned Atomic procedure · 0ae9e327-3251-465a-a53b-485d4e3f58fa · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
Ammyy_Admin_Path: Path of Ammyy Admin executable (type path; source default PathToAtomicsFolder\..\ExternalPayloads\ammyy.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Ammyy Admin must exist on disk at the specified location (#{Ammyy_Admin_Path})
UltraViewer - RAT Execution
A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as UltraViewer to provide the operator with access to the network using legitimate services.
Pinned Atomic procedure · 19acf63b-55c4-4b6a-8552-00a8865105c8 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
UltraViewer_Path: Path to the UltraViewer executable. (type path; source default PathToAtomicsFolder\..\ExternalPayloads\T1219_UltraViewer.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Ultraviewer installer must be downloaded and exist on the disk at the specified location. (#{UltraViewer_Path})
Microsoft App Quick Assist Execution
An adversary may attempt to trick a user into executing Microsoft Quick Assist Microsoft Store app and connect to the user's machine.
Pinned Atomic procedure · 1aea6d15-70f1-4b4e-8b02-397b5d5ffe75 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
GoToAssist Files Detected Test on Windows
An adversary may attempt to trick the user into downloading GoToAssist and use to establish C2. Download of GoToAssist installer will be at the destination location and ran when sucessfully executed.
Pinned Atomic procedure · 1b72b3bd-72f8-4b63-a30b-84e91b9c3578 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
installer_path: where GoToAssist will be downloaded to or already is located (type path; source default PathToAtomicsFolder\..\ExternalPayloads\GoToAssist.exe)download_url: url to download GoToAssist from (type url; source default https://launch.getgo.com/launcher2/helper?token=e0-FaCddxmtMoX8_cY4czssnTeGvy83ihp8CLREfvwQshiBW0_RcbdoaEp8IA-Qn8wpbKlpGIflS-39gW6RuWRM-XHwtkRVMLBsp5RSKp-a3PBM-Pb1Fliy73EDgoaxr-q83WtXbLKqD7-u3cfDl9gKsymmhdkTGsXcDXir90NqKj92LsN_KpyYwV06lIxsdRekhNZjNwhkWrBa_hG8RQJqWSGk6tkZLVMuMufmn37eC2Cqqiwq5bCGnH5dYiSUUsklSedRLjh4N46qPYT1bAU0qD25ZPr-Kvf4Kzu9bT02q3Yntj02ZA99TxL2-SKzgryizoopBPg4Ilfo5t78UxKTYeEwo4etQECfkCRvenkTRlIHmowdbd88zz7NiccXnbHJZehgs6_-JSVjQIdPTXZbF9T5z44mi4BQYMtZAS3DE86F0C3D4Tcd7fa5F6Ve8rQWt7pvqFCYyiJAailslxOw0LsGyFokoy65tMF980ReP8zhVcTKYP8s8mhGXihUQJQPNk20Sw"&"downloadTrigger=restart"&"renameFile=1)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- GoToAssist must exist on disk at the specified location (#{installer_path})
Splashtop Streamer Execution
An adversary may attempt to use Splashtop Streamer to gain unattended remote interactive access. Upon successful execution, Splashtop streamer will be executed.
Pinned Atomic procedure · 3e1858ee-3550-401c-86ec-5e70ed79295b · windows · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
srserver_exe: Splashtop streamer installation executables (type string; source default SRServer.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Splashtop Streamer must be installed in the location
UltraVNC Execution
An adversary may attempt to trick the user into downloading UltraVNC for use as a C2 channel.
Upon successful execution, UltraVNC will be executed.
Pinned Atomic procedure · 42e51815-a6cc-4c75-b970-3f0ff54b610e · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
UltraVNC_Viewer_Path: Path of UltraVNC Viewer executable (type path; source default $env:ProgramFiles\'uvnc bvba\UltraVnc\vncviewer.exe')
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- UltraVNC must exist at (#{UltraVNC_Viewer_Path})
ScreenConnect Application Download and Install on Windows
An adversary may attempt to trick the user into downloading ScreenConnect for use as a C2 channel. Download of ScreenConnect installer will be in the Downloads directory.
Msiexec will be used to quietly insall ScreenConnect.
Pinned Atomic procedure · 4a18cc4e-416f-4966-9a9d-75731c4684c0 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
AnyDesk Files Detected Test on Windows
An adversary may attempt to trick the user into downloading AnyDesk and use to establish C2. Download of AnyDesk installer will be at the destination location and ran when sucessfully executed.
