{
  "T1542.001": {
    "id": "T1542.001",
    "name": "Pre-OS Boot: Bootkit",
    "tactic": "Persistence",
    "tactic_color": "#22c55e",
    "count": 11,
    "crits": 11,
    "highs": 0,
    "meds": 0,
    "lows": 0,
    "pct": 91,
    "color": "#ef4444",
    "events": [
      {
        "id": 417,
        "ts": "23:11:10",
        "title": "Firmware hash mismatch \u2014 edge-node-04",
        "sev": "CRITICAL",
        "asset": "edge-node-04"
      },
      {
        "id": 406,
        "ts": "23:10:37",
        "title": "TR-069 unsigned firmware push",
        "sev": "CRITICAL",
        "asset": "vsat-gw-01"
      },
      {
        "id": 389,
        "ts": "23:09:49",
        "title": "Firmware hash mismatch \u2014 edge-node-04",
        "sev": "CRITICAL",
        "asset": "edge-node-04"
      }
    ]
  },
  "T1596": {
    "id": "T1596",
    "name": "Search Open Technical Databases",
    "tactic": "Reconnaissance",
    "tactic_color": "#64748b",
    "count": 10,
    "crits": 0,
    "highs": 0,
    "meds": 6,
    "lows": 4,
    "pct": 83,
    "color": "#06b6d4",
    "events": [
      {
        "id": 420,
        "ts": "23:11:20",
        "title": "WE-FORGE decoy \u2014 DNS beacon fired",
        "sev": "MEDIUM",
        "asset": "vortex.ghost.watch.local"
      },
      {
        "id": 412,
        "ts": "23:10:55",
        "title": "WE-FORGE decoy \u2014 DNS beacon fired",
        "sev": "MEDIUM",
        "asset": "vortex.ghost.watch.local"
      },
      {
        "id": 400,
        "ts": "23:10:21",
        "title": "New domain relationship correlated",
        "sev": "LOW",
        "asset": "shadow313.net"
      }
    ]
  },
  "T1505.003": {
    "id": "T1505.003",
    "name": "Server Software: Web Shell",
    "tactic": "Persistence",
    "tactic_color": "#22c55e",
    "count": 10,
    "crits": 10,
    "highs": 0,
    "meds": 0,
    "lows": 0,
    "pct": 83,
    "color": "#ef4444",
    "events": [
      {
        "id": 429,
        "ts": "23:11:49",
        "title": "China Chopper web shell in uploads/",
        "sev": "CRITICAL",
        "asset": "web-app-01"
      },
      {
        "id": 411,
        "ts": "23:10:52",
        "title": "Behinder JSP AES shell",
        "sev": "CRITICAL",
        "asset": "tomcat-prod-01"
      },
      {
        "id": 404,
        "ts": "23:10:32",
        "title": "China Chopper web shell in uploads/",
        "sev": "CRITICAL",
        "asset": "web-app-01"
      }
    ]
  },
  "T1558.003": {
    "id": "T1558.003",
    "name": "Steal Kerberos Tickets: Kerberoasting",
    "tactic": "Credential Access",
    "tactic_color": "#ef4444",
    "count": 6,
    "crits": 0,
    "highs": 6,
    "meds": 0,
    "lows": 0,
    "pct": 50,
    "color": "#f59e0b",
    "events": [
      {
        "id": 421,
        "ts": "23:11:24",
        "title": "Kerberoasting \u2014 RC4 TGS from jsmith",
        "sev": "HIGH",
        "asset": "dc-01"
      },
      {
        "id": 415,
        "ts": "23:11:04",
        "title": "Kerberoasting \u2014 RC4 TGS from jsmith",
        "sev": "HIGH",
        "asset": "dc-01"
      },
      {
        "id": 371,
        "ts": "23:08:54",
        "title": "Kerberoasting \u2014 RC4 TGS from jsmith",
        "sev": "HIGH",
        "asset": "dc-01"
      }
    ]
  },
  "T1490": {
    "id": "T1490",
    "name": "Inhibit System Recovery",
    "tactic": "Impact",
    "tactic_color": "#dc2626",
    "count": 6,
    "crits": 6,
    "highs": 0,
    "meds": 0,
    "lows": 0,
    "pct": 50,
