attack-scenarios.json

{
  "version": "1.5.22",
  "generated_at": "2025-11-15T00:00:00Z",
  "scenarios": [
    {
      "techniqueId": "T1119",
      "name": "Automated Collection",
      "description": "Performs REAL recursive file collection targeting sensitive files across /home/, /var/log/, /opt/, and /tmp/.",
      "fullDescription": "Recursively searches for and collects sensitive files matching patterns like *.key, *.pem, *.conf, *.db, *.sql, *secret*, *password*, and *.env. Creates staging directory /tmp/signalbench_collection_<uuid>/, copies ALL matching files, archives them with tar czf, extracts comprehensive metadata (sizes, timestamps, permissions, owners), and generates detailed JSON collection report. FULLY REVERSIBLE with complete cleanup of staging directory and archives.",
      "tactic": "Collection",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1119",
      "fullCommand": "signalbench run T1119",
      "estimatedDuration": "5-15s",
      "category": "Collection"
    },
    {
      "techniqueId": "T1095",
      "name": "Non-Application Layer Protocol",
      "description": "Generates telemetry for command and control communications using raw sockets and non-application layer protocols.",
      "fullDescription": "Simulates C2-style communication over protocols such as ICMP, TCP or UDP using safe utilities to produce beaconing and payload-exchange telemetry. Communications are conducted only with localhost endpoints and are non-destructive; logs and temporary files are removed during cleanup.",
      "tactic": "Command and Control",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1095",
      "fullCommand": "signalbench run T1095",
      "estimatedDuration": "3-10s",
      "category": "Command and Control"
    },
    {
      "techniqueId": "T1105",
      "name": "Ingress Tool Transfer",
      "description": "Generates telemetry for tool download and transfer activities via HTTP.",
      "fullDescription": "Downloads test binaries from authorised endpoints to simulate tool ingress activities. Operations create observable file and network telemetry whilst remaining non-destructive; generated files are removed during cleanup. Optionally attempts execution of downloaded files to produce process telemetry.",
      "tactic": "Command and Control",
      "severity": "Medium",
      "platform": "Linux",
      "command": "run T1105",
      "fullCommand": "signalbench run T1105",
      "estimatedDuration": "3-8s",
      "category": "Command and Control"
    },
    {
      "techniqueId": "T1205",
      "name": "Traffic Signalling - Port Knocking",
      "description": "ACTIVELY INSTALLS REAL IPTABLES RULES for port knock sequence detection on TCP ports 1337, 31337, 8080.",
      "fullDescription": "Creates firewall LOG rules that generate syslog entries when SYN packets hit monitored ports. Requires elevated privileges to manipulate netfilter. Network monitoring will detect these firewall rule modifications and logged connection attempts. Installation is fully reversible through comprehensive iptables rule cleanup.",
      "tactic": "Command and Control",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1205",
      "fullCommand": "signalbench run T1205",
      "estimatedDuration": "2-6s",
      "category": "Command and Control"
    },
    {
      "techniqueId": "T1105.001",
      "name": "Suspicious GitHub Tool Transfer",
      "description": "Generates telemetry for curl requests to suspicious fictional GitHub repositories with hacker-themed names.",
      "fullDescription": "Attempts downloads from synthetic GitHub repository URLs with suspicious naming patterns to exercise detection rules for malicious tool transfers. All requests are to non-existent repositories and produce only network telemetry; log files are removed during cleanup.",
      "tactic": "Command and Control",
      "severity": "Medium",
      "platform": "Linux",
      "command": "run T1105.001",
      "fullCommand": "signalbench run T1105.001",
      "estimatedDuration": "3-8s",
      "category": "Command and Control"
    },
    {
      "techniqueId": "T1059",
      "name": "Possible C2 via dnscat2",
      "description": "Generates telemetry for DNS tunnelling and dnscat2-style command and control activities.",
      "fullDescription": "Downloads a harmless test file representative of known C2 tooling and executes it with innocuous parameters to generate DNS-based C2 telemetry. The operation produces observable network and process traces whilst remaining non-destructive; generated files are removed during cleanup.",
      "tactic": "Command and Control",
      "severity": "High",
      "platform": "Linux",
