Attack Forensic Timeline & Incident Narrative
Pillar 9: Autonomous SynthesisMillisecond-precision event sequence reconstruction fusing Sysmon, Procmon, PCAP, and ETW into executive-ready LLM incident stories.
Manual Human Analyst Triage
4.2 Hoursavg manual reconstruction
CERBERUS Autonomous Reconstruction
1.8 Secondsfull event provenance
MTTR Velocity Acceleration
99.88%time savings
Analyst Time Recovered
+4.19 Hrsper incident
Timeline Position: T+5.800s / 5.800s
Showing 7 of 7 sequential events| Offset / Time | Attack Stage | Process / PID | Source | Event Summary |
|---|---|---|---|---|
T+0.000s 14:02:18.042 | 1. Initial Exploit & Drop | System (ntoskrnl.exe) PID: 4 | PPID: 0 | PCAP_ZEEK | Inbound SMBv1 EternalBlue Tree Connect on port 445 from 192.168.195.139 |
T+0.340s 14:02:18.382 | 2. Payload Execution & Killswitch Probe | WannaCry.exe PID: 3412 | PPID: 1420 | SYSMON_EID_1 | Detonation & HTTP GET probe to killswitch sinkhole domain |
T+1.120s 14:02:19.162 | 3. Unpacking & Secondary Stager Fork | tasksche.exe PID: 3820 | PPID: 3412 | PROCMON | Unpacks encrypted resource section and drops tasksche.exe to C:\Windows |
T+2.450s 14:02:20.492 | 4. Windows Service Creation | services.exe PID: 680 | PPID: 540 | SECURITY_LOG_4688 | Created persistent Windows Service 'mssecsvc2.0' |
T+3.180s 14:02:21.222 | 5. Shadow Copy Deletion Intercept | cmd.exe PID: 4104 | PPID: 3820 | SYSMON_EID_1 | cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet |
T+4.290s 14:02:22.332 | 6. Multi-Threaded AES File Encryption | tasksche.exe PID: 3820 | PPID: 3412 | ETW_KERNEL | Mass block encryption appending .WNCRY extension to user files |
T+5.800s 14:02:23.842 | 7. Ransom UI Rendering & Tor C2 | @WanaDecryptor@.exe PID: 4628 | PPID: 3820 | PROCMON | Rendered @WanaDecryptor@ GUI demanding 300 USD in Bitcoin |
Deep Forensic Telemetry
Click an event to inspect
Click any timestamped event row on the left to inspect raw command line arguments, MITRE techniques, and socket bindings.