Malware Behavior Knowledge Graph

PILLAR 3: GRAPH ONTOLOGY

Ontology mapping: Sample → Process → PowerShell → Dropped Payload → Domain → C2 Infrastructure → ATT&CK Technique.

GNN & LLM Graph Reasoning EngineNatural Language Graph Traversal & Attribution

Quick Queries:

Filter Entity:

Sample:

WannaCry.exe

tasksche.exe

cmd.exe (vssadmin)

iuqerfsodp9...com

T1486: Data Encrypted

@WanaDecryptor@.exe

SillyPutty.exe

powershell.exe -w hidden

SikoMode.exe

update.kbfirewall.com

C2: 192.168.195.139

T1059.001: PowerShell

T1041: Exfil Over C2

CobaltStrike_Beacon.bin

svchost.exe (Hollowed)

T1003.001: LSASS Dump

Type: MALWARE_SAMPLE

CRITICAL

WannaCry Ransomware Binary

Initial weaponized ransomware worm exploiting MS17-010 EternalBlue vulnerability on SMB port 445.

Path / Network Endpoint:

C:\Users\Victim\Desktop\WannaCry.exe