      "command": "run \"Possible C2 via dnscat2\"",
      "fullCommand": "signalbench run \"Possible C2 via dnscat2\"",
      "estimatedDuration": "5-12s",
      "category": "Command and Control"
    },
    {
      "techniqueId": "T1003.001",
      "name": "Memory Dumping",
      "description": "Performs REAL memory dumping of running processes using gcore or /proc/[pid]/mem to extract credential patterns.",
      "fullDescription": "Uses gcore utility (if available) or direct /proc/[pid]/mem access to dump real process memory from targets like ssh-agent, systemd, or specified PIDs. Searches dumped memory for credential patterns including SSH keys, API tokens, and password strings. Generates authentic process memory access telemetry detectable by EDR/XDR systems. Requires appropriate privileges and removes all dump files during cleanup.",
      "tactic": "Credential Access",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1003.001",
      "fullCommand": "signalbench run T1003.001",
      "estimatedDuration": "5-15s",
      "category": "Credential Access"
    },
    {
      "techniqueId": "T1056.001",
      "name": "Keylogging",
      "description": "Attempts REAL keystroke capture from /dev/input/event* devices when run as root, falls back to historical analysis.",
      "fullDescription": "Enumerates ALL /dev/input/event0-15 devices and attempts real keystroke capture when run with appropriate privileges. Falls back to analysing shell history files (.bash_history, .zsh_history, .lesshst, .sqlite_history, .redis_history, .node_repl_history) and /var/log/auth.log (200 lines) for credential patterns. Generates comprehensive keylogging telemetry detectable by EDR systems. All artefacts cleaned up by default.",
      "tactic": "Credential Access",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1056.001",
      "fullCommand": "signalbench run T1056.001",
      "estimatedDuration": "3-10s",
      "category": "Credential Access"
    },
    {
      "techniqueId": "T1552.001",
      "name": "Credentials in Files",
      "description": "Performs REAL filesystem credential harvesting across 16 search sections including /home/, /var/www/, /opt/, /srv/, /root/.ssh/.",
      "fullDescription": "Searches for credentials in .ssh/ directories, .aws/credentials, .env files, .netrc, git credentials, Docker config, Kubernetes config, database dump files, and /etc/shadow when run as root. Expanded to 16 sections covering web application directories, service configuration paths, and system credential stores. Generates extensive file access telemetry detectable by EDR systems. All created files removed during cleanup.",
      "tactic": "Credential Access",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1552.001",
      "fullCommand": "signalbench run T1552.001",
      "estimatedDuration": "5-12s",
      "category": "Credential Access"
    },
    {
      "techniqueId": "T1003.007",
      "name": "OS Credential Dumping: Proc Filesystem",
      "description": "READS /proc/[pid]/maps and /proc/[pid]/mem to extract SSH keys, API tokens, passwords, and connection strings from live process memory.",
      "fullDescription": "Enumerates running processes under /proc/, inspects memory maps, and uses dd utility to extract memory segments for credential pattern analysis. Searches for SSH private keys, API tokens, database passwords, and connection strings in live process memory. Generates realistic proc filesystem access telemetry for EDR/XDR detection. Logs findings to session directory and cleans up by default.",
      "tactic": "Credential Access",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1003.007",
      "fullCommand": "signalbench run T1003.007",
      "estimatedDuration": "6-15s",
      "category": "Credential Access"
    },
    {
      "techniqueId": "T1110.002",
      "name": "SSH Brute Force",
      "description": "Creates temporary test user with useradd and performs REAL failed SSH authentication attempts against localhost:22.",
      "fullDescription": "Creates a temporary test user account, generates password attempts, and executes 8 REAL failed SSH authentication attempts against localhost using sshpass. Measures timing patterns, generates auth.log entries, and produces authentic SSH brute force telemetry detectable by security products. Complete cleanup with userdel -r removes test user and all artefacts.",
      "tactic": "Credential Access",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1110.002",
      "fullCommand": "signalbench run T1110.002",
      "estimatedDuration": "8-15s",
      "category": "Credential Access"
    },
    {
      "techniqueId": "T1003.008",