    "color": "#ef4444",
    "events": [
      {
        "id": 435,
        "ts": "23:12:12",
        "title": "VSS shadow copy deletion",
        "sev": "CRITICAL",
        "asset": "ws-finance-03"
      },
      {
        "id": 388,
        "ts": "23:09:48",
        "title": "VSS shadow copy deletion",
        "sev": "CRITICAL",
        "asset": "ws-finance-03"
      },
      {
        "id": 360,
        "ts": "23:08:15",
        "title": "VSS shadow copy deletion",
        "sev": "CRITICAL",
        "asset": "ws-finance-03"
      }
    ]
  },
  "T1068": {
    "id": "T1068",
    "name": "Exploitation for Privilege Escalation",
    "tactic": "Privilege Escalation",
    "tactic_color": "#f97316",
    "count": 6,
    "crits": 6,
    "highs": 0,
    "meds": 0,
    "lows": 0,
    "pct": 50,
    "color": "#ef4444",
    "events": [
      {
        "id": 436,
        "ts": "23:12:14",
        "title": "CVE-2026-0001 kernel priv esc",
        "sev": "CRITICAL",
        "asset": "linux-srv-05"
      },
      {
        "id": 395,
        "ts": "23:10:07",
        "title": "CVE-2026-0001 kernel priv esc",
        "sev": "CRITICAL",
        "asset": "linux-srv-05"
      },
      {
        "id": 366,
        "ts": "23:08:39",
        "title": "CVE-2026-0001 kernel priv esc",
        "sev": "CRITICAL",
        "asset": "linux-srv-05"
      }
    ]
  },
  "T1003.006": {
    "id": "T1003.006",
    "name": "OS Credential Dumping: DCSync",
    "tactic": "Credential Access",
    "tactic_color": "#ef4444",
    "count": 6,
    "crits": 6,
    "highs": 0,
    "meds": 0,
    "lows": 0,
    "pct": 50,
    "color": "#ef4444",
    "events": [
      {
        "id": 419,
        "ts": "23:11:16",
        "title": "DCSync \u2014 non-DC replication",
        "sev": "CRITICAL",
        "asset": "dc-01"
      },
      {
        "id": 399,
        "ts": "23:10:18",
        "title": "DCSync \u2014 non-DC replication",
        "sev": "CRITICAL",
        "asset": "dc-01"
      },
      {
        "id": 364,
        "ts": "23:08:31",
        "title": "DCSync \u2014 non-DC replication",
        "sev": "CRITICAL",
        "asset": "dc-01"
      }
    ]
  },
  "T1055.001": {
    "id": "T1055.001",
    "name": "Process Injection: DLL Injection",
    "tactic": "Defense Evasion",
    "tactic_color": "#06b6d4",
    "count": 6,
    "crits": 6,
    "highs": 0,
    "meds": 0,
    "lows": 0,
    "pct": 50,
    "color": "#ef4444",
    "events": [
      {
        "id": 433,
        "ts": "23:12:03",
        "title": "CreateRemoteThread \u2192 lsass.exe",
        "sev": "CRITICAL",
        "asset": "ws-dev-12"
      },
      {
        "id": 390,
        "ts": "23:09:53",
        "title": "CreateRemoteThread \u2192 lsass.exe",
        "sev": "CRITICAL",
        "asset": "ws-dev-12"
      },
      {
        "id": 359,
        "ts": "23:08:11",
        "title": "CreateRemoteThread \u2192 lsass.exe",
        "sev": "CRITICAL",
        "asset": "ws-dev-12"
      }
    ]
  },
  "T1070.006": {
    "id": "T1070.006",
    "name": "Indicator Removal: Timestomping",
    "tactic": "Defense Evasion",
    "tactic_color": "#06b6d4",
    "count": 6,
    "crits": 0,
    "highs": 0,
    "meds": 6,
    "lows": 0,
    "pct": 50,
    "color": "#06b6d4",
    "events": [
      {
        "id": 431,
        "ts": "23:11:56",
        "title": "Timestomping \u2014 MACE attribute modified",
        "sev": "MEDIUM",
        "asset": "ws-dev-12"
      },
      {
        "id": 397,
        "ts": "23:10:13",
