T1424 Process Discovery — Attack Simulation

DC0123 collection page — Instrument the owned app lifecycle and corroborate permitted service snapshots; distinguish app events from inferred gateway activity.

Providers and collection configuration

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Required normalized fields: package, state_before, state_after, source.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0123",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "state_before": "background",
    "state_after": "foreground",
    "source": "own_app_callback"
  }
}

Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

DC0055 collection page — Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.

Providers and collection configuration

• Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.

• Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
• For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
• Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: path, access, actor, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0055",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "C:\\Lab\\demo.txt",
    "access": "read",
    "actor": "LAB\\analyst",
    "result": "success"
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

DC0018 collection page — Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.

Providers and collection configuration

• osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
• Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

• Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
• Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
• Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: asset_id, status, heartbeat_age_seconds, collector_healthy.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0018",
  "collector": "illustrative-lab-collector",
  "observation": {
    "asset_id": "lab-host-1",
    "status": "degraded",
    "heartbeat_age_seconds": 90,
    "collector_healthy": true
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0078 collection page — Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: source_ip, destination_ip, destination_port, protocol, bytes_sent, bytes_received.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0078",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_ip": "192.0.2.10",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "bytes_sent": 128,
    "bytes_received": 512
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0034 collection page — Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.

Providers and collection configuration

• osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
• Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

• Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
• Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
• Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: process_id, image, owner_uid, started_at.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0034",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "image": "/usr/bin/sleep",
    "owner_uid": 1000,
    "started_at": "2026-09-27T11:59:00Z"
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0311 YiSpecter — malware.

  YiSpecter has collected information about running processes.[paloalto_yispecter_1015]

  Exact relationship: relationship--4a608d3b-aa02-4563-8b6b-c64a491856f5
• S0411 Rotexy — malware.

  Rotexy collects information about running processes.[securelist rotexy 2018]

  Exact relationship: relationship--9d4c1d68-3cc8-4cf9-b3ee-1525d0ce32de
• S0421 GolfSpy — malware.

  GolfSpy can obtain a list of running processes.[Trend Micro Bouncing Golf 2019]

  Exact relationship: relationship--cd6a9777-a8fd-43ca-91dc-cafc7d4b7df3
• S0422 Anubis — malware.

  Anubis can collect a list of running processes.[Zimperium z9]

  Exact relationship: relationship--35453bbb-c9b3-4421-8452-95efdd290d21
• S0440 Agent Smith — malware.

  Agent Smith checks if a targeted application is running in user-space prior to infection.[CheckPoint Agent Smith]

  Exact relationship: relationship--5107be8a-b5fc-4442-af0d-2c92e086a912
• S0489 WolfRAT — malware.

  WolfRAT uses `dumpsys` to determine if certain applications are running.[Talos-WolfRAT]

  Exact relationship: relationship--a1814198-1f91-41d4-a413-d55e1a66c8e9
• S0544 HenBox — malware.

  HenBox can obtain a list of running processes.[Palo Alto HenBox]

  Exact relationship: relationship--9d264e84-27b2-4867-82c8-55486a969d7c
• S1055 SharkBot — malware.

  SharkBot can use Accessibility Services to detect which process is in the foreground.[nccgroup_sharkbot_0322]

  Exact relationship: relationship--23a67f24-a8eb-4e31-acf1-11cb5e9f88b2
• S1185 LightSpy — malware.

  LightSpy has collected a list of running processes.[Threatfabric LightSpy 2024][LinkedIn Dmitry LightSpy 2025]

  Exact relationship: relationship--526099a3-132d-430f-9559-fc067e39b227
• S1215 Binary Validator — malware.

  Binary Validator has obtained a list of running processes.[SecureList OpTriangulation 23Oct2023]

  Exact relationship: relationship--adbacfe1-1d78-4652-b32c-4d31a0c33ef3
• S1216 TriangleDB — malware.

  TriangleDB has collected a list of running processes.[SecureList OpTriangulation 21Jun2023]

  Exact relationship: relationship--4667e169-d85a-4d0c-9da7-2fe22d1ba873
• S1225 CherryBlos — malware.

  CherryBlos has used the Accessibility Service to monitor when a wallet application has launched.[TrendMicro_CherryBlos_July2023]

  Exact relationship: relationship--18c212f3-8c21-427c-9654-ebffbf33fac7

• M1002 Attestation

  Attestation can typically detect rooted devices. For MDM-enrolled devices, action can be taken if a device fails an attestation check.

• M1006 Use Recent OS Version

  Android 7 and later iOS versions introduced changes that prevent applications from performing Process Discovery without elevated privileges.