trazas 0.1.0__tar.gz

trazas-0.1.0/.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml,toml,md}]
+indent_size = 2

trazas-0.1.0/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Every change needs a review from the maintainer.
+*                    @geinerjimenezvillegas-create
+/.github/            @geinerjimenezvillegas-create

trazas-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,28 @@
+name: Bug report
+description: Something produces wrong, invalid or unrealistic output
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Security issue?** Do not open a public issue — see SECURITY.md.
+  - type: input
+    id: version
+    attributes:
+      label: trazas version
+      description: Output of `trazas --version`
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Exact command (include --seed and --start so we can reproduce it)
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect, and what happened instead?
+    validations:
+      required: true

trazas-0.1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a vulnerability (private)
+    url: https://github.com/geinerjimenezvillegas-create/trazas/security/advisories/new
+    about: Please report security issues privately.

trazas-0.1.0/.github/ISSUE_TEMPLATE/new_scenario.yml

@@ -0,0 +1,30 @@
+name: New scenario
+description: Propose an attack scenario to simulate
+labels: [scenario]
+body:
+  - type: input
+    id: techniques
+    attributes:
+      label: MITRE ATT&CK technique(s)
+      placeholder: T1003.001
+    validations:
+      required: true
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options: [windows, linux, cloud, other]
+    validations:
+      required: true
+  - type: textarea
+    id: events
+    attributes:
+      label: Which events/log lines should appear, in what order?
+      description: Event IDs, key fields and timing. Link public references (vendor docs, DFIR reports).
+    validations:
+      required: true
+  - type: textarea
+    id: lookalikes
+    attributes:
+      label: Benign look-alikes
+      description: Legitimate activity that produces similar logs (useful as noise / false positives).

trazas-0.1.0/.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: ci
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      dev-tools:
+        patterns: ["*"]
+    commit-message:
+      prefix: build

trazas-0.1.0/.github/pull_request_template.md

@@ -0,0 +1,9 @@
+## What does this change?
+
+## Checklist
+
+- [ ] Tests added/updated, `pytest` passes
+- [ ] `ruff check .`, `ruff format --check .` and `mypy` pass
+- [ ] New scenarios only use documentation/private IPs and `example.com` domains
+- [ ] Output is deterministic for a given `--seed` and `--start`
+- [ ] `CHANGELOG.md` updated under *Unreleased*

trazas-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,78 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+# Least privilege by default; jobs opt in to more if they need it.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint & type-check
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install -e ".[dev]"
+      - run: ruff check --output-format=github .
+      - run: ruff format --check .
+      - run: mypy
+
+  test:
+    name: Test (py${{ matrix.python }}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python: ["3.10", "3.11", "3.12", "3.13"]
+        include:
+          - { os: windows-latest, python: "3.13" }
+          - { os: macos-latest, python: "3.13" }
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+      - run: python -m pip install -e ".[dev]"
+      - run: pytest --cov --cov-report=term --cov-report=xml
+
+  build:
+    name: Build & smoke-test package
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: [lint, test]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - run: python -m pip install build twine
+      - run: python -m build
+      - run: python -m twine check --strict dist/*
+      - name: Install wheel in a clean venv and run it
+        run: |
+          python -m venv /tmp/venv
+          /tmp/venv/bin/pip install dist/*.whl
+          /tmp/venv/bin/trazas list
+          /tmp/venv/bin/trazas generate ssh-bruteforce -s 1 -n 5 -f raw > /dev/null

trazas-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "27 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        # "actions" scans the workflows themselves for injection and permission issues.
+        language: [python, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+      - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          category: /language:${{ matrix.language }}

trazas-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,76 @@
+name: Release
+
+# Push a tag like v0.1.0 to publish. No API tokens are stored anywhere:
+# PyPI authenticates this workflow through OIDC ("Trusted Publishing").
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write # sign the provenance attestation
+      attestations: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+      - name: Check tag matches package version
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          version=$(python -c "import re,pathlib;print(re.search(r'__version__ = \"(.+?)\"', pathlib.Path('src/trazas/__init__.py').read_text())[1])")
+          test "v${version}" = "${TAG}" || { echo "tag ${TAG} != v${version}"; exit 1; }
+      - run: python -m pip install build twine
+      - run: python -m build
+      - run: python -m twine check --strict dist/*
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/p/trazas
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+
+  github-release:
+    needs: publish-pypi
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
+        run: gh release create "$TAG" dist/* --repo "$REPO" --title "$TAG" --generate-notes --verify-tag