Pinned Atomic procedure · 6b8b7391-5c0a-4f8c-baee-78d8ce0ce330 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
installer_path: where the AnyDesk will be downloaded to or already is located (type path; source default PathToAtomicsFolder\..\ExternalPayloads\AnyDesk.exe)download_url: url to download AnyDesk from (type url; source default https://download.anydesk.com/AnyDesk.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- AnyDesk must exist on disk at the specified location (#{installer_path})
TeamViewer Files Detected Test on Windows
An adversary may attempt to trick the user into downloading teamviewer and using this to maintain access to the machine. Download of TeamViewer installer will be at the destination location when sucessfully executed.
Pinned Atomic procedure · 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
installer_path: where the installer will be downloaded to or already is located (type path; source default PathToAtomicsFolder\..\ExternalPayloads\TeamViewer_Setup_x64.exe)download_url: url to download teamviewer from (type url; source default https://download.teamviewer.com/download/TeamViewer_Setup_x64.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- TeamViewer installer must exist on disk at the specified location (#{installer_path})
Splashtop Execution
An adversary may attempt to trick the user into downloading Splashtop for use as a C2 channel.
Upon successful execution, Splashtop will be executed.
Pinned Atomic procedure · b025c580-029e-4023-888d-a42710d76934 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
Splashtop_Path: Path of Splashtop executable (type path; source default ${env:programfiles(x86)}\Splashtop\Splashtop Remote\Client for STP\strwinclt.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- Splashtop must exist at "#{Splashtop_Path}"
MSP360 Connect Execution
An adversary may attempt to trick the user into downloading MSP360 Connect for use as a C2 channel.
Upon successful execution, MSP360 Connect will be executed.
Pinned Atomic procedure · b1b8128b-c5d4-4de9-bf70-e60419274562 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
MSP360_Connect_Path: Path of MSP360 executable (type path; source default $env:ProgramFiles\Connect\Connect.exe)MSP360_Download_Url: URL to download MSP360 Connect from (type url; source default
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- MSP360 must exist at (#{MSP360_Connect_Path})
LogMeIn Files Detected Test on Windows
An adversary may attempt to trick the user into downloading LogMeIn and use to establish C2. Download of LogMeIn installer will be at the destination location and ran when sucessfully executed.
Pinned Atomic procedure · d03683ec-aae0-42f9-9b4c-534780e0f8e1 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
installer_path: where the installer will be downloaded to or already is located (type path; source default PathToAtomicsFolder\..\ExternalPayloads\LogMeInIgnition.msi)download_url: url to download LogMeIn from (type url; source default https://secure.logmein.com/LogMeInIgnition.msi)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- LogMeIn installer must exist on disk at the specified location (#{installer_path})
NetSupport - RAT Execution
A recent trend by threat actors, once a foothold is established, maintain long term persistence using third party remote services such as NetSupport to provide the operator with access to the network using legitimate services.
Pinned Atomic procedure · ecca999b-e0c8-40e8-8416-ad320b146a75 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
NetSupport_Path: Path to the NetSupport executable. (type path; source default PathToAtomicsFolder\..\ExternalPayloads\T1219_NetSupport.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- NetSupport must be downloaded and exist on the disk at the specified location. (#{NetSupport_Path})
RustDesk Files Detected Test on Windows
An adversary may attempt to trick the user into downloading RustDesk and use this to maintain access to the machine.
Download of RustDesk installer will be at the destination location when successfully executed.
Pinned Atomic procedure · f1641ba9-919a-4323-b74f-33372333bf0e · windows · powershell.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
installer_path: where the installer will be downloaded to or already is located (type path; source default PathToAtomicsFolder\..\ExternalPayloads\rustdesk-1.2.3-1-x86_64.exe)download_url: url to download teamviewer from (type url; source default https://github.com/rustdesk/rustdesk/releases/download/1.2.3-1/rustdesk-1.2.3-1-x86_64.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- RustDesk must exist on disk at the specified location (#{installer_path})
RemotePC Software Execution
An adversary may attempt to trick the user into downloading RemotePC Software for use as a C2 channel.
Upon successful execution, RemotePC will be executed.
Pinned Atomic procedure · fbff3f1f-b0bf-448e-840f-7e1687affdce · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
RemotePC_Path: Path of RemotePC executable (type path; source default PathToAtomicsFolder\..\ExternalPayloads\RemotePC.exe)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- RemotePC must exist on disk at the specified location (#{RemotePC_Path})
Technique-specific experiment contract
- Choose one procedure implementing T1219 Remote Access Tools; identify the observable behavior in the source definition, not just its tactic.
- Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
- Enable the collection sources above and verify a benign baseline reaches the detector.
- Run only the approved isolated scenario; capture native events and an independent behavior observable.
- Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.