        "title": "Timestomping \u2014 MACE attribute modified",
        "sev": "MEDIUM",
        "asset": "ws-dev-12"
      },
      {
        "id": 373,
        "ts": "23:08:59",
        "title": "Timestomping \u2014 MACE attribute modified",
        "sev": "MEDIUM",
        "asset": "ws-dev-12"
      }
    ]
  },
  "T1003.001": {
    "id": "T1003.001",
    "name": "OS Credential Dumping: LSASS Memory",
    "tactic": "Credential Access",
    "tactic_color": "#ef4444",
    "count": 6,
    "crits": 6,
    "highs": 0,
    "meds": 0,
    "lows": 0,
    "pct": 50,
    "color": "#ef4444",
    "events": [
      {
        "id": 427,
        "ts": "23:11:42",
        "title": "LSASS dump via MiniDumpWriteDump",
        "sev": "CRITICAL",
        "asset": "ws-hr-07"
      },
      {
        "id": 398,
        "ts": "23:10:16",
        "title": "LSASS dump via MiniDumpWriteDump",
        "sev": "CRITICAL",
        "asset": "ws-hr-07"
      },
      {
        "id": 382,
        "ts": "23:09:30",
        "title": "LSASS dump via MiniDumpWriteDump",
        "sev": "CRITICAL",
        "asset": "ws-hr-07"
      }
    ]
  },
  "T1552.001": {
    "id": "T1552.001",
    "name": "Unsecured Credentials: Credentials In Files",
    "tactic": "Credential Access",
    "tactic_color": "#ef4444",
    "count": 6,
    "crits": 0,
    "highs": 0,
    "meds": 6,
    "lows": 0,
    "pct": 50,
    "color": "#06b6d4",
    "events": [
      {
        "id": 434,
        "ts": "23:12:07",
        "title": ".env probe \u2014 CensysInspect",
        "sev": "MEDIUM",
        "asset": "web-trap-01"
      },
      {
        "id": 387,
        "ts": "23:09:44",
        "title": ".env probe \u2014 CensysInspect",
        "sev": "MEDIUM",
        "asset": "web-trap-01"
      },
      {
        "id": 369,
        "ts": "23:08:49",
        "title": ".env probe \u2014 CensysInspect",
        "sev": "MEDIUM",
        "asset": "web-trap-01"
      }
    ]
  },
  "T1600.001": {
    "id": "T1600.001",
    "name": "Weaken Encryption: Reduce Key Space",
    "tactic": "Defense Evasion",
    "tactic_color": "#06b6d4",
    "count": 6,
    "crits": 0,
    "highs": 6,
    "meds": 0,
    "lows": 0,
    "pct": 50,
    "color": "#f59e0b",
    "events": [
      {
        "id": 422,
        "ts": "23:11:26",
        "title": "OpenSSL PQC downgrade CVE-2026-1847",
        "sev": "HIGH",
        "asset": "api-gw-01"
      },
      {
        "id": 405,
        "ts": "23:10:34",
        "title": "OpenSSL PQC downgrade CVE-2026-1847",
        "sev": "HIGH",
        "asset": "api-gw-01"
      },
      {
        "id": 362,
        "ts": "23:08:24",
        "title": "OpenSSL PQC downgrade CVE-2026-1847",
        "sev": "HIGH",
        "asset": "api-gw-01"
      }
    ]
  },
  "T1003.008": {
    "id": "T1003.008",
    "name": "OS Credential Dumping: /etc/passwd",
    "tactic": "Credential Access",
    "tactic_color": "#ef4444",
    "count": 6,
    "crits": 0,
    "highs": 0,
    "meds": 6,
    "lows": 0,
    "pct": 50,
    "color": "#06b6d4",
    "events": [
      {
        "id": 423,
        "ts": "23:11:29",
        "title": "eBPF: cat /etc/shadow intercepted",
        "sev": "MEDIUM",
        "asset": "linux-srv-05"
      },
      {
        "id": 386,
        "ts": "23:09:40",
        "title": "eBPF: cat /etc/shadow intercepted",
        "sev": "MEDIUM",
        "asset": "linux-srv-05"
      },
      {
        "id": 361,
        "ts": "23:08:20",
        "title": "eBPF: cat /etc/shadow intercepted",
        "sev": "MEDIUM",