      "name": "/etc/passwd and /etc/shadow",
      "description": "Reads and parses /etc/passwd completely, attempts /etc/shadow read if root, extracts usernames/UIDs/GIDs/home directories/shells.",
      "fullDescription": "Performs comprehensive user enumeration by reading /etc/passwd with cat and grep, extracts all user accounts, identifies privileged accounts (UID 0, sudo group membership), parses home directories and login shells. When run as root, attempts /etc/shadow read to extract password hashes. Generates detailed user enumeration report with complete system account information. Read-only reconnaissance with no system modifications.",
      "tactic": "Credential Access",
      "severity": "Medium",
      "platform": "Linux",
      "command": "run T1003.008",
      "fullCommand": "signalbench run T1003.008",
      "estimatedDuration": "2-6s",
      "category": "Credential Access"
    },
    {
      "techniqueId": "T1562.002",
      "name": "Disable Linux Audit Logs",
      "description": "Multi-method REAL audit system manipulation using auditctl -D, systemctl stop auditd, and /etc/audit/audit.rules modification.",
      "fullDescription": "Attempts to disable audit logging through multiple methods: executes auditctl -D to delete all audit rules, attempts systemctl stop auditd to halt audit daemon, and optionally modifies /etc/audit/audit.rules configuration. Requires root privileges for successful execution. Generates extensive audit system modification telemetry detectable by security monitoring. Full restoration of audit configuration during cleanup.",
      "tactic": "Defense Evasion",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1562.002",
      "fullCommand": "signalbench run T1562.002",
      "estimatedDuration": "3-8s",
      "category": "Defense Evasion"
    },
    {
      "techniqueId": "T1070.003",
      "name": "Clear Command History",
      "description": "REAL backup and modification of 6 shell history files including .bash_history, .zsh_history, .python_history, .mysql_history, .psql_history, .redis_history.",
      "fullDescription": "Backs up current shell history files, then actually modifies them by truncating or filtering suspicious command patterns to simulate anti-forensic activity. Targets multiple shell and application history files to maximise coverage. Restores original history files from backup during cleanup to avoid permanent user impact. All actions logged for detection analysis.",
      "tactic": "Defense Evasion",
      "severity": "Medium",
      "platform": "Linux",
      "command": "run T1070.003",
      "fullCommand": "signalbench run T1070.003",
      "estimatedDuration": "2-5s",
      "category": "Defense Evasion"
    },
    {
      "techniqueId": "T1574.007",
      "name": "Path Interception with Trojan Binaries",
      "description": "Creates 7 REAL trojan binaries (ls, ps, whoami, sudo, ssh, curl, wget) that hijack PATH and log intercepted executions.",
      "fullDescription": "Creates trojan wrapper binaries for common system commands, places them at the front of PATH to intercept execution, and logs all command invocations with PID/timestamp/arguments. Demonstrates PATH hijacking for privilege escalation and command interception. Enhanced logging captures process details for forensic analysis. All modifications reversible with complete PATH restoration and trojan binary removal during cleanup.",
      "tactic": "Defense Evasion",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1574.007",
      "fullCommand": "signalbench run T1574.007",
      "estimatedDuration": "3-8s",
      "category": "Defense Evasion"
    },
    {
      "techniqueId": "T1036.003",
      "name": "Masquerading as Linux System Process",
      "description": "Compiles REAL C binaries with misleading names ([kworker/0:0], systemd-journald, crond) using prctl(PR_SET_NAME) for process name spoofing.",
      "fullDescription": "Creates actual C source files that use prctl(PR_SET_NAME) to set deceptive process names, compiles them with GCC, and executes the binaries to appear as legitimate system processes in ps aux output. Demonstrates process masquerading for evasion of process-name-based detection. Generates realistic compilation and execution telemetry. Complete cleanup removes all processes, binaries, and source files.",
      "tactic": "Defense Evasion",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1036.003",
      "fullCommand": "signalbench run T1036.003",
      "estimatedDuration": "4-10s",
      "category": "Defense Evasion"
    },
    {
      "techniqueId": "T1070.004",
      "name": "File Deletion",
