[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$apiParty6fBuHLCPZ1LTYs42XHdVbjpSDOYYPYzyxeAGwSN5Tp8":3,"$apiPartyRs5RTqQ_PBO-qeJQZxIjKDloFc9DbooPRT_nlAOUR4Q":563,"$apiPartyRs5RTqQ_PBO-qeJQZxIjKDloFc9DbooPRT_nlAOUR4Q$H93EERW16b":563},{"product_data":4,"scene_data":21,"task_data":407,"modality_data":441,"domain_data":478},[5,9,12,15,18],{"name":6,"value":7,"add_value":8,"describe":8},"Rivo","1","",{"name":10,"value":11,"add_value":8,"describe":8},"Cubo","2",{"name":13,"value":14,"add_value":8,"describe":8},"Moye","3",{"name":16,"value":17,"add_value":8,"describe":8},"Juro","4",{"name":19,"value":20,"add_value":8,"describe":8},"Ordo","5",[22,73,135,197,232,267,302,337,372],{"name":23,"value":7,"add_value":24,"describe":25,"children":26},"Home & Indoor","sofa","AI enhances everyday home life. Our datasets cover real indoor scenes to support smart devices, robotics, and home intelligence.",[27,29,31,33,35,37,40,43,46,49,52,55,58,61,64,67,70],{"name":28,"value":7},"Living Room",{"name":30,"value":11},"Bedroom",{"name":32,"value":14},"Kitchen",{"name":34,"value":17},"Dining Area",{"name":36,"value":20},"Bathroom",{"name":38,"value":39},"Entrance \u002F Foyer","6",{"name":41,"value":42},"Corridor \u002F Hallway","7",{"name":44,"value":45},"Staircase","8",{"name":47,"value":48},"Home Office","9",{"name":50,"value":51},"Hobby \u002F Game Room","10",{"name":53,"value":54},"Worship Space","11",{"name":56,"value":57},"Garage","12",{"name":59,"value":60},"Utility \u002F Laundry Room","13",{"name":62,"value":63},"Pantry","14",{"name":65,"value":66},"Basement","15",{"name":68,"value":69},"Garden","16",{"name":71,"value":72},"Balcony","17",{"name":74,"value":11,"add_value":75,"describe":76,"children":77},"Office & Educational","workshop","AI is reshaping work and learning. Our datasets capture offices and classrooms to power automation and next-generation productivity tools.",[78,81,84,87,90,93,96,99,102,105,108,111,114,117,120,123,126,129,132],{"name":79,"value":80},"Open Office","18",{"name":82,"value":83},"Private Office","19",{"name":85,"value":86},"Co-working Space","20",{"name":88,"value":89},"Reception \u002F Lobby","21",{"name":91,"value":92},"Conference Room","22",{"name":94,"value":95},"Huddle Room \u002F Booth","23",{"name":97,"value":98},"Lecture Hall \u002F Auditorium","24",{"name":100,"value":101},"Classroom","25",{"name":103,"value":104},"Science Laboratory","26",{"name":106,"value":107},"Library","27",{"name":109,"value":110},"Design Studio","28",{"name":112,"value":113},"Pantry \u002F Breakroom","29",{"name":115,"value":116},"Cafeteria \u002F Canteen","30",{"name":118,"value":119},"Restroom (Commercial)","31",{"name":121,"value":122},"Gymnasium \u002F Sports Hall","32",{"name":124,"value":125},"Server Room","33",{"name":127,"value":128},"Mailroom \u002F Logistics","34",{"name":130,"value":131},"Janitorial Closet","35",{"name":133,"value":134},"Corridor \u002F Elevators","36",{"name":136,"value":14,"add_value":137,"describe":138,"children":139},"Healthcare & Medical","love-and-help","AI is advancing modern healthcare. Our datasets include clinics and hospitals to enable clinical insights and medical automation.",[140,143,146,149,152,155,158,161,164,167,170,173,176,179,182,185,188,191,194],{"name":141,"value":142},"Operating Theatre \u002F OR","37",{"name":144,"value":145},"Consultation Room","38",{"name":147,"value":148},"Treatment Room","39",{"name":150,"value":151},"Dental Clinic","40",{"name":153,"value":154},"Inpatient Ward","41",{"name":156,"value":157},"Nurse Station","42",{"name":159,"value":160},"ICU","43",{"name":162,"value":163},"NICU (Neonatal ICU)","44",{"name":165,"value":166},"Emergency Room (ER)","45",{"name":168,"value":169},"Hospital Corridor","46",{"name":171,"value":172},"Waiting Area","47",{"name":174,"value":175},"CT\u002FMRI","48",{"name":177,"value":178},"Medical Laboratory","49",{"name":180,"value":181},"Phlebotomy Room","50",{"name":183,"value":184},"Rehabilitation Gym","51",{"name":186,"value":187},"Assisted Living Room","52",{"name":189,"value":190},"Pharmacy","53",{"name":192,"value":193},"Sterile Processing Dept","54",{"name":195,"value":196},"Medical Storage","55",{"name":198,"value":17,"add_value":199,"describe":200,"children":201},"Business & Public Service","business","AI is elevating commercial and public services. Our datasets span retail, dining, and service centers to improve intelligent operations.",[202,205,208,211,214,217,220,223,226,229],{"name":203,"value":204},"Shopping Mall Atrium","86",{"name":206,"value":207},"Supermarket Shelf","87",{"name":209,"value":210},"Self-Checkout Counter","88",{"name":212,"value":213},"Restaurant Dining Hall","89",{"name":215,"value":216},"Commercial Kitchen","90",{"name":218,"value":219},"Hotel Lobby","91",{"name":221,"value":222},"Subway Platform","92",{"name":224,"value":225},"Security Checkpoint","93",{"name":227,"value":228},"Underground Parking","94",{"name":230,"value":231},"Bank Teller Zone","95",{"name":233,"value":20,"add_value":234,"describe":235,"children":236},"Industrial & Manufacturing","robot-arm","AI is modernizing industry. Our datasets capture factories and logistics spaces to support robotics and intelligent manufacturing.",[237,240,243,246,249,252,255,258,261,264],{"name":238,"value":239},"Final Assembly Line","96",{"name":241,"value":242},"Quality Control Station","97",{"name":244,"value":245},"Robotic Welding Cell","98",{"name":247,"value":248},"CNC Machining Center","99",{"name":250,"value":251},"Cleanroom","100",{"name":253,"value":254},"Automated Warehouse","101",{"name":256,"value":257},"Loading Dock","102",{"name":259,"value":260},"Sorting Center","103",{"name":262,"value":263},"Chemical Plant","104",{"name":265,"value":266},"Power Substation","105",{"name":268,"value":39,"add_value":269,"describe":270,"children":271},"Transportation & Driving","car","AI is revolutionizing mobility. Our datasets capture road networks, vehicle dynamics and traffic scenarios to support autonomous driving and intelligent transportation systems.",[272,275,278,281,284,287,290,293,296,299],{"name":273,"value":274},"Urban Intersection","56",{"name":276,"value":277},"Highway \u002F Expressway","57",{"name":279,"value":280},"Tunnel","58",{"name":282,"value":283},"Roundabout","59",{"name":285,"value":286},"School \u002F Hospital Zone","60",{"name":288,"value":289},"Toll Station","61",{"name":291,"value":292},"Construction Zone","62",{"name":294,"value":295},"Parking Garage","63",{"name":297,"value":298},"Driver Cabin","64",{"name":300,"value":301},"Adverse Weather","65",{"name":303,"value":42,"add_value":304,"describe":305,"children":306},"Outdoor & Construction","tent-tree","AI is optimizing outdoor operations. Our datasets capture construction sites, open-air work zones and outdoor infrastructure to support smart construction and autonomous outdoor machinery.",[307,310,313,316,319,322,325,328,331,334],{"name":308,"value":309},"Excavation Site","66",{"name":311,"value":312},"Scaffolding Area","67",{"name":314,"value":315},"Material Storage Yard","68",{"name":317,"value":318},"Site Entrance","69",{"name":320,"value":321},"Roadwork Zone","70",{"name":323,"value":324},"Bridge