trazas-0.1.0/.github/workflows/scorecard.yml

@@ -0,0 +1,30 @@
+name: OpenSSF Scorecard
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "41 7 * * 2"
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      security-events: write
+      id-token: write # publish results to the public Scorecard API / badge
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          sarif_file: results.sarif

trazas-0.1.0/.gitignore

@@ -0,0 +1,17 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+build/
+dist/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+coverage.xml
+htmlcov/
+# generated datasets
+*.jsonl
+*.log
+!tests/fixtures/**

trazas-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,25 @@
+# Install once with: pre-commit install
+# Keep hooks current with: pre-commit autoupdate
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-yaml
+      - id: check-toml
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-added-large-files
+      - id: detect-private-key
+      - id: check-merge-conflict
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.17.4
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks

trazas-0.1.0/CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-11-11
+
+### Added
+
+- `trazas list`, `describe` and `generate` commands.
+- Scenarios: `windows-bruteforce` (T1110.001), `windows-spray` (T1110.003),
+  `psexec-lateral` (T1021.002, T1569.002), `ssh-bruteforce` (T1110.001).
+- Scenario `lsass-dump` (T1003.001): Sysmon 1 → Sysmon 10 ProcessAccess on `lsass.exe`
+  → Sysmon 11 dump file, in three variants (comsvcs.dll `MiniDump`, `procdump -ma`,
+  renamed Mimikatz with an `UNKNOWN` CallTrace frame).
+- Benign background noise for Windows and Linux, including look-alike Sysmon 10 lsass
+  access from Defender (`0x1010`), the EDR sensor (`0x1fffff`) and svchost (`0x1000`).
+- `jsonl` output with Sentinel `SecurityEvent` column names and `raw` auth.log output.
+- Optional ground-truth labels (`--labels`).
+
+[Unreleased]: https://github.com/geinerjimenezvillegas-create/trazas/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/geinerjimenezvillegas-create/trazas/releases/tag/v0.1.0

trazas-0.1.0/CLAUDE.md

@@ -0,0 +1,40 @@
+# CLAUDE.md — trazas
+
+Synthetic, labelled attack-log generator for testing detection rules. Python ≥3.10,
+src layout, **zero runtime dependencies** (keep it that way; dev deps only in `[dev]`).
+
+## Commands
+
+```bash
+pip install -e ".[dev]"          # setup
+ruff check . && ruff format --check . && mypy && pytest --cov   # must all pass
+python -m trazas list            # smoke test
+```
+
+## Architecture
+
+- `src/trazas/context.py` — `GenContext`: single seeded RNG, IP/user/host helpers.
+- `src/trazas/windows.py`, `linux.py` — event builders (Sentinel `SecurityEvent` column names / auth.log).
+- `src/trazas/scenarios/` — one `Scenario` subclass per attack; registered explicitly in `__init__.py`.
+- `src/trazas/noise.py` — benign background + look-alikes.
+- `src/trazas/engine.py` — merges scenarios + noise, stable sort by time.
+- `src/trazas/cli.py` — argparse CLI (`list`, `describe`, `generate`).
+
+## Non-negotiable rules
+
+- All randomness via `ctx.rng`; never `random` module directly or wall-clock time. Same seed+start ⇒ identical bytes.
+- Only RFC 5737 / RFC 1918 IPs and `example.com` domains (enforced by tests).
+- Every attacker event: `malicious=True` + ATT&CK `technique`.
+- mypy strict and ruff must stay clean; no `# type: ignore` / `noqa` without a reason comment.
+- New scenario ⇒ test + row in README.md and README.es.md + CHANGELOG entry.
+- Never commit secrets, tokens or real log data. Never weaken workflow `permissions`.
+- Conventional Commits. Work on a branch and open a PR; don't push to `main` directly.
+
+## Pending work (maintainer TODO)
+
+1. ~~Replace `OWNER` placeholder~~ — done.
+2. ~~Pin GitHub Actions to SHAs~~ — done (Dependabot keeps them updated).
+3. ~~`pre-commit autoupdate`~~ — done.
+4. `docs/github-setup.md`: applied, including SSH commit signing and the PyPI pending
+   trusted publisher.
+5. ~~LSASS credential dumping scenario (T1003.001)~~ — done (`lsass-dump`).

