events.example.jsonl

{"schema_version":1,"seq":0,"ts_mono":1000,"pid":1001,"kind":"proc","data":{"op":"exec","path":"/work/dropper.bin","argv":["/work/dropper.bin","--quiet"],"ppid":1}}
{"schema_version":1,"seq":1,"ts_mono":250000,"pid":1001,"kind":"file","data":{"op":"open","path":"/etc/hosts","fd":3,"flags":"O_RDONLY"}}
{"schema_version":1,"seq":2,"ts_mono":300000,"pid":1001,"kind":"mem","data":{"op":"protect","region":{"base":"0x555555560000","size":4096,"perms":"r-x"},"addr":"0x555555560000","len":4096}}
{"schema_version":1,"seq":3,"ts_mono":400000,"pid":1001,"kind":"net","data":{"op":"socket","proto":"tcp","flow_id":"f1"}}
{"schema_version":1,"seq":4,"ts_mono":420000,"pid":1001,"kind":"net","data":{"op":"dns","dns":{"qname":"cdn.evil.example.com","qtype":"A","answers":["10.0.0.53"]},"decision":"simulated","flow_id":"f1"}}
{"schema_version":1,"seq":5,"ts_mono":600000,"pid":1001,"kind":"net","data":{"op":"connect","proto":"tcp","raddr":"93.184.216.34:443","decision":"block","flow_id":"f1"}}
{"schema_version":1,"seq":6,"ts_mono":700000,"pid":1001,"kind":"syscall","data":{"nr":42,"name":"connect","phase":"exit","ret":"-1","errno":"ECONNREFUSED"}}
{"schema_version":1,"seq":7,"ts_mono":800000,"pid":1001,"kind":"file","data":{"op":"write","path":"/work/wallet.dat","size":512,"decoy":true,"artifact_id":"a-0003"}}
{"schema_version":1,"seq":8,"ts_mono":820000,"pid":1001,"kind":"detection","data":{"detector":"heuristic","id":"decoy-access","severity":"high","title":"Wrote to a decoy file","description":"Specimen modified planted canary wallet.dat","refs":{"seq":7,"artifact_id":"a-0003"},"attack":["T1657"]}}
{"schema_version":1,"seq":9,"ts_mono":900000,"pid":1001,"tid":1001,"kind":"instr","data":{"ip":"0x555555555abc","disasm":"mov qword ptr [rbp-0x8], rax","window_id":"w-1","reg_deltas":{"rip":{"old":"0x555555555abc","new":"0x555555555ac0"}},"mem_writes":[{"addr":"0x7fffffffe1a8","old":"0x0","new":"0x4141414141414141","size":8}]}}
{"schema_version":1,"seq":10,"ts_mono":950000,"pid":1001,"kind":"mem","data":{"op":"snapshot","snapshot_id":"snap-0007","region":{"base":"0x555555554000","size":16384,"perms":"rwxp"}}}
{"schema_version":1,"seq":11,"ts_mono":1000000,"pid":1001,"kind":"proc","data":{"op":"exit","exit_code":0}}