Infrastructure","71",{"name":326,"value":327},"Transmission Line","72",{"name":329,"value":330},"Open-pit Mine","73",{"name":332,"value":333},"Tunneling Site","74",{"name":335,"value":336},"Post-Disaster Rubble","75",{"name":338,"value":45,"add_value":339,"describe":340,"children":341},"Nature, Aerial & Aquatic","global-loop","AI is exploring the natural world. Our datasets capture terrestrial landscapes, aerial vistas and aquatic ecosystems to support environmental monitoring and autonomous exploration systems.",[342,345,348,351,354,357,360,363,366,369],{"name":343,"value":344},"Deep Forest","76",{"name":346,"value":347},"Farmland \u002F Crops","77",{"name":349,"value":350},"River \u002F Lake","78",{"name":352,"value":353},"Open Ocean","79",{"name":355,"value":356},"Underwater Coral Reef","80",{"name":358,"value":359},"Fish Farm","81",{"name":361,"value":362},"Mountain Terrain","82",{"name":364,"value":365},"Urban Low Altitude","83",{"name":367,"value":368},"Fire Scene","84",{"name":370,"value":371},"Desert \u002F Gobi","85",{"name":373,"value":48,"add_value":374,"describe":375,"children":376},"Virtul & Digital","siri","AI is reshaping the virtual realm. Our datasets capture digital twins, virtual environments and simulated spaces to support metaverse development and intelligent digital interaction.",[377,380,383,386,389,392,395,398,401,404],{"name":378,"value":379},"VR Social Space","106",{"name":381,"value":382},"Synthetic Driving Sim","107",{"name":384,"value":385},"Digital Twin City","108",{"name":387,"value":388},"FPS \u002F MOBA Game","109",{"name":390,"value":391},"Robotics Gym","110",{"name":393,"value":394},"AR Navigation","111",{"name":396,"value":397},"Virtual Showroom","112",{"name":399,"value":400},"Code \u002F IDE Interface","113",{"name":402,"value":403},"App GUI Screen","114",{"name":405,"value":406},"Synthetic Face\u002FID","115",[408,411,414,417,420,423,426,429,432,435,438],{"name":409,"value":7,"add_value":410,"describe":8},"Classification","rubric",{"name":412,"value":11,"add_value":413,"describe":8},"Detection","radar",{"name":415,"value":14,"add_value":416,"describe":8},"Segmentation","segmentation",{"name":418,"value":17,"add_value":419,"describe":8},"Tacking","crosshairs",{"name":421,"value":20,"add_value":422,"describe":8},"Estimation","streamline",{"name":424,"value":39,"add_value":425,"describe":8},"QA","qa",{"name":427,"value":42,"add_value":428,"describe":8},"Recognition","finger-scan",{"name":430,"value":45,"add_value":431,"describe":8},"Control","control",{"name":433,"value":48,"add_value":434,"describe":8},"Extraction","extraction",{"name":436,"value":51,"add_value":437,"describe":8},"Retrieval","retrieval",{"name":439,"value":54,"add_value":440,"describe":8},"Forecast","forecast",[442,445,448,451,454,457,460,463,466,469,472,475],{"name":443,"value":7,"add_value":444,"describe":8},"Audio","audio",{"name":446,"value":11,"add_value":447,"describe":8},"Image","image",{"name":449,"value":14,"add_value":450,"describe":8},"Text","text",{"name":452,"value":17,"add_value":453,"describe":8},"Video","video",{"name":455,"value":20,"add_value":456,"describe":8},"Multi","multi",{"name":458,"value":39,"add_value":459,"describe":8},"Document","document",{"name":461,"value":42,"add_value":462,"describe":8},"Time-Series","time-series",{"name":464,"value":45,"add_value":465,"describe":8},"3D cloud","cloud",{"name":467,"value":48,"add_value":468,"describe":8},"Code","code",{"name":470,"value":51,"add_value":471,"describe":8},"Event","event",{"name":473,"value":54,"add_value":474,"describe":8},"Motion","motion",{"name":476,"value":57,"add_value":477,"describe":8},"Interaction","interaction",[479,482,487,491,494,499,504,509,514,519,524,528,532,536,540,544,548,552,556,559],{"id":480,"value":480,"name":233,"intro":481,"add_value":234,"describe":481},2,"智能质检：利用图像识别、多模态模型对产品外观或声音、振动等数据进行分析，自动识别缺陷，提高质量控制效率。