trazas 0.1.0__py3-none-any.whl

trazas/__init__.py

@@ -0,0 +1,3 @@
+"""trazas - realistic, labelled attack log generator for detection engineering."""
+
+__version__ = "0.1.0"

trazas/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from trazas.cli import main
+
+sys.exit(main())

trazas/cli.py

@@ -0,0 +1,117 @@
+"""Command-line interface."""
+
+from __future__ import annotations
+
+import argparse
+import secrets
+import sys
+from collections.abc import Sequence
+from datetime import datetime, timezone
+from pathlib import Path
+
+from trazas import __version__, engine
+from trazas.scenarios import REGISTRY
+from trazas.writers import FORMATS, UnsupportedFormatError, write
+
+
+def _parse_start(value: str) -> datetime:
+    try:
+        ts = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except ValueError as exc:
+        raise argparse.ArgumentTypeError(f"invalid ISO 8601 timestamp: {value!r}") from exc
+    return ts if ts.tzinfo else ts.replace(tzinfo=timezone.utc)
+
+
+def _non_negative_int(value: str) -> int:
+    n = int(value)
+    if n < 0:
+        raise argparse.ArgumentTypeError("must be >= 0")
+    return n
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="trazas",
+        description="Generate realistic, labelled attack logs for testing detections.",
+    )
+    parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    sub.add_parser("list", help="list available scenarios")
+
+    desc = sub.add_parser("describe", help="show details of a scenario")
+    desc.add_argument("scenario", choices=sorted(REGISTRY))
+
+    gen = sub.add_parser("generate", help="generate a dataset")
+    gen.add_argument("scenarios", nargs="+", choices=sorted(REGISTRY), metavar="SCENARIO")
+    gen.add_argument("-s", "--seed", type=int, help="PRNG seed (random if omitted, printed to stderr)")
+    gen.add_argument("--start", type=_parse_start, help="ISO 8601 start time (default: now, UTC)")
+    gen.add_argument("-n", "--noise", type=_non_negative_int, default=200,
+                     help="benign events per platform (default: 200)")  # fmt: skip
+    gen.add_argument("-f", "--format", choices=FORMATS, default="jsonl")
+    gen.add_argument("-o", "--output", type=Path, help="output file (default: stdout)")
+    gen.add_argument("--force", action="store_true", help="overwrite the output file if it exists")
+    gen.add_argument("--labels", action="store_true",
+                     help="add a _trazas ground-truth field to each JSON record")  # fmt: skip
+    return parser
+
+
+def _cmd_list() -> int:
+    width = max(len(sid) for sid in REGISTRY)
+    for sid, cls in sorted(REGISTRY.items()):
+        print(f"{sid:<{width}}  {cls.platform:<8} {','.join(cls.techniques):<22} {cls.name}")
+    return 0
+
+
+def _cmd_describe(scenario_id: str) -> int:
+    cls = REGISTRY[scenario_id]
+    print(f"{cls.name} ({cls.id})")
+    print(f"Platform:   {cls.platform}")
+    print(f"Techniques: {', '.join(cls.techniques)}")
+    for t in cls.techniques:
+        print(f"            https://attack.mitre.org/techniques/{t.replace('.', '/')}/")
+    print(f"\n{cls.description}")
+    return 0
+
+
+def _cmd_generate(args: argparse.Namespace) -> int:
+    seed: int = args.seed if args.seed is not None else secrets.randbits(63)
+    start: datetime = args.start or datetime.now(timezone.utc).replace(microsecond=0)
+    events = engine.generate(args.scenarios, seed=seed, start=start, noise=args.noise)
+
+    if args.format == "raw" and any(e.raw is None for e in events):
+        print("error: --format raw only supports Linux scenarios; use jsonl", file=sys.stderr)
+        return 2
+
+    if args.output is None:
+        count = write(events, sys.stdout, args.format, labels=args.labels)
+    else:
+        mode = "w" if args.force else "x"  # "x" refuses to clobber existing files
+        try:
+            with args.output.open(mode, encoding="utf-8", newline="\n") as fh:
+                count = write(events, fh, args.format, labels=args.labels)
+        except FileExistsError:
+            print(f"error: {args.output} exists (use --force to overwrite)", file=sys.stderr)
+            return 1
+
+    print(
+        f"trazas: {count} events, seed={seed}, start={start.isoformat()}",
+        file=sys.stderr,
+    )
+    return 0
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        if args.command == "list":
+            return _cmd_list()
+        if args.command == "describe":
+            return _cmd_describe(args.scenario)
+        return _cmd_generate(args)
+    except (ValueError, UnsupportedFormatError) as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 2
+    except BrokenPipeError:  # pragma: no cover - e.g. `trazas generate ... | head`
+        sys.stderr.close()
+        return 0