      "description": "REAL anti-forensics with shred -uvz -n 3 (three overwrite passes), backups files before deletion, demonstrates log tampering and metadata clearing.",
      "fullDescription": "Performs secure file deletion using shred utility with three overwrite passes (-n 3), verbose output (-v), and zero-fill final pass (-z). Backs up files to /tmp/signalbench_deletion_backup/ before deletion to enable restoration. Demonstrates anti-forensic techniques including log file tampering and metadata clearing with unlink verification. Full restoration from backup during cleanup ensures reversibility.",
      "tactic": "Defense Evasion",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1070.004",
      "fullCommand": "signalbench run T1070.004",
      "estimatedDuration": "3-8s",
      "category": "Defense Evasion"
    },
    {
      "techniqueId": "T1027",
      "name": "Obfuscated Files or Information",
      "description": "Generates obfuscated artefacts using base64, XOR, packing, and string concatenation to exercise detection logic.",
      "fullDescription": "Creates files using various obfuscation methods including base64 encoding, XOR encryption, executable packing, and string concatenation. Optionally executes deobfuscated content to produce end-to-end telemetry for static analysis testing. All artefacts removed during standard cleanup unless retention is requested for analysis.",
      "tactic": "Defense Evasion",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1027",
      "fullCommand": "signalbench run T1027",
      "estimatedDuration": "3-8s",
      "category": "Defense Evasion"
    },
    {
      "techniqueId": "T1055",
      "name": "Process Injection",
      "description": "Implements controlled process injection simulations using ptrace, LD_PRELOAD, and shared library approaches.",
      "fullDescription": "Compiles local test code and performs safe process injection operations using ptrace-based attachment, LD_PRELOAD environment manipulation, and shared library injection techniques. Produces observable process and memory access telemetry for injection detection testing. Implementation is controlled and reversible; compilation artefacts cleaned up by default.",
      "tactic": "Defense Evasion",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1055",
      "fullCommand": "signalbench run T1055",
      "estimatedDuration": "5-12s",
      "category": "Defense Evasion"
    },
    {
      "techniqueId": "T1082",
      "name": "System Information Discovery",
      "description": "Performs comprehensive system enumeration including /etc/passwd parsing, package enumeration (dpkg/rpm), and security tool detection.",
      "fullDescription": "Executes system information commands to collect details about operating system, hardware, kernel, installed packages, and running security products. Detects presence of CrowdStrike, Carbon Black, Wazuh, and other EDR/XDR solutions. Reads /proc/cpuinfo, /proc/meminfo, enumerates kernel modules, and detects containerisation (Docker, Kubernetes). Saves comprehensive results to log file for telemetry analysis. All files cleaned up by default.",
      "tactic": "Discovery",
      "severity": "Low",
      "platform": "Linux",
      "command": "run T1082",
      "fullCommand": "signalbench run T1082",
      "estimatedDuration": "3-8s",
      "category": "Discovery"
    },
    {
      "techniqueId": "T1016",
      "name": "System Network Configuration Discovery",
      "description": "Comprehensive network reconnaissance with ARP enumeration, VPN detection (/etc/openvpn, /etc/wireguard), VLAN identification, and firewall rule enumeration.",
      "fullDescription": "Runs network configuration commands (ip addr, ip route, ifconfig, netstat, arp) to collect interface details, routing tables, and ARP cache. Detects VPN configurations, identifies VLAN tagging, parses network bridges, and enumerates firewall rules (iptables/nftables). Writes comprehensive network configuration report for telemetry analysis. All generated files removed during standard cleanup.",
      "tactic": "Discovery",
      "severity": "Low",
      "platform": "Linux",
      "command": "run T1016",
      "fullCommand": "signalbench run T1016",
      "estimatedDuration": "2-6s",
      "category": "Discovery"
    },
    {
      "techniqueId": "T1049",
      "name": "System Network Connections Discovery",
      "description": "REAL enumeration via netstat/ss/lsof, parses active connections by state, listening ports, and process-to-socket mappings.",
