{
  "schema_version": "1.0",
  "built_at": "2026-10-22T20:09:08+00:00",
  "sources": {
    "cisa-kev": {
      "last_attempt": "2026-10-22T18:57:47+00:00",
      "last_success": "2026-10-22T18:57:47+00:00",
      "state": "ok",
      "input_count": 1754,
      "source_digest": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b"
    },
    "cert-cc": {
      "state": "disabled-rights-review",
      "last_attempt": "2026-10-22T18:57:47+00:00"
    },
    "ms-volt": {
      "last_attempt": "2026-10-22T18:57:47+00:00",
      "last_success": "2026-10-22T18:57:47+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "5330424e70e518584db2bc875b557e17a24b6e8dd7912e541a76f0fc62fa70df"
    },
    "ms-destructive": {
      "last_attempt": "2026-10-22T18:57:47+00:00",
      "last_success": "2026-10-22T18:57:47+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "c3dd977fa5cfc5830204bdf255dc7d26217ed6000a8aa84ef02ae0c527bc710d"
    },
    "ms-human-operated-ransomware-2020": {
      "last_attempt": "2026-10-22T19:50:55+00:00",
      "last_success": "2026-10-22T19:50:55+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "39341fccf4f9caf0ef555d7245597bee37ebbdb038719c5ba031521777a2b3cc"
    },
    "ms-storm-2949-cloud-breach-2026": {
      "last_attempt": "2026-10-22T19:50:55+00:00",
      "last_success": "2026-10-22T19:50:55+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "45ca7f6de9f52211272274943041456f86a5153b34759c194cc469ef6145dcf1"
    },
    "eset-industroyer2-caddywiper-2022": {
      "last_attempt": "2026-10-22T19:51:52+00:00",
      "last_success": "2026-10-22T19:51:52+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "4a945d9759d7c49667f12522f43c458d40507c79ff79d0c877293a4a9d9b5eb2"
    },
    "mandiant-russian-targeting-log-gaps-2021": {
      "last_attempt": "2026-10-22T19:50:55+00:00",
      "last_success": "2026-10-22T19:50:55+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "74dd45a169d97fc25b625a3c2bfa5507ee43323f1f6b22b1d40e277f551e634b"
    },
    "mandiant-unc3886-esxi-logging-2023": {
      "last_attempt": "2026-10-22T19:50:55+00:00",
      "last_success": "2026-10-22T19:50:55+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "cc0abb4e2b66552b30ff9d9bcf2539d0a0ed3074cad1f95140747204ad5b30ff"
    },
    "ms-security-rss": {
      "last_attempt": "2026-10-22T20:09:08+00:00",
      "last_success": "2026-10-22T20:09:08+00:00",
      "state": "ok",
      "input_count": 10,
      "source_digest": "5624c0fcc3d9b4ee5553ad4033266880fc26ffbd2fc112df92a0acadde513782"
    }
  },
  "records": [
    {
      "source_id": "ms-storm-2949-cloud-breach-2026",
      "source_key": "ms-storm-2949-cloud-breach-2026",
      "title": "How Storm-2949 turned a compromised identity into a cloud-wide breach",
      "publisher": "Microsoft Defender Security Research Team",
      "source_url": "https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/",
      "originally_published": "2026-05-18T22:42:50+00:00",
      "most_recently_updated": "2026-05-18T22:42:53+00:00",
      "first_collected": "2026-10-22T19:50:55+00:00",
      "last_successfully_checked": "2026-10-22T19:50:55+00:00",
      "original_content_digest": "2c8730c0d46ea75d11efae8fc27e5c860f6919918ac51874ecb55e7eaf68369b",
      "source_publication_date": "2026-05-18",
      "date_precision": "timestamp",
      "affected_platform": "Microsoft Entra ID / Microsoft 365 / Azure / Windows",
      "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
      "review_decision": "include",
      "reason_codes": [
        "editor-approved",
        "The original investigation explicitly describes removal of local forensic artifacts and states that the actions complicate investigation. This is direct evidentiary impact rather than a generic intrusion or CVE item."
      ],
      "editorial_annotation": "Microsoft reports cleanup of local forensic artifacts in a cloud-to-endpoint intrusion. Preserve the distinction between endpoint history and cloud audit coverage, and trace credential context through the available identity records before naming a person.",
      "topic": "Cloud and endpoint traces",
      "evidence_quote_reference": {
        "short_quote": "clearing Windows event logs",
        "section": "Reviewed original report; locate the quoted phrase in context."