trazas/context.py

@@ -0,0 +1,98 @@
+"""Deterministic generation context.
+
+All randomness flows through a single seeded :class:`random.Random` so that the
+same ``seed`` + ``start`` always produce byte-identical output. This is a
+simulation PRNG, not a security primitive.
+
+Every address and domain produced here comes from ranges reserved for
+documentation or private use (RFC 5737, RFC 1918, RFC 2606), so generated
+datasets never point at real infrastructure.
+"""
+
+from __future__ import annotations
+
+import random
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta
+
+# RFC 5737 documentation ranges, used for "external" / attacker addresses.
+_EXTERNAL_NETS = ("203.0.113", "198.51.100", "192.0.2")
+# RFC 1918 range used for internal hosts.
+_INTERNAL_NET = "10.20"
+
+DOMAIN = "CORP"
+DNS_SUFFIX = "corp.example.com"  # RFC 2606 reserved
+
+_FIRST_NAMES = (
+    "ana", "luis", "maria", "jose", "carla", "diego", "sofia", "pablo",
+    "laura", "andres", "valeria", "jorge", "elena", "mateo", "paula", "ricardo",
+)  # fmt: skip
+_LAST_NAMES = (
+    "mora", "rojas", "vargas", "jimenez", "solis", "castro", "araya", "chaves",
+    "quesada", "alfaro", "brenes", "campos",
+)  # fmt: skip
+
+COMMON_BAD_USERNAMES = (
+    "administrator", "admin", "user", "test", "guest", "scanner",
+    "backup", "support", "sql", "ftp", "oracle", "postgres", "root", "ubuntu",
+)  # fmt: skip
+
+
+@dataclass
+class GenContext:
+    """Shared state for one generation run."""
+
+    seed: int
+    start: datetime
+    rng: random.Random = field(init=False, repr=False)
+
+    def __post_init__(self) -> None:
+        if self.start.tzinfo is None:
+            raise ValueError("start must be timezone-aware")
+        self.rng = random.Random(self.seed)  # noqa: S311 - simulation, not crypto
+
+    # --- time -----------------------------------------------------------------
+    def at(self, seconds: float) -> datetime:
+        return self.start + timedelta(seconds=seconds)
+
+    def jitter(self, low: float, high: float) -> float:
+        return self.rng.uniform(low, high)
+
+    # --- identities -----------------------------------------------------------
+    def username(self) -> str:
+        return f"{self.rng.choice(_FIRST_NAMES)}.{self.rng.choice(_LAST_NAMES)}"
+
+    def users(self, n: int) -> list[str]:
+        seen: dict[str, None] = {}
+        while len(seen) < n:
+            seen[self.username()] = None
+        return list(seen)
+
+    def bad_username(self) -> str:
+        return self.rng.choice(COMMON_BAD_USERNAMES)
+
+    def workstation(self) -> str:
+        return f"WS{self.rng.randint(1, 250):03d}"
+
+    def server(self, role: str = "SRV") -> str:
+        return f"{role}{self.rng.randint(1, 20):02d}"
+
+    def fqdn(self, host: str) -> str:
+        return f"{host}.{DNS_SUFFIX}"
+
+    # --- network --------------------------------------------------------------
+    def external_ip(self) -> str:
+        return f"{self.rng.choice(_EXTERNAL_NETS)}.{self.rng.randint(1, 254)}"
+
+    def internal_ip(self) -> str:
+        return f"{_INTERNAL_NET}.{self.rng.randint(0, 31)}.{self.rng.randint(2, 254)}"
+
+    def ephemeral_port(self) -> int:
+        return self.rng.randint(49152, 65535)
+
+    # --- misc -----------------------------------------------------------------
+    def pid(self) -> int:
+        return self.rng.randint(300, 65000)
+
+    def logon_id(self) -> str:
+        return f"0x{self.rng.getrandbits(32):x}"