trazas-0.1.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,9 @@
+# Code of Conduct
+
+This project adopts the [Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+In short: be respectful and welcoming, assume good faith, and focus on what is best
+for the community. Harassment of any kind is not tolerated.
+
+Report unacceptable behaviour privately to the maintainer through the contact on their
+GitHub profile. All reports will be handled confidentially.

trazas-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing to trazas
+
+Thanks for helping! Contributions in English or Spanish are welcome. /
+¡Gracias! Se aceptan contribuciones en inglés o español.
+
+## Development setup
+
+```console
+git clone https://github.com/geinerjimenezvillegas-create/trazas && cd trazas
+python -m venv .venv && source .venv/bin/activate   # Windows: .venv\Scripts\activate
+pip install -e ".[dev]"
+pre-commit install
+```
+
+Before opening a PR, everything below must pass (CI runs the same):
+
+```console
+ruff check . && ruff format --check . && mypy && pytest --cov
+```
+
+## Adding a scenario
+
+1. Open a *New scenario* issue first so we can agree on the event sequence.
+2. Create `src/trazas/scenarios/<name>.py` with a `Scenario` subclass. Set `id`,
+   `name`, `description`, `platform` and `techniques`, and implement `generate()`.
+3. Build events with the helpers in `trazas.windows` / `trazas.linux`; add a helper if
+   a new event type is needed, using the field names of the closest real schema.
+4. Register it in `src/trazas/scenarios/__init__.py`.
+5. Add a test asserting the important parts of the chain (event IDs, order, fields).
+6. Add a row to the scenario tables in both READMEs and a line in `CHANGELOG.md`.
+
+### Rules for scenarios
+
+- **All randomness through `ctx.rng`** — never `random` directly, never wall-clock
+  time. Output must be deterministic for a given seed and start.
+- **No real infrastructure** — use `ctx.external_ip()`, `ctx.internal_ip()` and the
+  `example.com` domain. A test enforces this.
+- **Mark every attacker event** with `malicious=True` and its ATT&CK `technique`.
+- Prefer realism you can cite: link vendor docs or public DFIR reports in the PR.
+
+## Commits and PRs
+
+- Use [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`,
+  `docs:`, `ci:`…).
+- Keep PRs focused; one scenario per PR.
+- By contributing you agree your work is licensed under the MIT License.
+
+## Code of Conduct
+
+This project follows the [Code of Conduct](CODE_OF_CONDUCT.md).

trazas-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Geiner Jiménez Villegas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