      },
      "editor_reviewed": "2026-10-22",
      "historical": true,
      "related_guide_urls": [
        "https://anti-forensics.com/reference/artifacts/windows-event-forwarding-gaps/",
        "https://anti-forensics.com/reference/artifacts/cloud-audit-scope-and-identity/",
        "https://anti-forensics.com/reference/field-guides/collection-provenance-record/"
      ],
      "record_version_digest": "6d987f7c97f72659e595f8b258e5580f0e35f019beaa8165afc0b590ac5f83f7"
    },
    {
      "source_id": "mandiant-unc3886-esxi-logging-2023",
      "source_key": "mandiant-unc3886-esxi-logging-2023",
      "title": "VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors",
      "publisher": "Mandiant / Google Cloud",
      "source_url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass",
      "originally_published": null,
      "most_recently_updated": null,
      "first_collected": "2026-10-22T19:50:55+00:00",
      "last_successfully_checked": "2026-10-22T19:50:55+00:00",
      "original_content_digest": "d6d62d6000fa93785bc8ec8434af2ffd2d9a3281c9e7a0e51d48d35361ed4a70",
      "source_publication_date": "2023-06-13",
      "date_precision": "day",
      "affected_platform": "VMware ESXi / vCenter / Windows, Linux and PhotonOS guests",
      "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
      "review_decision": "include",
      "reason_codes": [
        "editor-approved",
        "The original report explicitly connects observed logging interference to investigation difficulty and identifies guest-operation visibility limits. It is included for that stated forensic impact, not merely for the associated vulnerability."
      ],
      "editorial_annotation": "Mandiant explicitly describes investigative challenges from disabled or altered logging and guest operations without default guest logs. Treat hypervisor, guest, and central logging as separate coverage questions and preserve surviving sources with their collection limits.",
      "topic": "Virtualization visibility",
      "evidence_quote_reference": {
        "short_quote": "tamper with and disable logging services",
        "section": "Reviewed original report; locate the quoted phrase in context."
      },
      "editor_reviewed": "2026-10-22",
      "historical": true,
      "related_guide_urls": [
        "https://anti-forensics.com/reference/artifacts/windows-event-forwarding-gaps/",
        "https://anti-forensics.com/reference/artifacts/linux-systemd-journal-scope/",
        "https://anti-forensics.com/reference/techniques/recovery-and-absence-claims/"
      ],
      "record_version_digest": "6e12caf17b123dc636201775a8c53145ce5887bddfa6c64e86aadbf3ca7977fa"
    },
    {
      "source_id": "eset-industroyer2-caddywiper-2022",
      "source_key": "eset-industroyer2-caddywiper-2022",
      "title": "Industroyer2: Industroyer reloaded",
      "publisher": "ESET Research / WeLiveSecurity",
      "source_url": "https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/",
      "originally_published": null,
      "most_recently_updated": null,
      "first_collected": "2026-10-22T19:51:52+00:00",
      "last_successfully_checked": "2026-10-22T19:51:52+00:00",
      "original_content_digest": "5f1a6fb16fe6c018a29fe7325198af80379d6fcc65f50bfae94615a962e95d91",
      "source_publication_date": "2022-04-12",
      "date_precision": "day",
      "affected_platform": "Windows / Linux / Solaris / industrial control environments",
      "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
      "review_decision": "include",
      "reason_codes": [
        "editor-approved",
        "ESET’s original incident analysis explicitly connects scheduled destructive activity with erasing traces and discusses impaired recovery. This supplies a concrete evidentiary consequence beyond generic wiper coverage."
      ],
      "editorial_annotation": "ESET and CERT-UA investigated an energy-sector attack involving Industroyer2 and destructive malware. ESET distinguishes observed deployment from assessed purpose; examine surviving remote records and source collections without assuming every affected system or copy had the same outcome.",
      "topic": "Evidence availability",
      "evidence_quote_reference": {
        "short_quote": "erase Industroyer2 traces",
        "section": "Reviewed original report; locate the quoted phrase in context."
      },
      "editor_reviewed": "2026-10-22",
      "historical": true,
      "related_guide_urls": [
        "https://anti-forensics.com/reference/techniques/recovery-and-absence-claims/",
        "https://anti-forensics.com/reference/field-guides/corroborating-a-timeline/",
        "https://anti-forensics.com/reference/field-guides/collection-provenance-record/"
      ],
      "record_version_digest": "9a7ca0a4ce6072a57164fa1dacda9419f88bf3de48d489aab83e7a2336650f25"
    },
    {
      "source_id": "ms-destructive",
      "source_key": "ms-destructive",
      "title": "Destructive malware targeting Ukrainian organizations",
      "publisher": "Microsoft Security",
      "source_url": "https://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/",
      "originally_published": "2022-01-16T02:28:30+00:00",
      "most_recently_updated": "2026-08-19T15:57:04+00:00",
      "first_collected": "2026-10-22T18:57:47+00:00",
      "last_successfully_checked": "2026-10-22T18:57:47+00:00",
      "original_content_digest": "af2147d1dd874c7815cfc3cace3ec70d173521e4ea71409f355eb12095ae213b",
      "affected_platform": "Windows / enterprise networks",
      "date_note": "Historical primary incident report; not a new incident.",
      "review_decision": "include",
      "reason_codes": [
        "editor-approved",
        "historical-primary-report-evidence-destruction"
      ],
      "editorial_annotation": "Microsoft reports destructive effects on boot records and file content behind a ransom message. Evidence availability can be affected before collection; corroborate the reported behavior against preserved originals and independent records. This is a historical source, not a new incident alert.",
      "topic": "Evidence availability",
      "evidence_quote_reference": {
        "section": "Opening assessment and Observed actor activity",
        "short_quote": "designed to be destructive",
        "note": "Page displays January 15, 2022; publisher machine-readable publication time is January 16, 2022 in UTC. Updated time is publisher metadata, not a new incident date."