trazas/engine.py

@@ -0,0 +1,47 @@
+"""Combine scenarios and noise into one time-ordered dataset."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from datetime import datetime
+
+from trazas import scenarios
+from trazas.context import GenContext
+from trazas.events import Event
+from trazas.noise import noise_for
+
+DEFAULT_WINDOW_S = 3600.0
+MAX_NOISE = 1_000_000
+
+
+def generate(
+    scenario_ids: Sequence[str],
+    *,
+    seed: int,
+    start: datetime,
+    noise: int = 200,
+    window_s: float = DEFAULT_WINDOW_S,
+) -> list[Event]:
+    """Generate a sorted list of events for the given scenarios.
+
+    ``noise`` is the number of benign events per platform involved.
+    """
+    if not scenario_ids:
+        raise ValueError("at least one scenario is required")
+    if not 0 <= noise <= MAX_NOISE:
+        raise ValueError(f"noise must be between 0 and {MAX_NOISE}")
+    if window_s <= 0:
+        raise ValueError("window must be positive")
+
+    ctx = GenContext(seed=seed, start=start)
+    selected = [scenarios.get(sid) for sid in dict.fromkeys(scenario_ids)]
+
+    events: list[Event] = []
+    for scenario in selected:
+        events.extend(scenario.generate(ctx))
+    for platform in sorted({s.platform for s in selected}):
+        events.extend(noise_for(platform, ctx, noise, window_s))
+
+    # Stable sort: ties keep generation order, so output stays deterministic.
+    events.sort(key=lambda e: e.timestamp)
+    return events

trazas/events.py

@@ -0,0 +1,45 @@
+"""Core event model."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any, Literal
+
+Source = Literal["windows_security", "windows_system", "sysmon", "linux_auth"]
+
+
+def iso_utc(ts: datetime) -> str:
+    """Render a timezone-aware datetime as ISO 8601 UTC with millisecond precision."""
+    if ts.tzinfo is None:
+        raise ValueError("timestamps must be timezone-aware")
+    return ts.astimezone(timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+
+
+@dataclass(frozen=True, slots=True)
+class Event:
+    """A single synthetic log event.
+
+    ``fields`` follows the column names of the closest well-known schema
+    (Microsoft Sentinel ``SecurityEvent`` for Windows, syslog/auth.log for Linux)
+    so the output can be loaded directly into tools that expect those names.
+    """
+
+    timestamp: datetime
+    source: Source
+    fields: dict[str, Any]
+    scenario: str
+    malicious: bool = False
+    technique: str | None = None
+    raw: str | None = field(default=None, compare=False)
+
+    def to_record(self, *, include_labels: bool = False) -> dict[str, Any]:
+        record: dict[str, Any] = {"TimeGenerated": iso_utc(self.timestamp), "Source": self.source}
+        record.update(self.fields)
+        if include_labels:
+            record["_trazas"] = {
+                "scenario": self.scenario,
+                "malicious": self.malicious,
+                "technique": self.technique,
+            }
+        return record

trazas/linux.py

@@ -0,0 +1,80 @@
+"""Builders for Linux ``auth.log`` (sshd) events."""
+
+from __future__ import annotations
+
+from datetime import datetime
+
+from trazas.context import GenContext
+from trazas.events import Event
+
+
+def _syslog_ts(ts: datetime) -> str:
+    # Classic BSD syslog format, e.g. "Nov  1 03:04:05".
+    return f"{ts:%b} {ts.day:>2} {ts:%H:%M:%S}"
+
+
+def sshd(
+    ctx: GenContext,
+    ts: datetime,
+    *,
+    host: str,
+    message: str,
+    user: str,
+    src_ip: str,
+    outcome: str,
+    scenario: str,
+    pid: int | None = None,
+    malicious: bool = False,
+    technique: str | None = None,
+) -> Event:
+    pid = pid if pid is not None else ctx.pid()
+    raw = f"{_syslog_ts(ts)} {host} sshd[{pid}]: {message}"
+    fields = {
+        "HostName": host,
+        "ProcessName": "sshd",
+        "ProcessID": pid,
+        "SyslogMessage": message,
+        "User": user,
+        "SrcIp": src_ip,
+        "Outcome": outcome,
+    }
+    return Event(ts, "linux_auth", fields, scenario, malicious, technique, raw=raw)
+
+
+def failed_password(
+    ctx: GenContext,
+    ts: datetime,
+    *,
+    host: str,
+    user: str,
+    user_exists: bool,
+    src_ip: str,
+    scenario: str,
+    malicious: bool = False,
+    technique: str | None = None,
+) -> Event:
+    who = user if user_exists else f"invalid user {user}"
+    msg = f"Failed password for {who} from {src_ip} port {ctx.ephemeral_port()} ssh2"
+    return sshd(
+        ctx, ts, host=host, message=msg, user=user, src_ip=src_ip, outcome="failure",
+        scenario=scenario, malicious=malicious, technique=technique,
+    )  # fmt: skip
+
+
+def accepted(
+    ctx: GenContext,
+    ts: datetime,
+    *,
+    host: str,
+    user: str,
+    src_ip: str,
+    method: str,
+    scenario: str,
+    malicious: bool = False,
+    technique: str | None = None,
+) -> Event:
+    msg = f"Accepted {method} for {user} from {src_ip} port {ctx.ephemeral_port()} ssh2"
+    return sshd(
+        ctx, ts, host=host, message=msg, user=user, src_ip=src_ip, outcome="success",
+        scenario=scenario, malicious=malicious, technique=technique,
+    )  # fmt: skip

