{
  "source": "/blackice/runtime/engine.js and /blackice/runtime/memory.js",
  "fixture": "/assets/blackice-fixtures.js",
  "commands": [
    "nmap 192.0.2.10",
    "net view",
    "net user"
  ],
  "knowledge": {
    "T1595": {
      "id": "T1595",
      "name": "Active Scanning",
      "tactic": "reconnaissance",
      "capec_ids": [
        "CAPEC-169"
      ],
      "prerequisites": [],
      "enables": [
        "T1046"
      ]
    },
    "T1046": {
      "id": "T1046",
      "name": "Network Service Discovery",
      "tactic": "discovery",
      "capec_ids": [
        "CAPEC-300"
      ],
      "prerequisites": [
        "T1595"
      ],
      "enables": [
        "T1135",
        "T1087",
        "T1018"
      ]
    },
    "T1018": {
      "id": "T1018",
      "name": "Remote System Discovery",
      "tactic": "discovery",
      "capec_ids": [
        "CAPEC-292"
      ],
      "prerequisites": [
        "T1046"
      ],
      "enables": [
        "T1087"
      ]
    },
    "T1135": {
      "id": "T1135",
      "name": "Network Share Discovery",
      "tactic": "discovery",
      "capec_ids": [
        "CAPEC-643"
      ],
      "prerequisites": [
        "T1046"
      ],
      "enables": [
        "T1039"
      ]
    },
    "T1087": {
      "id": "T1087",
      "name": "Account Discovery",
      "tactic": "discovery",
      "capec_ids": [
        "CAPEC-575"
      ],
      "prerequisites": [
        "T1046"
      ],
      "enables": [
        "T1649",
        "T1078"
      ]
    },
    "T1039": {
      "id": "T1039",
      "name": "Data from Network Shared Drive",
      "tactic": "collection",
      "capec_ids": [
        "CAPEC-639"
      ],
      "prerequisites": [
        "T1135"
      ],
      "enables": []
    },
    "T1649": {
      "id": "T1649",
      "name": "Steal or Forge Authentication Certificates",
      "tactic": "credential-access",
      "capec_ids": [],
      "prerequisites": [
        "T1087"
      ],
      "enables": [
        "T1550"
      ]
    },
    "T1078": {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactic": "initial-access",
      "capec_ids": [
        "CAPEC-560"
      ],
      "prerequisites": [
        "T1087"
      ],
      "enables": [
        "T1021",
        "T1550"
      ]
    },
    "T1550": {
      "id": "T1550",
      "name": "Use Alternate Authentication Material",
      "tactic": "lateral-movement",
      "capec_ids": [],
      "prerequisites": [
        "T1649"
      ],
      "enables": [
        "T1021.002"
      ]
    },
    "T1021": {
      "id": "T1021",
      "name": "Remote Services",
      "tactic": "lateral-movement",
      "capec_ids": [
        "CAPEC-555"
      ],
      "prerequisites": [
        "T1078"
      ],
      "enables": [
        "T1021.002"
      ]
    },
    "T1021.002": {
      "id": "T1021.002",
      "name": "SMB/Windows Admin Shares",
      "tactic": "lateral-movement",
      "capec_ids": [
        "CAPEC-561"
      ],
      "prerequisites": [
        "T1550",
        "T1021"
      ],
      "enables": []
    }
  },
  "memoryFrames": [
    {
      "step": 0,
      "adjacency": {
        "T1595": {
          "T1046": 0.4
        },
        "T1046": {
          "T1135": 0.4,
          "T1087": 0.4,
          "T1018": 0.4
        },
        "T1018": {
          "T1087": 0.4
        },
        "T1135": {
          "T1039": 0.4
        },
        "T1087": {
          "T1649": 0.4,
          "T1078": 0.4
        },
        "T1039": {},
        "T1649": {
          "T1550": 0.4
        },
        "T1078": {
          "T1021": 0.4,
          "T1550": 0.4
        },
        "T1550": {
          "T1021.002": 0.4
        },
        "T1021": {
          "T1021.002": 0.4
        },
        "T1021.002": {}
      },
      "observed": [],
      "ranks": [
        {
          "id": "T1087",
          "score": 0.2445875,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.56,
            "rwr": 0.078625
          }
        },
        {
          "id": "T1018",
          "score": 0.19375,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.4,
            "rwr": 0.042499999999999996
          }
        },
        {
          "id": "T1135",
          "score": 0.19375,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.4,
            "rwr": 0.042499999999999996
          }
        }
      ]
    },
    {
      "step": 1,
      "adjacency": {
        "T1595": {
          "T1046": 0.4
        },
        "T1046": {
          "T1135": 0.4,
          "T1087": 0.4,
          "T1018": 0.4
        },
        "T1018": {
          "T1087": 0.4
        },
        "T1135": {
          "T1039": 0.4
        },
        "T1087": {
          "T1649": 0.4,
          "T1078": 0.4
        },
        "T1039": {},
        "T1649": {
          "T1550": 0.4
        },
        "T1078": {
          "T1021": 0.4,
          "T1550": 0.4
        },
        "T1550": {
          "T1021.002": 0.4
        },
        "T1021": {
          "T1021.002": 0.4
        },
        "T1021.002": {}
      },
      "observed": [],
      "ranks": [
        {
          "id": "T1087",
          "score": 0.2445875,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.56,
            "rwr": 0.078625
          }
        },
        {
          "id": "T1018",
          "score": 0.19375,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.4,
            "rwr": 0.042499999999999996
          }
        },
        {
          "id": "T1135",
          "score": 0.19375,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.4,
            "rwr": 0.042499999999999996
          }
        }
      ]
    },
    {
      "step": 2,
      "adjacency": {
        "T1595": {
          "T1046": 0.4
        },
        "T1046": {