\n工业知识问答与文档理解：通过大模型理解和总结技术文档、操作手册，实现快速问答、知识检索和培训支持。\n安全监测与风险预警：实时分析视频、传感器和操作日志，识别潜在危险行为或异常状态，提前预警，保障人员和设备安全。",{"id":483,"value":483,"name":484,"intro":485,"add_value":486,"describe":485},3,"Finance & Insurance","风险评估与预测：分析大量客户数据，评估信用风险、市场风险等，预测违约概率、股价走势等，辅助金融机构决策。\n智能投顾：根据客户风险偏好、资产状况等，提供个性化投资组合建议，实时调整投资策略。\n反欺诈检测：通过分析交易数据、用户行为，识别异常交易和欺诈行为，保障金融安全。","funds",{"id":488,"value":488,"name":489,"intro":490,"add_value":269,"describe":490},1,"Transport & Automotive","智能座舱：打造多模态交互的 AI 座舱，通过语音、手势、面部识别等实现人机交互，如语音控制导航、音乐播放。\n驾驶员状态监测：识别疲劳、分心、抽烟、打电话等行为，通过大模型判断危险等级，触发相应提醒或干预机制。\n智能驾驶：AI 用于环境感知、路径规划与决策控制，使车辆能识别道路、行人、障碍物等，实现自适应巡航、自动泊车、车道保持等功能，提升驾驶安全性与便利性。",{"id":492,"value":492,"name":136,"intro":493,"add_value":137,"describe":493},4,"医学影像诊断：分析 CT、MRI 等影像，辅助医生检测疾病、识别病灶，如 AI 系统可快速发现肺部结节。\n医患对话助手：通过自然语言处理理解患者问题，提供初步健康建议或就诊指导，缓解医生接诊压力。\n智能健康管理：根据用户健康数据，提供个性化健康建议、疾病预警，如智能手环结合 AI 分析用户运动、睡眠、心率等数据。",{"id":495,"value":495,"name":496,"intro":497,"add_value":498,"describe":497},6,"Smart Devices","多模态交互：支持语音、手势、眼神等多种交互方式，如 AI 眼镜可通过语音指令实现翻译、搜索功能。\n智能感知与处理：使设备能感知环境、理解用户需求，如智能音箱根据环境噪音自动调节音量。\n个性化服务：根据用户使用习惯和偏好，提供个性化功能与服务，如智能手表为用户定制运动健身计划。","microscope",{"id":500,"value":500,"name":501,"intro":502,"add_value":503,"describe":502},8,"Law & Government","智能法律问答：面向公众或企业用户，提供合规、劳动法、婚姻继承、知识产权等常见法律问题的智能解答。\n合同审查与风险识别：利用大模型分析合同内容，识别潜在风险条款、漏洞或不合理约定，提升合同审核质量。\n法律知识图谱构建：自动梳理法规、案例、条文之间的引用关系，构建语义化知识图谱，支持智能分析和推理。","hammer",{"id":505,"value":505,"name":506,"intro":507,"add_value":508,"describe":507},7,"Education & Training","个性化学习：根据学生学习进度、能力和知识掌握情况，推送个性化学习内容与练习，如智能辅导系统为学生制定专属学习计划。\n智能教学辅助：AI 助教协助教师进行作业批改、答疑解惑，还可分析教学数据，为教师提供教学反馈，优化教学方法。\n虚拟学习环境：利用 AI 创建虚拟实验、历史场景等，让学生沉浸式学习，如在虚拟化学实验室中进行实验操作。","degree-hat",{"id":510,"value":510,"name":511,"intro":512,"add_value":513,"describe":512},5,"Agriculture & Food","作物病虫害识别与防治：通过图像识别分析农作物叶片、果实等症状，识别病虫害类型，给出防治建议，减少产量损失。\n农产品质量检测：利用图像和传感器数据，识别果蔬等农产品的成熟度、外观缺陷，进行自动分级，提高市场竞争力。\n农情监测与预测：利用卫星遥感、气象和传感器数据，结合大模型预测作物长势、干旱、洪涝等农情变化。","ph-farm",{"id":515,"value":515,"name":516,"intro":517,"add_value":518,"describe":517},9,"Retail & E-commerce","智能客服：通过自然语言对话理解用户需求，提供产品推荐、订单查询、退换货支持等服务，提升客户满意度。\n个性化营销推荐：基于用户浏览、购买、偏好等行为数据，生成个性化推荐内容与优惠策略，提高转化率和客单价。\n商品内容生成：自动撰写商品标题、卖点描述、使用说明等内容，适用于海量SKU的内容生产与多语言发布。","buy",{"id":520,"value":520,"name":521,"intro":522,"add_value":523,"describe":8},10,"Security & Protection",null,"safe-shield-line",{"id":525,"value":525,"name":526,"intro":522,"add_value":527,"describe":8},11,"Environment & Climate","weather",{"id":529,"value":529,"name":530,"intro":522,"add_value":531,"describe":8},12,"Energy & Resource","energy-leaf",{"id":533,"value":533,"name":534,"intro":522,"add_value":535,"describe":8},13,"Express & Logistics","speed-outline",{"id":537,"value":537,"name":538,"intro":522,"add_value":539,"describe":8},15,"Sports","baseball-outline",{"id":541,"value":541,"name":542,"intro":522,"add_value":543,"describe":8},16,"General Data","daily-booth",{"id":545,"value":545,"name":546,"intro":522,"add_value":547,"describe":8},17,"Content & Media","media",{"id":549,"value":549,"name":550,"intro":522,"add_value":551,"describe":8},18,"Construction","construction",{"id":553,"value":553,"name":554,"intro":522,"add_value":555,"describe":8},19,"IT & Telecom","tech",{"id":557,"value":557,"name":558,"intro":522,"add_value":498,"describe":8},20,"Science & Research",{"id":560,"value":560,"name":561,"intro":522,"add_value":562,"describe":8},21,"Language & Culture","lang",{"id":564,"unique_code":565,"title":566,"icon":8,"intro":567,"cate":483,"detail":568,"create_time":569,"update_time":570,"price":571,"view_count":483,"download_count":572,"unit":572,"amount":573,"is_create_order":572,"enterprise_id":488,"seo_keywords":574,"seo_description":575,"data_format":576,"file_size":577,"apply_scene":578,"training_task":579,"version":580,"dataset_type_id":492,"dataset_scene_id":520,"sample_file":581,"banner":8,"unit_name":8,"cate_name":449,"icon_url":8,"banner_url":8,"sample_file_url":8,"data_dict":582,"qa_list":603,"sample_metadatas":620,"text_sample_content":648,"enterprise_name":649,"enterprise_logo":650,"data_distribution":651},1321,"d8b705518ceec9429af306fcb995bbe8","Rootkit Forensic Evidence Synthesis Question Answering Dataset","Train models to interpret and reconstruct suspected rootkit activity with multi-source forensic evidence and careful expert reasoning.","\u003Cp>This dataset pairs investigation questions with detailed expert analyses based on textual findings from memory, file systems, system logs, and runtime state. It focuses on reconstructing suspected rootkit activity from multiple evidence sources, distinguishing direct observations from analytical inferences, and addressing conflicting evidence, uncertainty, and examination limits. It supports domain-specific supervised fine-tuning, forensic analysis training, and generative question answering evaluation.\u003C\u002Fp>","2026-10-17 17:59:32","2026-10-19 18:24:57","0.00",0,5000,"rootkit forensics dataset,rootkit analysis QA,memory forensics,file system forensics,system log analysis,multi-source evidence reasoning,malware investigation data,cybersecurity SFT","Long-form QA for rootkit analysis, combining memory, file system, log, and runtime evidence for forensic reasoning and domain-specific fine-tuning.","JSON","0.3GB","rootkit threat investigation, digital forensic analysis, cybersecurity incident response","forensic evidence synthesis, rootkit activity reconstruction, evidence-based question answering","V1.0","rivo\u002Fsample-packages\u002F9ffb6c06-0869-4329-b358-a21ad3d06764\u002F20261017.zip",[583,588,593,598],{"id":572,"name":584,"field":585,"intro":586,"type":587},"File Name","file_name","File name","string",{"id":589,"name":590,"field":591,"intro":592,"type":587},9753,"Expert Analysis Answer","expert_answer","An analysis that reconstructs suspected rootkit activity across evidence sources; distinguishes direct observations from inferences; explains supporting reasoning, conflicting evidence, uncertainty, and evidentiary limits; and presents a cautious investigative conclusion.",{"id":594,"name":595,"field":596,"intro":597,"type":587},9754,"Forensic Evidence Report","evidence_report","Textual findings from memory, file system, system log, and runtime state examinations. May include source identifiers, timestamps, and examination limitations.",{"id":599,"name":600,"field":601,"intro":602,"type":587},9755,"Investigation Question","investigation_question","A question about suspected rootkit activity, formulated from the forensic evidence.",[604,608,612,616],{"id":605,"question":606,"answer":607},6737,"What does the dataset contain?","Each record is organized around textual forensic evidence, an investigation question, and an expert analysis answer. Evidence may cover memory, file systems, system logs, and runtime state, and may include source identifiers, timestamps, and examination limits.",{"id":609,"question":610,"answer":611},6738,"Which capabilities