trazas/noise.py

@@ -0,0 +1,97 @@
+"""Benign background activity.
+
+Noise matters: a detection that only works on attack-only data is untested.
+It deliberately includes look-alikes (a user mistyping a password, admins
+using SMB shares) so rules have to tell the difference.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from datetime import datetime
+
+from trazas import linux, windows
+from trazas.context import GenContext
+from trazas.events import Event
+from trazas.scenarios.base import Platform
+
+NOISE_SCENARIO = "benign"
+
+_DEFENDER_DIR = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.24090.11-0"
+_SENSE_DIR = "C:\\Program Files\\Windows Defender Advanced Threat Protection"
+# Legitimate processes that routinely open lsass.exe. Defender uses the same access
+# mask as Mimikatz and the EDR sensor asks for full access, so a rule keyed only on
+# GrantedAccess will fire on these.
+_LSASS_READERS = (
+    (f"{_DEFENDER_DIR}\\MsMpEng.exe", "0x1010", f"{_DEFENDER_DIR}\\MpSvc.dll"),
+    (f"{_SENSE_DIR}\\MsSense.exe", "0x1fffff", f"{_SENSE_DIR}\\MsSense.exe"),
+    ("C:\\Windows\\System32\\svchost.exe", "0x1000", "C:\\Windows\\System32\\RPCRT4.dll"),
+)
+
+
+def _benign_lsass_access(ctx: GenContext, ts: datetime, host: str, lsass_pids: dict[str, int]) -> Event:
+    image, access, module = ctx.rng.choice(_LSASS_READERS)
+    lsass_pid = lsass_pids.setdefault(host, ctx.rng.randint(600, 1200))
+    return windows.sysmon_process_access(
+        ctx, ts, computer=host, source_image=image, source_pid=ctx.pid(),
+        source_user="NT AUTHORITY\\SYSTEM", target_image=windows.LSASS_IMAGE, target_pid=lsass_pid,
+        granted_access=access, trace=windows.call_trace(ctx, (windows.NTDLL, windows.KERNELBASE, module)),
+        scenario=NOISE_SCENARIO,
+    )  # fmt: skip
+
+
+def windows_noise(ctx: GenContext, count: int, window_s: float) -> Iterator[Event]:
+    users = ctx.users(12)
+    hosts = [ctx.workstation() for _ in range(8)] + [ctx.server("FS"), ctx.server("DC")]
+    lsass_pids: dict[str, int] = {}
+    for _ in range(count):
+        ts = ctx.at(ctx.jitter(0, window_s))
+        user = ctx.rng.choice(users)
+        host = ctx.rng.choice(hosts)
+        roll = ctx.rng.random()
+        if roll < 0.08:  # honest typo
+            yield windows.logon_failure(
+                ctx, ts, computer=host, user=user, user_exists=True, logon_type=2, ip="127.0.0.1",
+                workstation=host, scenario=NOISE_SCENARIO,
+            )  # fmt: skip
+        elif roll < 0.15:
+            yield windows.share_access(
+                ts, computer=ctx.rng.choice(hosts), user=user, share="IPC$",
+                ip=ctx.internal_ip(), scenario=NOISE_SCENARIO,
+            )  # fmt: skip
+        elif roll < 0.21:  # AV/EDR touching lsass: look-alike for credential dumping
+            yield _benign_lsass_access(ctx, ts, host, lsass_pids)
+        elif roll < 0.35:
+            yield windows.logoff(ctx, ts, computer=host, user=user, logon_type=3, scenario=NOISE_SCENARIO)
+        else:
+            logon_type = ctx.rng.choice((2, 3, 3, 3, 7, 11))
+            ip = "-" if logon_type in (2, 7, 11) else ctx.internal_ip()
+            yield windows.logon_success(
+                ctx, ts, computer=host, user=user, logon_type=logon_type, ip=ip, workstation=host,
+                scenario=NOISE_SCENARIO, auth_package=ctx.rng.choice(("Kerberos", "Kerberos", "NTLM")),
+            )  # fmt: skip
+
+
+def linux_noise(ctx: GenContext, count: int, window_s: float) -> Iterator[Event]:
+    admins = ["deploy", "ansible", ctx.username().split(".")[0]]
+    hosts = ["web01", "app02", "bastion", "db01"]
+    for _ in range(count):
+        ts = ctx.at(ctx.jitter(0, window_s))
+        user = ctx.rng.choice(admins)
+        src = ctx.internal_ip()
+        if ctx.rng.random() < 0.05:  # someone fat-fingers a password once
+            yield linux.failed_password(
+                ctx, ts, host=ctx.rng.choice(hosts), user=user, user_exists=True, src_ip=src,
+                scenario=NOISE_SCENARIO,
+            )  # fmt: skip
+        else:
+            yield linux.accepted(
+                ctx, ts, host=ctx.rng.choice(hosts), user=user, src_ip=src, method="publickey",
+                scenario=NOISE_SCENARIO,
+            )  # fmt: skip
+
+
+def noise_for(platform: Platform, ctx: GenContext, count: int, window_s: float) -> Iterator[Event]:
+    if platform == "windows":
+        return windows_noise(ctx, count, window_s)
+    return linux_noise(ctx, count, window_s)