      },
      "editor_reviewed": "2026-10-22",
      "historical": true,
      "related_guide_urls": [],
      "record_version_digest": "01638b463ddd9e1c3c99674fa921ff682808e2786936b147d100103e1455fba4"
    },
    {
      "source_id": "mandiant-russian-targeting-log-gaps-2021",
      "source_key": "mandiant-russian-targeting-log-gaps-2021",
      "title": "Suspected Russian Activity Targeting Government and Business Entities Around the Globe",
      "publisher": "Mandiant / Google Cloud",
      "source_url": "https://cloud.google.com/blog/topics/threat-intelligence/russian-targeting-gov-business",
      "originally_published": null,
      "most_recently_updated": null,
      "first_collected": "2026-10-22T19:50:55+00:00",
      "last_successfully_checked": "2026-10-22T19:50:55+00:00",
      "original_content_digest": "3d90635f20a29b38c68b9be718b9de4f99f77a6647d0f7ce731ecf76e6bbec01",
      "source_publication_date": "2021-12-06",
      "date_precision": "day",
      "affected_platform": "Windows / Microsoft 365 / enterprise identity infrastructure",
      "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
      "review_decision": "include",
      "reason_codes": [
        "editor-approved",
        "The original report describes observed stopping of Sysmon and Splunk logging and clearing of Windows events. Those actions directly affect local and forwarded investigative visibility."
      ],
      "editorial_annotation": "Mandiant reports stopped Sysmon and Splunk logging alongside cleared Windows events. The combination illustrates why source generation, forwarding health, retained central copies, and cloud identity records must be reviewed as separate evidence paths.",
      "topic": "Log visibility",
      "evidence_quote_reference": {
        "short_quote": "cleared Windows Event Logs",
        "section": "Reviewed original report; locate the quoted phrase in context."
      },
      "editor_reviewed": "2026-10-22",
      "historical": true,
      "related_guide_urls": [
        "https://anti-forensics.com/reference/artifacts/windows-event-forwarding-gaps/",
        "https://anti-forensics.com/reference/artifacts/security-log-clear-records/",
        "https://anti-forensics.com/reference/artifacts/cloud-audit-scope-and-identity/"
      ],
      "record_version_digest": "81e840df9d6695190495bede0139061a9bfd0fdc90fef7495960a09390249741"
    },
    {
      "source_id": "ms-human-operated-ransomware-2020",
      "source_key": "ms-human-operated-ransomware-2020",
      "title": "Human-operated ransomware attacks: A preventable disaster",
      "publisher": "Microsoft Security",
      "source_url": "https://www.microsoft.com/en-us/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/",
      "originally_published": "2020-03-05T17:00:31+00:00",
      "most_recently_updated": "2025-06-27T06:58:35+00:00",
      "first_collected": "2026-10-22T19:50:55+00:00",
      "last_successfully_checked": "2026-10-22T19:50:55+00:00",
      "original_content_digest": "be17c43bdbcc4a60e1e45b9cc05804aba86543149f2af5e6b1941813d9dffad9",
      "source_publication_date": "2020-03-05",
      "date_precision": "timestamp",
      "affected_platform": "Windows / enterprise networks",
      "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
      "review_decision": "include",
      "reason_codes": [
        "editor-approved",
        "Original Microsoft report describes an observed clearing behavior, not only a general recommendation or hypothetical vulnerability. Relevant to loss of local event history and corroboration with surviving records."
      ],
      "editorial_annotation": "Microsoft describes event-log clearing within observed human-operated ransomware activity. The investigative implication is to compare native endpoint channels with retained central copies and collection status; a gap by itself does not attribute an actor.",
      "topic": "Log visibility",
      "evidence_quote_reference": {
        "short_quote": "the group clears event logs",
        "section": "Reviewed original report; locate the quoted phrase in context."
      },
      "editor_reviewed": "2026-10-22",
      "historical": true,
      "related_guide_urls": [
        "https://anti-forensics.com/reference/artifacts/security-log-clear-records/",
        "https://anti-forensics.com/reference/artifacts/windows-event-forwarding-gaps/",
        "https://anti-forensics.com/reference/field-guides/corroborating-a-timeline/"
      ],
      "record_version_digest": "dec30451c17fbcae60fded55d5e1f19eeb82e94a06417bb01fc3f8b261be470f"
    }
  ],
  "coverage": "Limited source monitoring with a historical starter selection. Not a complete threat or incident catalog.",
  "counts": {
    "exclude": 1765,
    "include": 6
  }
}