        "asset": "linux-srv-05"
      }
    ]
  },
  "T1021.001": {
    "id": "T1021.001",
    "name": "Remote Services: Remote Desktop Protocol",
    "tactic": "Lateral Movement",
    "tactic_color": "#ec4899",
    "count": 6,
    "crits": 0,
    "highs": 6,
    "meds": 0,
    "lows": 0,
    "pct": 50,
    "color": "#f59e0b",
    "events": [
      {
        "id": 428,
        "ts": "23:11:45",
        "title": "RDP from powershell.exe parent",
        "sev": "HIGH",
        "asset": "ws-admin-01"
      },
      {
        "id": 394,
        "ts": "23:10:05",
        "title": "RDP from powershell.exe parent",
        "sev": "HIGH",
        "asset": "ws-admin-01"
      },
      {
        "id": 367,
        "ts": "23:08:42",
        "title": "RDP from powershell.exe parent",
        "sev": "HIGH",
        "asset": "ws-admin-01"
      }
    ]
  },
  "T1572": {
    "id": "T1572",
    "name": "Protocol Tunneling",
    "tactic": "Command and Control",
    "tactic_color": "#3b82f6",
    "count": 5,
    "crits": 0,
    "highs": 5,
    "meds": 0,
    "lows": 0,
    "pct": 41,
    "color": "#f59e0b",
    "events": [
      {
        "id": 410,
        "ts": "23:10:50",
        "title": "DNS tunneling \u2014 entropy 4.2",
        "sev": "HIGH",
        "asset": "ws-finance-03"
      },
      {
        "id": 363,
        "ts": "23:08:26",
        "title": "DNS tunneling \u2014 entropy 4.2",
        "sev": "HIGH",
        "asset": "ws-finance-03"
      },
      {
        "id": 326,
        "ts": "23:06:28",
        "title": "DNS tunneling \u2014 entropy 4.2",
        "sev": "HIGH",
        "asset": "ws-finance-03"
      }
    ]
  },
  "T1059.001": {
    "id": "T1059.001",
    "name": "Command and Scripting: PowerShell",
    "tactic": "Execution",
    "tactic_color": "#f59e0b",
    "count": 5,
    "crits": 0,
    "highs": 5,
    "meds": 0,
    "lows": 0,
    "pct": 41,
    "color": "#f59e0b",
    "events": [
      {
        "id": 391,
        "ts": "23:09:55",
        "title": "Encoded PowerShell from WINWORD.EXE",
        "sev": "HIGH",
        "asset": "ws-exec-09"
      },
      {
        "id": 383,
        "ts": "23:09:32",
        "title": "Encoded PowerShell from WINWORD.EXE",
        "sev": "HIGH",
        "asset": "ws-exec-09"
      },
      {
        "id": 324,
        "ts": "23:06:22",
        "title": "Encoded PowerShell from WINWORD.EXE",
        "sev": "HIGH",
        "asset": "ws-exec-09"
      }
    ]
  },
  "T1548.002": {
    "id": "T1548.002",
    "name": "Abuse Elevation Control: Bypass UAC",
    "tactic": "Privilege Escalation",
    "tactic_color": "#f97316",
    "count": 5,
    "crits": 0,
    "highs": 5,
    "meds": 0,
    "lows": 0,
    "pct": 41,
    "color": "#f59e0b",
    "events": [
      {
        "id": 416,
        "ts": "23:11:05",
        "title": "UAC bypass via fodhelper.exe",
        "sev": "HIGH",
        "asset": "ws-hr-07"
      },
      {
        "id": 376,
        "ts": "23:09:09",
        "title": "UAC bypass via fodhelper.exe",
        "sev": "HIGH",
        "asset": "ws-hr-07"
      },
      {
        "id": 329,
        "ts": "23:06:37",
        "title": "UAC bypass via fodhelper.exe",
        "sev": "HIGH",
        "asset": "ws-hr-07"
      }
    ]
  },
  "T1565.001": {
    "id": "T1565.001",
    "name": "Data Manipulation: Stored Data Manipulation",
    "tactic": "Impact",
    "tactic_color": "#dc2626",
    "count": 5,
    "crits": 0,
    "highs": 0,
    "meds": 5,
    "lows": 0,
    "pct": 41,
    "color": "#06b6d4",