trazas/scenarios/__init__.py

@@ -0,0 +1,34 @@
+"""Scenario registry.
+
+Scenarios are registered explicitly instead of discovered dynamically so that
+running ``trazas`` never imports code from outside the package.
+"""
+
+from __future__ import annotations
+
+from trazas.scenarios.base import Platform, Scenario
+from trazas.scenarios.lsass_dump import LsassCredentialDump
+from trazas.scenarios.psexec_lateral import PsExecLateralMovement
+from trazas.scenarios.ssh_bruteforce import SshBruteForce
+from trazas.scenarios.windows_bruteforce import WindowsBruteForce
+from trazas.scenarios.windows_spray import WindowsPasswordSpray
+
+_ALL: tuple[type[Scenario], ...] = (
+    WindowsBruteForce,
+    WindowsPasswordSpray,
+    PsExecLateralMovement,
+    LsassCredentialDump,
+    SshBruteForce,
+)
+
+REGISTRY: dict[str, type[Scenario]] = {cls.id: cls for cls in _ALL}
+
+__all__ = ["REGISTRY", "Platform", "Scenario", "get"]
+
+
+def get(scenario_id: str) -> Scenario:
+    try:
+        return REGISTRY[scenario_id]()
+    except KeyError:
+        known = ", ".join(sorted(REGISTRY))
+        raise KeyError(f"unknown scenario {scenario_id!r}; available: {known}") from None

trazas/scenarios/base.py

@@ -0,0 +1,30 @@
+"""Scenario contract."""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from collections.abc import Iterator
+from typing import ClassVar, Literal
+
+from trazas.context import GenContext
+from trazas.events import Event
+
+Platform = Literal["windows", "linux"]
+
+
+class Scenario(ABC):
+    """An attack scenario that emits the malicious events of one technique chain.
+
+    Benign background noise is added separately by the engine, so scenarios only
+    need to describe what the attacker does.
+    """
+
+    id: ClassVar[str]
+    name: ClassVar[str]
+    description: ClassVar[str]
+    platform: ClassVar[Platform]
+    techniques: ClassVar[tuple[str, ...]]
+
+    @abstractmethod
+    def generate(self, ctx: GenContext) -> Iterator[Event]:
+        """Yield the scenario's events. Order does not matter; the engine sorts."""

