security-platform/test-data/sample-alerts.json

[
  {
    "event_time": "2025-07-19T10:05:23.451Z",
    "alert_type": "phishing.malware_execution",
    "severity": "high",
    "attack_stage": ["initial_access", "execution"],
    "attack_scenario": "Phishing attachment executed malware, set autorun and connected to C2",
    "description": "User executed a masqueraded PDF executable via browser, created autorun registry entry, and established C2 connection.",
    "evidence": [
      {
        "type": "process_execution",
        "parent_process": "chrome.exe",
        "parent_pid": 4412,
        "child_file_name": "发票确认.pdf.exe",
        "child_hash": {
          "sha256": "9a2fdb8c7e..."
        },
        "action": "executed"
      },
      {
        "type": "registry_persistence",
        "path": "HKCU\\...\\Run",
        "value_name": "UpdaterService",
        "effect": "autorun"
      },
      {
        "type": "network_c2",
        "dst_ip": "103.216.154.99"
      },
      {
        "type": "host_user",
        "host_name": "WIN-USER01",
        "host_id": "WIN-01-7A3B",
        "user": {
          "username": "ming.zhang",
          "employee_id": "E10086",
          "email": "[email protected]"
        }
      }
    ]
  },
  {
    "event_time": "2025-07-19T10:17:58.120Z",
    "alert_type": "credential_access.aksk_exfil",
    "severity": "high",
    "attack_stage": ["credential_access", "exfiltration"],
    "attack_scenario": "Endpoint stole AliCloud AK/SK and exfiltrated",
    "description": "Credential access on host reading AliCloud credential file containing AK/SK and cloud account identifiers, followed by outbound transfer.",
    "evidence": [
      {
        "type": "file_access",
        "target_file": "aliyun_credentials.txt",
        "contains_fields": ["AccessKey", "SecretKey", "CloudAccount"],
        "redacted": true
      },
      {
        "type": "cloud_account",
        "cloud_provider": "alibaba_cloud",
        "account_email": "[email protected]",
        "account_uid": "123456789012"
      },
      {
        "type": "exfiltration",
        "dst_ip": "103.216.154.99",
        "dst_port": 443,
        "protocol": "tcp"
      },
      {
        "type": "host_user",
        "host_id": "WIN-01-7A3B",
        "user": {
          "username": "ming.zhang"
        }
      }
    ]
  },
  {
    "event_time": "2025-07-19T10:22:15Z",
    "alert_type": "cloud.discovery.describe",
    "severity": "medium",
    "attack_stage": ["discovery"],
    "attack_scenario": "Cloud resource enumeration (DescribeInstances)",
    "description": "DescribeInstances call on Alibaba Cloud ECS using the compromised identity to enumerate assets.",
    "evidence": [
      {
        "type": "cloud_api_call",
        "cloud_provider": "alibaba_cloud",
        "event_name": "DescribeInstances",
        "event_source": "ecs.aliyuncs.com",
        "request_parameters": {
          "RegionId": "cn-hangzhou"
        }
      },
      {
        "type": "cloud_identity",
        "identity_type": "ram-user",
        "user_name": "ming.zhang",
        "account_email": "[email protected]",
        "account_id": "123456789012"
      },
      {
        "type": "network_source",
        "source_ip": "185.163.209.22"
      },
      {
        "type": "cloud_response",
        "instance_ids_sample": ["i-001"],
        "truncated": true
      }
    ]
  },
  {
    "event_time": "2025-07-19T10:35:47Z",
    "alert_type": "cloud.persistence.backdoor_user",
    "severity": "high",
    "attack_stage": ["persistence"],
    "attack_scenario": "Create backdoor user for persistent access",
    "description": "A new cloud user backdoor_admin was created under the same account by ming.zhang, indicating persistence setup.",
    "evidence": [
      {
        "type": "cloud_api_call",
        "cloud_provider": "alibaba_cloud",
        "event_name": "CreateUser"
      },
      {
        "type": "cloud_identity",
        "creator_user_name": "ming.zhang",
        "account_email": "[email protected]"
      },
      {
        "type": "cloud_user_created",
        "user_name": "backdoor_admin",
        "user_id": "user-8899",
        "arn": "acs:ram::123456789012:user/backdoor_admin"
      },
      {
        "type": "network_source",
        "source_ip": "45.76.218.17"
      }
    ]
  },
  {
    "event_time": "2025-07-19T10:52:31Z",
    "alert_type": "cloud.privilege_abuse.kubeconfig_download",
    "severity": "high",
    "attack_stage": ["credential_access", "lateral_movement"],
    "attack_scenario": "Download KubeConfig to pivot into Kubernetes",
    "description": "Backdoor user downloaded Kubernetes kubeconfig; certificate subject ties to the victim identity, enabling higher-privilege access.",
    "evidence": [
      {
        "type": "cloud_api_call",
        "cloud_provider": "alibaba_cloud",
        "event_name": "GetClusterKubeConfig",
        "request_parameters": {
          "ClusterId": "c0d76c4650bc94******"
        }
      },
      {
        "type": "cloud_identity",
        "user_name": "backdoor_admin",
        "account_id": "123456789012"
      },
      {
        "type": "certificate_subject",
        "subject_cn": "[email protected]",
        "organization": "eks-admins",
        "raw": "[email protected]/O=eks-admins"
      },
      {
        "type": "network_source",
        "source_ip": "209.133.78.45"
      }
    ]
  },
  {
    "event_time": "2025-07-19T11:15:00Z",
    "alert_type": "k8s.exec.remote_control",
    "severity": "critical",
    "attack_stage": ["execution"],
    "attack_scenario": "Container command execution via exec in production",
    "description": "Certificate identity used to exec into production pod; actual user resolved to backdoor_admin, confirming interactive command execution.",
    "evidence": [
      {
        "type": "k8s_audit",
        "resource": "pods",
        "namespace": "production",
        "name": "nginx-pod",
        "subresource": "exec",
        "response_code": 200
      },
      {
        "type": "k8s_user",
        "username": "[email protected]",
        "groups": ["eks-admins"]
      },
      {
        "type": "k8s_user_extra",
        "client_certificate_subject": "[email protected], O=eks-admins",
        "ram_actual_user": "backdoor_admin"
      },
      {
        "type": "network_source",
        "source_ip": "77.77.77.77"
      }
    ]
  }
]