    "events": [
      {
        "id": 392,
        "ts": "23:09:59",
        "title": "SATCOM uplink gain spoof",
        "sev": "MEDIUM",
        "asset": "vsat-gw-01"
      },
      {
        "id": 375,
        "ts": "23:09:05",
        "title": "SATCOM uplink gain spoof",
        "sev": "MEDIUM",
        "asset": "vsat-gw-01"
      },
      {
        "id": 347,
        "ts": "23:07:34",
        "title": "SATCOM uplink gain spoof",
        "sev": "MEDIUM",
        "asset": "vsat-gw-01"
      }
    ]
  },
  "T1550.002": {
    "id": "T1550.002",
    "name": "Use Alternate Auth: Pass the Hash",
    "tactic": "Lateral Movement",
    "tactic_color": "#ec4899",
    "count": 5,
    "crits": 5,
    "highs": 0,
    "meds": 0,
    "lows": 0,
    "pct": 41,
    "color": "#ef4444",
    "events": [
      {
        "id": 393,
        "ts": "23:10:02",
        "title": "Pass-the-Hash NTLM KeyLength 0",
        "sev": "CRITICAL",
        "asset": "srv-app-02"
      },
      {
        "id": 380,
        "ts": "23:09:23",
        "title": "Pass-the-Hash NTLM KeyLength 0",
        "sev": "CRITICAL",
        "asset": "srv-app-02"
      },
      {
        "id": 325,
        "ts": "23:06:26",
        "title": "Pass-the-Hash NTLM KeyLength 0",
        "sev": "CRITICAL",
        "asset": "srv-app-02"
      }
    ]
  },
  "T1110.003": {
    "id": "T1110.003",
    "name": "Brute Force: Password Spraying",
    "tactic": "Credential Access",
    "tactic_color": "#ef4444",
    "count": 5,
    "crits": 0,
    "highs": 5,
    "meds": 0,
    "lows": 0,
    "pct": 41,
    "color": "#f59e0b",
    "events": [
      {
        "id": 407,
        "ts": "23:10:41",
        "title": "Password spraying \u2014 15 accounts",
        "sev": "HIGH",
        "asset": "ad-srv-01"
      },
      {
        "id": 354,
        "ts": "23:07:53",
        "title": "Password spraying \u2014 15 accounts",
        "sev": "HIGH",
        "asset": "ad-srv-01"
      },
      {
        "id": 336,
        "ts": "23:07:01",
        "title": "Password spraying \u2014 15 accounts",
        "sev": "HIGH",
        "asset": "ad-srv-01"
      }
    ]
  },
  "T1195.001": {
    "id": "T1195.001",
    "name": "Supply Chain Compromise: Software Dependencies",
    "tactic": "Initial Access",
    "tactic_color": "#a78bfa",
    "count": 5,
    "crits": 0,
    "highs": 5,
    "meds": 0,
    "lows": 0,
    "pct": 41,
    "color": "#f59e0b",
    "events": [
      {
        "id": 425,
        "ts": "23:11:36",
        "title": "Unsigned dependency in build pipeline",
        "sev": "HIGH",
        "asset": "build-runner-02"
      },
      {
        "id": 408,
        "ts": "23:10:44",
        "title": "Unsigned dependency in build pipeline",
        "sev": "HIGH",
        "asset": "build-runner-02"
      },
      {
        "id": 368,
        "ts": "23:08:45",
        "title": "Unsigned dependency in build pipeline",
        "sev": "HIGH",
        "asset": "build-runner-02"
      }
    ]
  },
  "T1110.001": {
    "id": "T1110.001",
    "name": "Brute Force: Password Guessing",
    "tactic": "Credential Access",
    "tactic_color": "#ef4444",
    "count": 5,
    "crits": 0,
    "highs": 5,
    "meds": 0,
    "lows": 0,
    "pct": 41,
    "color": "#f59e0b",
    "events": [
      {
        "id": 430,
        "ts": "23:11:53",
        "title": "SSH brute force \u2014 root:password123",
        "sev": "HIGH",
        "asset": "honeypot-ssh-01"
      },
      {
        "id": 401,
        "ts": "23:10:24",