trazas/scenarios/lsass_dump.py

@@ -0,0 +1,116 @@
+"""T1003.001 - Credential dumping from LSASS process memory."""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from dataclasses import dataclass
+
+from trazas import windows
+from trazas.context import DOMAIN, GenContext
+from trazas.events import Event
+from trazas.scenarios.base import Scenario
+
+TECHNIQUE = "T1003.001"
+
+
+@dataclass(frozen=True, slots=True)
+class _Tool:
+    image: str
+    # Formatted with ``pid`` (lsass PID), ``dump`` (dump path) and ``exe`` (image basename).
+    command: str
+    granted_access: str
+    modules: tuple[str, ...]
+    unknown_frame: bool  # in-memory code shows up as UNKNOWN(...) in CallTrace
+    writes_dump: bool
+
+
+_RUNDLL32 = "C:\\Windows\\System32\\rundll32.exe"
+_PROCDUMP = "C:\\Users\\Public\\procdump64.exe"
+
+_TOOLS = (
+    # LOLBin: comsvcs.dll exports MiniDump, so no tool needs to be dropped on disk.
+    _Tool(
+        image=_RUNDLL32,
+        command="rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump {pid} {dump} full",
+        granted_access="0x1fffff",
+        modules=(
+            windows.NTDLL,
+            windows.KERNELBASE,
+            "C:\\Windows\\SYSTEM32\\dbgcore.DLL",
+            "C:\\Windows\\System32\\comsvcs.dll",
+            _RUNDLL32,
+        ),
+        unknown_frame=False,
+        writes_dump=True,
+    ),
+    # Signed Sysinternals binary abused to write a full memory dump.
+    _Tool(
+        image=_PROCDUMP,
+        command="{exe} -accepteula -ma lsass.exe {dump}",
+        granted_access="0x1fffff",
+        modules=(windows.NTDLL, windows.KERNELBASE, "C:\\Windows\\SYSTEM32\\dbghelp.dll", _PROCDUMP),
+        unknown_frame=False,
+        writes_dump=True,
+    ),
+    # Renamed Mimikatz reading credentials straight out of lsass memory.
+    _Tool(
+        image="C:\\Users\\Public\\svchelper.exe",
+        command='{exe} "privilege::debug" "sekurlsa::logonpasswords" exit',
+        granted_access="0x1010",
+        modules=(windows.NTDLL, windows.KERNELBASE, "C:\\Users\\Public\\svchelper.exe"),
+        unknown_frame=True,
+        writes_dump=False,
+    ),
+)
+
+_DUMP_NAMES = ("lsass", "debug", "report", "mem", "out")
+_PARENTS = (
+    "C:\\Windows\\System32\\cmd.exe",
+    "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+)
+
+
+class LsassCredentialDump(Scenario):
+    id = "lsass-dump"
+    name = "LSASS credential dumping"
+    description = (
+        "A local admin runs a dumping tool (comsvcs.dll MiniDump, procdump -ma, or a "
+        "renamed Mimikatz) that opens lsass.exe with read access (Sysmon 10) and, for the "
+        "dump variants, writes a .dmp file (Sysmon 11). Background noise contains benign "
+        "lsass access from Defender, the EDR sensor and svchost."
+    )
+    platform = "windows"
+    techniques = (TECHNIQUE,)
+
+    def generate(self, ctx: GenContext) -> Iterator[Event]:
+        tool = ctx.rng.choice(_TOOLS)
+        host = ctx.workstation()
+        user = f"{DOMAIN}\\{ctx.username()}"
+        lsass_pid = ctx.rng.randint(600, 1200)
+        tool_pid = ctx.pid()
+        dump = f"C:\\Windows\\Temp\\{ctx.rng.choice(_DUMP_NAMES)}{ctx.rng.randint(1, 99)}.dmp"
+        exe = tool.image.rsplit("\\", 1)[-1]
+        t = ctx.jitter(300, 2400)
+
+        yield windows.sysmon_process(
+            ctx, ctx.at(t), computer=host, image=tool.image,
+            command_line=tool.command.format(pid=lsass_pid, dump=dump, exe=exe),
+            parent_image=ctx.rng.choice(_PARENTS), user=user, scenario=self.id,
+            malicious=True, technique=TECHNIQUE, pid=tool_pid,
+        )  # fmt: skip
+
+        t += ctx.jitter(0.2, 1.5)
+        yield windows.sysmon_process_access(
+            ctx, ctx.at(t), computer=host, source_image=tool.image, source_pid=tool_pid,
+            source_user=user, target_image=windows.LSASS_IMAGE, target_pid=lsass_pid,
+            granted_access=tool.granted_access,
+            trace=windows.call_trace(ctx, tool.modules, unknown_frame=tool.unknown_frame),
+            scenario=self.id, malicious=True, technique=TECHNIQUE,
+        )  # fmt: skip
+
+        if tool.writes_dump:
+            t += ctx.jitter(1.0, 6.0)
+            yield windows.sysmon_file_create(
+                ctx.at(t), computer=host, image=tool.image, pid=tool_pid, user=user,
+                target_filename=dump, scenario=self.id, malicious=True, technique=TECHNIQUE,
+            )  # fmt: skip