Domain Registration — Detection Telemetry

Domain registration records and changes used as infrastructure context.

Collection and providers

Query an approved RDAP service/feed, retaining retrieval time and registration-event dates; preserve redaction and missing-field indicators.

Authorized intelligence feeds / STIX repositories: Provenance-bearing observations and analysis, not direct victim-side logs.
RDAP registries/registrars: Registration context; public fields can be redacted or unavailable.

Configuration

Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.
Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.
Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

Synthetic normalized event

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0101",
  "collector": "illustrative-lab-collector",
  "observation": {
    "domain": "example.test",
    "event": "registration",
    "registrant": "redacted",
    "retrieved_at": "2026-09-27T12:00:00Z"
  }
}

Visibility and validation

Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.

Record the lab scope, collector version, effective configuration and expected source fields before testing.
Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

Connected ecosystem references

Linked tags

External context and intelligence attack_component Authorized intelligence feeds / STIX repositories RDAP registries/registrars

Each workspace retains its own logsource and platform requirements. A technique-level association is not a per-rule sensor mapping.

Attack tools through shared TTPs

These are two-hop navigation links through explicitly associated techniques, not independent tool-to-sensor assertions.

No reviewed association in this snapshot.

Native security log sources

Security log-source library groups concrete producers and formats separately from ATT&CK data components. Samples carry provenance and version limits; associations do not prove collection coverage.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.