can it support?","It is designed for rootkit-focused supervised fine-tuning. Training can target multi-source evidence synthesis, reconstruction of suspected activity, separation of observed facts from inferences, and clear discussion of reasoning, uncertainty, and evidentiary limits. It can also support generative QA evaluation.",{"id":613,"question":614,"answer":615},6739,"What are the dataset size and quality specifications?","The dataset centers on long-form question-answering records with structured evidence report, investigation question, and expert answer fields. The available information does not specify sample count, language coverage, or file format, so consult the product page or package documentation before acquisition.",{"id":617,"question":618,"answer":619},6740,"How can I access the data, and what are the licensing terms?","Check the dataset product page for available access options, file formats, and licensing terms. Use, redistribution, and commercial use should follow the license provided with the relevant data package.",[621,632,640],{"id":622,"relate_table":623,"relate_id":624,"file_size":572,"file_name":625,"path":8,"duration":572,"cate":483,"file_format":626,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":627,"cate_name":628,"expert_answer":629,"evidence_report":630,"investigation_question":631},15362,"union_cubo",495161942,"样例_3.json","json","{\"expert_answer\": \"**Direct observations:** The journal and audit record place the start of thermald-helper.service and an init_module call by PID 661 at approximately 02:56. At acquisition, kguard appeared in both standard module views, and its file was present on disk. The memory inspection found the getdents64 syscall-table entry pointing into kguard's executable range. The live listing omitted .task-cache, whereas an offline parse of a read-only snapshot acquired three minutes later found an allocated directory entry with that name. The reported mount table showed no separate mount or overlay over \u002Fvar\u002Ftmp. Neither file was recorded as owned by an installed package.\\n\\n**Assessment:** These observations form a plausible sequence in which the helper started, loaded kguard, and the resident module was positioned to affect directory enumeration. The pointer into kguard's range, together with the live-versus-offline directory discrepancy, is consistent with a mechanism that filters directory results and conceals .task-cache. This is a significant rootkit hypothesis, but the evidence does not show the module's code or prove that this pointer was invoked or caused the differing views.\\n\\n**Uncertainty and conclusion:** The two directory observations were not simultaneous, so a filesystem change between them cannot be excluded. The absence of package ownership raises provenance concerns but does not establish maliciousness. No trusted baseline, module source, or execution trace is available to confirm the module's behavior or establish who installed the files. The evidence supports prioritizing kguard and .task-cache for code-level and timeline examination; it does not, on its own, prove that a rootkit concealed the entry.