        "title": "SSH brute force \u2014 root:password123",
        "sev": "HIGH",
        "asset": "honeypot-ssh-01"
      },
      {
        "id": 365,
        "ts": "23:08:35",
        "title": "SSH brute force \u2014 root:password123",
        "sev": "HIGH",
        "asset": "honeypot-ssh-01"
      }
    ]
  },
  "T1027": {
    "id": "T1027",
    "name": "Obfuscated Files or Information",
    "tactic": "Defense Evasion",
    "tactic_color": "#06b6d4",
    "count": 5,
    "crits": 0,
    "highs": 0,
    "meds": 5,
    "lows": 0,
    "pct": 41,
    "color": "#06b6d4",
    "events": [
      {
        "id": 418,
        "ts": "23:11:13",
        "title": "PE analyzer: UPX-packed entropy 7.8",
        "sev": "MEDIUM",
        "asset": "edge-node-04"
      },
      {
        "id": 403,
        "ts": "23:10:29",
        "title": "PE analyzer: UPX-packed entropy 7.8",
        "sev": "MEDIUM",
        "asset": "edge-node-04"
      },
      {
        "id": 372,
        "ts": "23:08:56",
        "title": "PE analyzer: UPX-packed entropy 7.8",
        "sev": "MEDIUM",
        "asset": "edge-node-04"
      }
    ]
  },
  "T1053.005": {
    "id": "T1053.005",
    "name": "Scheduled Task/Job: Scheduled Task",
    "tactic": "Persistence",
    "tactic_color": "#22c55e",
    "count": 5,
    "crits": 0,
    "highs": 0,
    "meds": 5,
    "lows": 0,
    "pct": 41,
    "color": "#06b6d4",
    "events": [
      {
        "id": 432,
        "ts": "23:12:01",
        "title": "Suspicious scheduled task SYSTEM",
        "sev": "MEDIUM",
        "asset": "ws-finance-03"
      },
      {
        "id": 396,
        "ts": "23:10:09",
        "title": "Suspicious scheduled task SYSTEM",
        "sev": "MEDIUM",
        "asset": "ws-finance-03"
      },
      {
        "id": 353,
        "ts": "23:07:50",
        "title": "Suspicious scheduled task SYSTEM",
        "sev": "MEDIUM",
        "asset": "ws-finance-03"
      }
    ]
  },
  "T1547.001": {
    "id": "T1547.001",
    "name": "Boot Autostart: Registry Run Keys",
    "tactic": "Persistence",
    "tactic_color": "#22c55e",
    "count": 5,
    "crits": 0,
    "highs": 0,
    "meds": 5,
    "lows": 0,
    "pct": 41,
    "color": "#06b6d4",
    "events": [
      {
        "id": 424,
        "ts": "23:11:33",
        "title": "Registry Run key \u2014 non-standard path",
        "sev": "MEDIUM",
        "asset": "ws-hr-07"
      },
      {
        "id": 385,
        "ts": "23:09:38",
        "title": "Registry Run key \u2014 non-standard path",
        "sev": "MEDIUM",
        "asset": "ws-hr-07"
      },
      {
        "id": 370,
        "ts": "23:08:51",
        "title": "Registry Run key \u2014 non-standard path",
        "sev": "MEDIUM",
        "asset": "ws-hr-07"
      }
    ]
  },
  "T1498": {
    "id": "T1498",
    "name": "Network Denial of Service",
    "tactic": "Impact",
    "tactic_color": "#dc2626",
    "count": 4,
    "crits": 0,
    "highs": 4,
    "meds": 0,
    "lows": 0,
    "pct": 33,
    "color": "#f59e0b",
    "events": [
      {
        "id": 409,
        "ts": "23:10:46",
        "title": "Mirai botnet Telnet staging",
        "sev": "HIGH",
        "asset": "honeypot-01"
      },
      {
        "id": 381,
        "ts": "23:09:26",
        "title": "Mirai botnet Telnet staging",
        "sev": "HIGH",
        "asset": "honeypot-01"
      },
      {
        "id": 331,
        "ts": "23:06:42",
        "title": "Mirai botnet Telnet staging",
        "sev": "HIGH",
        "asset": "honeypot-01"
      }
    ]
  }
}