      "fullDescription": "Executes network connection enumeration tools (netstat, ss, lsof) to discover active network connections, listening ports, and associated processes. Parses connection states (ESTABLISHED, LISTEN, TIME_WAIT), identifies process IDs bound to sockets, and generates comprehensive process-to-network mapping. Useful for generating realistic process network activity telemetry. Connections log file cleaned up by default.",
      "tactic": "Discovery",
      "severity": "Low",
      "platform": "Linux",
      "command": "run T1049",
      "fullCommand": "signalbench run T1049",
      "estimatedDuration": "2-5s",
      "category": "Discovery"
    },
    {
      "techniqueId": "T1046",
      "name": "Network Service Discovery",
      "description": "REAL TCP connection attempts with banner grabbing on 1,032 ports (1-1024 + backdoor ports), added UDP scanning (DNS, NTP, SNMP), scans IPv4/IPv6 localhost.",
      "fullDescription": "Performs comprehensive port scanning against localhost using TCP connection attempts on 1,024 standard ports plus known backdoor ports (445, 3389, 1433, 5985, 22, 23, 3306, 5432, 6379, 27017). Includes UDP scanning for common services (DNS 53, NTP 123, SNMP 161). Performs banner grabbing to identify running services. Scans both IPv4 (127.0.0.1) and IPv6 (::1) localhost addresses. Produces comprehensive scan results file cleaned up by default.",
      "tactic": "Discovery",
      "severity": "Medium",
      "platform": "Linux",
      "command": "run T1046",
      "fullCommand": "signalbench run T1046",
      "estimatedDuration": "8-20s",
      "category": "Discovery"
    },
    {
      "techniqueId": "T1016",
      "name": "DNS reconnaissance or enumeration via DNSRecon",
      "description": "Creates and executes a Python DNS reconnaissance script to simulate domain and subdomain enumeration.",
      "fullDescription": "Writes a Python DNS reconnaissance script to temporary directory which performs DNS lookups against common subdomains of a target domain, logs results, and then cleans up. The implementation generates detectable DNS query patterns for analytics testing without using comprehensive scanning tools. All script files and logs removed during cleanup.",
      "tactic": "Discovery",
      "severity": "Medium",
      "platform": "Linux",
      "command": "run \"DNS reconnaissance or enumeration via DNSRecon\"",
      "fullCommand": "signalbench run \"DNS reconnaissance or enumeration via DNSRecon\"",
      "estimatedDuration": "3-8s",
      "category": "Discovery"
    },
    {
      "techniqueId": "T1059.004",
      "name": "Unix Shell Execution",
      "description": "Executes REAL suspicious commands including reverse shells to localhost, base64-encoded payloads, process chains, and /dev/shm payload execution.",
      "fullDescription": "Performs actual shell command execution demonstrating attack patterns: creates reverse shell connections to localhost, executes base64-encoded commands, builds process execution chains (bash -c chains), and writes/executes payloads from /dev/shm memory filesystem. Generates realistic command injection and shell execution telemetry for EDR detection. All processes terminated and artefacts removed during cleanup.",
      "tactic": "Execution",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1059.004",
      "fullCommand": "signalbench run T1059.004",
      "estimatedDuration": "3-8s",
      "category": "Execution"
    },
    {
      "techniqueId": "T1059.006",
      "name": "Python Script Execution",
      "description": "REAL socket listeners (20s accept loop), /proc/*/fd enumeration, environment variable extraction from all processes, comprehensive recon reporting.",
      "fullDescription": "Creates and executes Python scripts that open persistent socket listeners accepting connections for 20 seconds, enumerate file descriptors from /proc/*/fd for all processes, extract environment variables from running processes, and perform system reconnaissance. Generates extensive Python interpreter telemetry including network operations and process inspection. All scripts and logs removed during cleanup.",
      "tactic": "Execution",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1059.006",
      "fullCommand": "signalbench run T1059.006",
      "estimatedDuration": "4-10s",
      "category": "Execution"
    },
    {
      "techniqueId": "T1059.004.001",
      "name": "Uncommon Remote Shell Commands",
      "description": "Generates telemetry for execution of uncommon command names to trigger baseline anomaly detection.",
      "fullDescription": "Creates several uniquely named benign executables with test provenance prefixes, executes them briefly to produce process creation telemetry, then removes them. Names chosen to exercise detection rules that flag novel or suspicious command names not typically seen in enterprise environments. All artefacts removed during cleanup.",