trazas-0.1.0/PKG-INFO

@@ -0,0 +1,114 @@
+Metadata-Version: 2.5
+Name: trazas
+Version: 0.1.0
+Summary: Realistic, labelled attack log generator for testing detection rules without a lab.
+Project-URL: Homepage, https://github.com/geinerjimenezvillegas-create/trazas
+Project-URL: Issues, https://github.com/geinerjimenezvillegas-create/trazas/issues
+Project-URL: Changelog, https://github.com/geinerjimenezvillegas-create/trazas/blob/main/CHANGELOG.md
+Author: Geiner Jiménez Villegas
+License-Expression: MIT
+License-File: LICENSE
+Keywords: blue-team,detection-engineering,kql,logs,mitre-attack,security,siem,sigma
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Education
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: pre-commit>=3.8; extra == 'dev'
+Requires-Dist: pytest-cov>=5; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# trazas
+
+[![CI](https://github.com/geinerjimenezvillegas-create/trazas/actions/workflows/ci.yml/badge.svg)](https://github.com/geinerjimenezvillegas-create/trazas/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/geinerjimenezvillegas-create/trazas/actions/workflows/codeql.yml/badge.svg)](https://github.com/geinerjimenezvillegas-create/trazas/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/geinerjimenezvillegas-create/trazas/badge)](https://scorecard.dev/viewer/?uri=github.com/geinerjimenezvillegas-create/trazas)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
+**Realistic, labelled attack logs for testing detection rules — no lab required.**
+
+🇪🇸 [Leer en español](README.es.md)
+
+Writing a detection is easy; proving it works is hard. Most people don't have a
+lab with domain controllers, attackers and months of baseline traffic. `trazas`
+generates that data for you: attack chains mapped to MITRE ATT&CK, mixed with
+benign noise (including look-alikes that *should not* fire your rule), with
+optional ground-truth labels so you can measure true and false positives.
+
+```console
+$ pip install trazas
+$ trazas generate windows-bruteforce psexec-lateral --seed 42 --labels -o dataset.jsonl
+trazas: 248 events, seed=42, start=2026-11-10T23:00:00+00:00
+```
+
+## Features
+
+- **Detection-ready schemas** — Windows events use Microsoft Sentinel `SecurityEvent`
+  column names (`EventID`, `TargetUserName`, `LogonType`, `IpAddress`…); Linux events
+  are real `auth.log` lines.
+- **Reproducible** — same `--seed` + `--start` ⇒ byte-identical output. Perfect for
+  regression tests of your rules in CI.
+- **Ground truth** — `--labels` adds `_trazas.malicious` and `_trazas.technique` to every
+  record.
+- **Realistic noise** — normal logons, admin share use, honest password typos.
+- **Safe by design** — external IPs come only from RFC 5737 documentation ranges,
+  internal ones from RFC 1918, domains from `example.com`. Zero runtime dependencies.
+
+## Scenarios
+
+| ID | Platform | ATT&CK | What happens |
+|---|---|---|---|
+| `windows-bruteforce` | Windows | T1110.001 | Burst of 4625 against one account from one external IP, then 4624 |
+| `windows-spray` | Windows | T1110.003 | One password against many accounts (real and invalid), slow, one success |
+| `psexec-lateral` | Windows | T1021.002, T1569.002 | 4624 type 3 → 5140 `ADMIN$` → 7045 `PSEXESVC` → Sysmon 1 recon as SYSTEM |
+| `lsass-dump` | Windows | T1003.001 | Sysmon 1 dumper (comsvcs `MiniDump`, `procdump -ma` or renamed Mimikatz) → Sysmon 10 on `lsass.exe` → Sysmon 11 `.dmp`; noise adds benign Defender/EDR lsass access |
+| `ssh-bruteforce` | Linux | T1110.001 | sshd failures with common usernames, then `Accepted password` |
+
+Run `trazas list` and `trazas describe <id>` for details.
+
+## Usage
+
+```text
+trazas generate SCENARIO [SCENARIO ...]
+  -s, --seed INT       PRNG seed (random if omitted; printed so you can reproduce)
+  --start ISO8601      start time (default: now, UTC)
+  -n, --noise INT      benign events per platform (default: 200)
+  -f, --format         jsonl (default) | raw  (raw = native text, Linux only)
+  -o, --output PATH    write to file (refuses to overwrite without --force)
+  --labels             add ground-truth labels
+```
+
+## Testing a KQL rule without Sentinel
+
+1. Create a free [Azure Data Explorer cluster](https://dataexplorer.azure.com/freecluster).
+2. Generate data: `trazas generate windows-bruteforce windows-spray -s 1 --labels -o events.jsonl`
+3. Ingest `events.jsonl` into a table named `SecurityEvent` (JSON format).
+4. Run your rule. Example:
+
+```kql
+SecurityEvent
+| where EventID == 4625
+| summarize Failures = count(), Accounts = dcount(TargetUserName) by IpAddress, bin(TimeGenerated, 10m)
+| where Failures > 20 or Accounts > 10
+```
+
+Then compare against `_trazas.malicious` to count true and false positives. See
+[docs/testing-detections.md](docs/testing-detections.md).
+
+## Contributing
+
+New scenarios are very welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). Please report
+security issues privately as described in [SECURITY.md](SECURITY.md).
+
+## License
+
+[MIT](LICENSE). Generated data is synthetic; any resemblance to real users is coincidental.