{
  "description": "Labels for evaluation only. Detections and agent tools must never read this file.",
  "scenarios": {
    "benign_lookalike": {
      "stages": {
        "backup-enumeration": {
          "note": "admin listing shadow copies -- read-only, legitimate",
          "event_ids": [
            "evt-000209",
            "evt-000213"
          ]
        },
        "it-inventory": {
          "note": "encoded PowerShell launched by patch management -- legitimate",
          "event_ids": [
            "evt-000598",
            "evt-000599"
          ]
        },
        "it-admin-multi-host": {
          "note": "admin touching multiple servers -- looks like lateral movement",
          "event_ids": [
            "evt-000606",
            "evt-000613",
            "evt-000617"
          ]
        }
      },
      "event_ids": [
        "evt-000209",
        "evt-000213",
        "evt-000598",
        "evt-000599",
        "evt-000606",
        "evt-000613",
        "evt-000617"
      ]
    },
    "intrusion": {
      "stages": {
        "1-initial-access": {
          "note": "macro-enabled attachment opened from Outlook",
          "event_ids": [
            "evt-000355"
          ]
        },
        "2-execution": {
          "note": "Office application spawning hidden encoded PowerShell",
          "event_ids": [
            "evt-000357"
          ]
        },
        "3-payload-download": {
          "note": "PowerShell retrieving remote script over cleartext HTTP",
          "event_ids": [
            "evt-000358"
          ]
        },
        "4-command-and-control": {
          "note": "regular-interval outbound connections to a fixed remote host",
          "event_ids": [
            "evt-000362",
            "evt-000380",
            "evt-000399",
            "evt-000421",
            "evt-000454",
            "evt-000486"
          ]
        },
        "5-discovery": {
          "note": "account and domain enumeration from the PowerShell session",
          "event_ids": [
            "evt-000367",
            "evt-000370",
            "evt-000374"
          ]
        },
        "6-credential-access": {
          "note": "LSASS process memory dumped via signed Microsoft DLL",
          "event_ids": [
            "evt-000381"
          ]
        },
        "7-brute-force": {
          "note": "repeated failed network logons for one account from one source",
          "event_ids": [
            "evt-000419",
            "evt-000422",
            "evt-000425",
            "evt-000427",
            "evt-000429",
            "evt-000431",
            "evt-000432",
            "evt-000433",
            "evt-000437",
            "evt-000438",
            "evt-000439",
            "evt-000440",
            "evt-000442",
            "evt-000444",
            "evt-000457"
          ]
        },
        "8-lateral-movement": {
          "note": "command shell spawned by the service control manager, output redirected to an admin share",
          "event_ids": [
            "evt-000461"
          ]
        },
        "9-collection": {
          "note": "bulk archive of a finance file share into a temp directory",
          "event_ids": [
            "evt-000469"
          ]
        },
        "10-exfiltration": {
          "note": "server-side process contacting the same external host as PC01",
          "event_ids": [
            "evt-000481"
          ]
        }
      },
      "event_ids": [
        "evt-000355",
        "evt-000357",
        "evt-000358",
        "evt-000362",
        "evt-000367",
        "evt-000370",
        "evt-000374",
        "evt-000380",
        "evt-000381",
        "evt-000399",
        "evt-000419",
        "evt-000421",
        "evt-000422",
        "evt-000425",
        "evt-000427",
        "evt-000429",
        "evt-000431",
        "evt-000432",
        "evt-000433",
        "evt-000437",
        "evt-000438",
        "evt-000439",
        "evt-000440",
        "evt-000442",
        "evt-000444",
        "evt-000454",
        "evt-000457",
        "evt-000461",
        "evt-000469",
        "evt-000481",
        "evt-000486"
      ]
    },
    "ransomware_prep": {
      "stages": {
        "1-defense-impairment": {
          "note": "powershell.exe -nop -w hidden Set-MpPreference -DisableRealtimeMonitoring $true",
          "event_ids": [
            "evt-000901",
            "evt-000905",
            "evt-000909"
          ]
        },
        "2-recovery-inhibition": {
          "note": "vssadmin.exe delete shadows /all /quiet",
          "event_ids": [
            "evt-000922",
            "evt-000925",
            "evt-000927"
          ]
        }
      },
      "event_ids": [
        "evt-000901",
        "evt-000905",
        "evt-000909",
        "evt-000922",
        "evt-000925",
        "evt-000927"
      ]
    }
  }
}