      "tactic": "Execution",
      "severity": "Medium",
      "platform": "Linux",
      "command": "run \"Uncommon Remote Shell Commands\"",
      "fullCommand": "signalbench run \"Uncommon Remote Shell Commands\"",
      "estimatedDuration": "3-8s",
      "category": "Execution"
    },
    {
      "techniqueId": "T1059",
      "name": "Advanced Command and Scripting Interpreter",
      "description": "Executes commands and scripts with obfuscation methods including base64, hex, variable concatenation, and IFS manipulation.",
      "fullDescription": "Supports multiple interpreter types (bash, python, perl) and obfuscation techniques (base64 encoding, hex encoding, variable concatenation, IFS manipulation, command substitution). Creates temporary scripts with various evasion patterns, executes them to generate telemetry, and removes artefacts during cleanup. Designed to exercise interpreter-based detection capabilities.",
      "tactic": "Execution",
      "severity": "High",
      "platform": "Linux",
      "command": "run \"Advanced Command and Scripting Interpreter\"",
      "fullCommand": "signalbench run \"Advanced Command and Scripting Interpreter\"",
      "estimatedDuration": "3-9s",
      "category": "Execution"
    },
    {
      "techniqueId": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "description": "Simulates data exfiltration over protocols such as DNS, ICMP or HTTP to generate network exfiltration telemetry.",
      "fullDescription": "Encodes synthetic data for selected protocol and simulates or performs controlled transfers to localhost endpoints to generate detectable exfiltration patterns. All data used is synthetic and transfers performed only to authorised test endpoints or simulated locally. Artefacts removed during cleanup. Supports DNS TXT records, ICMP payload encoding, and HTTP POST exfiltration patterns.",
      "tactic": "Exfiltration",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1048",
      "fullCommand": "signalbench run T1048",
      "estimatedDuration": "5-12s",
      "category": "Exfiltration"
    },
    {
      "techniqueId": "T1496",
      "name": "Resource Hijacking",
      "description": "Controlled CPU stress (SHA256 hashing loops simulating crypto-mining), memory stress (100MB chunk allocations), disk I/O stress with 30 second duration limit.",
      "fullDescription": "Simulates cryptocurrency mining and resource abuse by spawning controlled CPU stress processes performing SHA256 hashing loops, allocating large memory blocks in 100MB chunks, and performing rapid disk I/O operations in /tmp/. Limited to 30 seconds maximum duration with safety limits. Monitors and logs resource usage during stress, demonstrates resource hijacking patterns detectable by EDR systems. FULLY REVERSIBLE with guaranteed process termination, memory cleanup, and temporary file removal.",
      "tactic": "Impact",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1496",
      "fullCommand": "signalbench run T1496",
      "estimatedDuration": "10-35s",
      "category": "Impact"
    },
    {
      "techniqueId": "T1021.004",
      "name": "SSH Lateral Movement",
      "description": "Generates RSA SSH keys, backs up and modifies authorized_keys, executes REAL SSH connections to localhost with port forwarding attempts.",
      "fullDescription": "Performs REAL SSH lateral movement by generating RSA key pair using ssh-keygen, modifying ~/.ssh/authorized_keys with backup, and executing genuine SSH connections to localhost (127.0.0.1). Executes multiple commands via SSH including whoami, uname, hostname, env, and id. Attempts SSH port forwarding (-L) and dynamic tunnelling (-D) to simulate advanced lateral movement tactics. Generates authentic SSH connection logs and authorized_keys modifications detectable by EDR/XDR systems. Full restoration of authorized_keys during cleanup.",
      "tactic": "Lateral Movement",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1021.004",
      "fullCommand": "signalbench run T1021.004",
      "estimatedDuration": "5-12s",
      "category": "Lateral Movement"
    },
    {
      "techniqueId": "T1547.002",
      "name": "Startup Folder",
      "description": "REAL modification of /etc/profile.d/99-signalbench.sh, ~/.bashrc, ~/.bash_profile with persistence commands.",
      "fullDescription": "Actually modifies shell startup files including /etc/profile.d/99-signalbench.sh (if root), ~/.bashrc, and ~/.bash_profile by appending benign logging commands that execute on user login. Commands write to /tmp/signalbench_boot.log to demonstrate persistence. Backs up all original files before modification, tests by sourcing files to verify execution, and provides full restoration during cleanup. Generates authentic startup persistence telemetry.",