          "T1135": 1,
          "T1087": 0.4,
          "T1018": 0.4
        },
        "T1018": {
          "T1087": 0.4
        },
        "T1135": {
          "T1039": 0.4
        },
        "T1087": {
          "T1649": 0.4,
          "T1078": 0.4
        },
        "T1039": {},
        "T1649": {
          "T1550": 0.4
        },
        "T1078": {
          "T1021": 0.4,
          "T1550": 0.4
        },
        "T1550": {
          "T1021.002": 0.4
        },
        "T1021": {
          "T1021.002": 0.4
        },
        "T1021.002": {}
      },
      "observed": [
        {
          "from": "T1046",
          "to": "T1135",
          "weight": 1
        }
      ],
      "ranks": [
        {
          "id": "T1135",
          "score": 0.35224999999999995,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 1,
            "rwr": 0.07083333333333333
          }
        },
        {
          "id": "T1087",
          "score": 0.23672500000000002,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.56,
            "rwr": 0.05241666666666668
          }
        },
        {
          "id": "T1018",
          "score": 0.1895,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.4,
            "rwr": 0.02833333333333334
          }
        }
      ]
    },
    {
      "step": 3,
      "adjacency": {
        "T1595": {
          "T1046": 0.4
        },
        "T1046": {
          "T1135": 0.9862959810605475,
          "T1087": 0.4,
          "T1018": 0.4
        },
        "T1018": {
          "T1087": 0.4
        },
        "T1135": {
          "T1039": 0.4,
          "T1087": 0.6
        },
        "T1087": {
          "T1649": 0.4,
          "T1078": 0.4
        },
        "T1039": {},
        "T1649": {
          "T1550": 0.4
        },
        "T1078": {
          "T1021": 0.4,
          "T1550": 0.4
        },
        "T1550": {
          "T1021.002": 0.4
        },
        "T1021": {
          "T1021.002": 0.4
        },
        "T1021.002": {}
      },
      "observed": [
        {
          "from": "T1046",
          "to": "T1135",
          "weight": 0.9862959810605475
        },
        {
          "from": "T1135",
          "to": "T1087",
          "weight": 0.6
        }
      ],
      "ranks": [
        {
          "id": "T1087",
          "score": 0.3576166242070983,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 1,
            "rwr": 0.08872208069032776
          }
        },
        {
          "id": "T1135",
          "score": 0.3486935754889963,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.9862959810605475,
            "rwr": 0.07039860074619814
          }
        },
        {
          "id": "T1018",
          "score": 0.18956520988807027,
          "parts": {
            "cos": 0.17999999999999997,
            "path": 0.4,
            "rwr": 0.02855069962690093
          }
        }
      ]
    }
  ],
  "replay": [
    {
      "changed": false,
      "traces": [
        [
          {
            "command": "whoami",
            "code": 0,
            "out": "researcher\n",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "cat /opt/notes.txt",
            "code": 0,
            "out": "baseline\n",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "echo reviewed > /opt/result.txt",
            "code": 0,
            "out": "",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "cat /opt/result.txt",
            "code": 0,
            "out": "reviewed\n",
            "err": "",
            "source": "builtin"
          }
        ],
        [
          {
            "command": "whoami",
            "code": 0,
            "out": "researcher\n",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "cat /opt/notes.txt",
            "code": 0,
            "out": "baseline\n",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "echo reviewed > /opt/result.txt",
            "code": 0,
            "out": "",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "cat /opt/result.txt",
            "code": 0,
            "out": "reviewed\n",
            "err": "",
            "source": "builtin"
          }
        ]
      ],
      "notes": [
        "baseline\n",
        "baseline\n"
      ],
      "results": [
        "reviewed\n",
        "reviewed\n"
      ]
    },
    {
      "changed": true,
      "traces": [
        [
          {
            "command": "whoami",
            "code": 0,
            "out": "researcher\n",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "cat /opt/notes.txt",
            "code": 0,
            "out": "baseline\n",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "echo reviewed > /opt/result.txt",
            "code": 0,
            "out": "",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "cat /opt/result.txt",
            "code": 0,
            "out": "reviewed\n",
            "err": "",
            "source": "builtin"
          }
        ],
        [
          {
            "command": "whoami",
            "code": 0,
            "out": "researcher\n",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "cat /opt/notes.txt",
            "code": 0,
            "out": "changed baseline\n",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "echo reviewed > /opt/result.txt",
            "code": 0,
            "out": "",
            "err": "",
            "source": "builtin"
          },
          {
            "command": "cat /opt/result.txt",
            "code": 0,
            "out": "reviewed\n",
            "err": "",
            "source": "builtin"
          }
        ]
      ],
      "notes": [
        "baseline\n",
        "changed baseline\n"
      ],
      "results": [
        "reviewed\n",
        "reviewed\n"
      ]
    }
  ]
}