      "tactic": "Persistence",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1547.002",
      "fullCommand": "signalbench run T1547.002",
      "estimatedDuration": "3-8s",
      "category": "Persistence"
    },
    {
      "techniqueId": "T1053.003",
      "name": "Cron Job",
      "description": "Creates REAL system-wide cron jobs in /etc/cron.d/99-signalbench-test and user crontab entries, executes benign commands.",
      "fullDescription": "Actually creates system-wide cron jobs by writing to /etc/cron.d/99-signalbench-test (if root) and modifying user crontab with crontab -e. Executes benign commands like echo to /tmp/ for demonstration. Verifies installation with crontab -l output, produces authentic scheduled task telemetry. Full backup and restore of original crontab during cleanup ensures reversibility.",
      "tactic": "Persistence",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1053.003",
      "fullCommand": "signalbench run T1053.003",
      "estimatedDuration": "2-6s",
      "category": "Persistence"
    },
    {
      "techniqueId": "T1505.003",
      "name": "Web Shell Deployment",
      "description": "Writes REAL malicious PHP and Python web shells to /tmp/signalbench_webshell/, includes eval($_POST['cmd']), system(), exec(), base64_decode() patterns.",
      "fullDescription": "Creates 5 variants of actual web shell code (simple, obfuscated, multi-function) in PHP and Python containing dangerous functions like eval($_POST['cmd']), system(), exec(), and base64_decode(). Writes files to /tmp/signalbench_webshell/ directory to simulate web application compromise. Web shells contain realistic backdoor patterns detectable by YARA rules and file scanning. Full directory cleanup removes all web shell artefacts.",
      "tactic": "Persistence",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1505.003",
      "fullCommand": "signalbench run T1505.003",
      "estimatedDuration": "2-6s",
      "category": "Persistence"
    },
    {
      "techniqueId": "T1098",
      "name": "Account Manipulation",
      "description": "Modifies existing user accounts, injects SSH public keys into ~/.ssh/authorized_keys, changes user shells with chsh, adds users to groups.",
      "fullDescription": "Performs REAL account manipulation by injecting SSH public keys into ~/.ssh/authorized_keys for existing users, changes user login shells using chsh command, adds users to supplementary groups with usermod -aG (including sudo group for privilege escalation), and modifies password aging policies with chage command. Requires root privileges for full functionality. Complete restoration of all backups during cleanup ensures reversibility.",
      "tactic": "Persistence",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1098",
      "fullCommand": "signalbench run T1098",
      "estimatedDuration": "3-8s",
      "category": "Persistence"
    },
    {
      "techniqueId": "T1543",
      "name": "Create or Modify System Process",
      "description": "Generates telemetry for systemd service creation and modification to demonstrate service-based persistence.",
      "fullDescription": "Writes systemd service unit files, init.d scripts, or rc.local entries in controlled manner and simulates installation where privilege permits. Creates service definitions with benign commands for telemetry generation. All created service files removed during cleanup unless explicitly preserved. Generates service manipulation telemetry detectable by configuration monitoring.",
      "tactic": "Persistence",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1543",
      "fullCommand": "signalbench run T1543",
      "estimatedDuration": "3-10s",
      "category": "Persistence"
    },
    {
      "techniqueId": "T1548.003",
      "name": "Sudoers Modification",
      "description": "Creates /etc/sudoers.d/99-signalbench-test with NOPASSWD rules, validates with visudo, tests sudo access.",
      "fullDescription": "Actually creates sudoers configuration file in /etc/sudoers.d/99-signalbench-test with NOPASSWD rules for privilege escalation demonstration. Validates syntax using visudo -c to prevent system lockout, tests sudo access to verify configuration, and generates authentic sudoers modification telemetry. Requires root privileges for creation. Full cleanup removes sudoers file and restores original sudo configuration.",
      "tactic": "Privilege Escalation",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1548.003",
      "fullCommand": "signalbench run T1548.003",
      "estimatedDuration": "2-6s",
      "category": "Privilege Escalation"
    },
    {
      "techniqueId": "T1548.001",
      "name": "SUID Binary Creation",
      "description": "Compiles C wrapper, sets SUID bit with chmod u+s, tests /etc/shadow access to demonstrate privilege escalation.",
      "fullDescription": "Creates C source code for a test wrapper binary, compiles it with GCC, and sets the SUID bit using chmod u+s to enable privilege escalation. Tests privileged operations like reading /etc/shadow to demonstrate SUID exploitation patterns. Generates compilation, SUID bit setting, and privileged access telemetry. Complete cleanup removes binary, source code, and compilation artefacts.",
      "tactic": "Privilege Escalation",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1548.001",
      "fullCommand": "signalbench run T1548.001",
      "estimatedDuration": "3-8s",
      "category": "Privilege Escalation"
    },
    {
      "techniqueId": "T1136.001",
      "name": "Local Account Creation",
      "description": "Creates REAL local accounts with sudo access, password configuration, and SSH key generation.",
      "fullDescription": "Actually creates local user accounts using useradd command with home directory creation, configures passwords using passwd (when run as root), adds users to sudo group for privilege escalation, and generates SSH key pairs for the new accounts. Produces authentic user account creation telemetry including /etc/passwd and /etc/shadow modifications. Complete cleanup removes accounts with userdel -r including home directories.",
      "tactic": "Privilege Escalation",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1136.001",
      "fullCommand": "signalbench run T1136.001",
      "estimatedDuration": "3-8s",
      "category": "Privilege Escalation"
    },
    {
      "techniqueId": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "description": "Attempts REAL exploitation: creates systemd test services, performs Docker operations, executes sudo -l testing for vulnerability enumeration.",
      "fullDescription": "Performs real privilege escalation enumeration and testing including: creating systemd service units with elevated privileges, attempting Docker socket manipulation for container escape, executing sudo -l to enumerate NOPASSWD entries, scanning for writable systemd service files, and testing common privilege escalation vectors. Generates authentic exploitation attempt telemetry detectable by EDR/XDR. All test services and artefacts removed during cleanup.",
      "tactic": "Privilege Escalation",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1068",
      "fullCommand": "signalbench run T1068",
      "estimatedDuration": "4-12s",
      "category": "Privilege Escalation"
    },
    {
      "techniqueId": "T1548.003.001",
      "name": "Sudo Unsigned Integer Privilege Escalation",
      "description": "Demonstrates sudo negative/unsigned integer invocation pattern to generate CVE-2019-14287 exploitation telemetry.",
      "fullDescription": "Attempts to run harmless commands using -u#-1 and -u#4294967295 invocation patterns in controlled manner to produce logs representative of attempts to exploit sudo integer handling vulnerabilities (CVE-2019-14287). Operation is non-destructive and intended solely for telemetry generation. Generates sudo command audit logs detectable by security monitoring.",
      "tactic": "Privilege Escalation",
      "severity": "High",
      "platform": "Linux",
      "command": "run T1548.003.001",
      "fullCommand": "signalbench run T1548.003.001",
      "estimatedDuration": "2-6s",
      "category": "Privilege Escalation"
    },
    {
      "techniqueId": "S1109",
      "name": "PACEMAKER",
      "description": "UNC2630 APT malware simulation with embedded YARA signatures matching FE_APT_Trojan_Linux_PACEMAKER rules.",
      "fullDescription": "Simulates UNC2630 APT group's PACEMAKER credential stealer malware based on Mandiant threat intelligence reports. Embedded helper binary contains authentic YARA signatures for detection by security products using FireEye/Mandiant rule sets. Performs /proc reading behaviour, process inspection, and credential harvesting simulation patterns documented in APT reports. Designed for malware detection testing in research environments. Complete cleanup of all simulation artefacts.",
      "tactic": "Software",
      "severity": "High",
      "platform": "Linux",
      "command": "run S1109",
      "fullCommand": "signalbench run S1109",
      "estimatedDuration": "3-10s",
      "category": "Software"
    }
  ]
}