\", \"evidence_report\": \"Linux host build-22 was examined on 2025-04-18. The system journal records thermald-helper.service starting at 02:56 UTC. An audit record at the same time attributes an init_module call to PID 661, running \u002Fusr\u002Flocal\u002Flibexec\u002Fthermald-helper. At acquisition, \u002Fproc\u002Fmodules and \u002Fsys\u002Fmodule both listed kguard. The root filesystem contained \u002Fusr\u002Flib\u002Fmodules\u002F6.1.0\u002Flocal\u002Fkguard.ko and \u002Fetc\u002Fsystemd\u002Fsystem\u002Fthermald-helper.service; the package database recorded no owner for either file. A memory inspection found the getdents64 entry in sys_call_table pointing into the executable memory range assigned to kguard. During live collection, a directory listing of \u002Fvar\u002Ftmp did not show the name .task-cache. A read-only snapshot of the same ext4 root volume, parsed offline, contained an allocated directory entry named .task-cache in \u002Fvar\u002Ftmp. The mount table showed no separate mount or overlay covering \u002Fvar\u002Ftmp. The snapshot was acquired three minutes after the live listing. No trusted baseline, module source, or trace of calls through the modified entry was available.\", \"investigation_question\": \"How do the service, module, syscall-table pointer, and differing \u002Fvar\u002Ftmp views inform the hypothesis that a rootkit concealed a filesystem entry?\"}","文本","**Direct observations:** The journal and audit record place the start of thermald-helper.service and an init_module call by PID 661 at approximately 02:56. At acquisition, kguard appeared in both standard module views, and its file was present on disk. The memory inspection found the getdents64 syscall-table entry pointing into kguard's executable range. The live listing omitted .task-cache, whereas an offline parse of a read-only snapshot acquired three minutes later found an allocated directory entry with that name. The reported mount table showed no separate mount or overlay over \u002Fvar\u002Ftmp. Neither file was recorded as owned by an installed package.\n\n**Assessment:** These observations form a plausible sequence in which the helper started, loaded kguard, and the resident module was positioned to affect directory enumeration. The pointer into kguard's range, together with the live-versus-offline directory discrepancy, is consistent with a mechanism that filters directory results and conceals .task-cache. This is a significant rootkit hypothesis, but the evidence does not show the module's code or prove that this pointer was invoked or caused the differing views.\n\n**Uncertainty and conclusion:** The two directory observations were not simultaneous, so a filesystem change between them cannot be excluded. The absence of package ownership raises provenance concerns but does not establish maliciousness. No trusted baseline, module source, or execution trace is available to confirm the module's behavior or establish who installed the files. The evidence supports prioritizing kguard and .task-cache for code-level and timeline examination; it does not, on its own, prove that a rootkit concealed the entry.","Linux host build-22 was examined on 2025-04-18. The system journal records thermald-helper.service starting at 02:56 UTC. An audit record at the same time attributes an init_module call to PID 661, running \u002Fusr\u002Flocal\u002Flibexec\u002Fthermald-helper. At acquisition, \u002Fproc\u002Fmodules and \u002Fsys\u002Fmodule both listed kguard. The root filesystem contained \u002Fusr\u002Flib\u002Fmodules\u002F6.1.0\u002Flocal\u002Fkguard.ko and \u002Fetc\u002Fsystemd\u002Fsystem\u002Fthermald-helper.service; the package database recorded no owner for either file. A memory inspection found the getdents64 entry in sys_call_table pointing into the executable memory range assigned to kguard. During live collection, a directory listing of \u002Fvar\u002Ftmp did not show the name .task-cache. A read-only snapshot of the same ext4 root volume, parsed offline, contained an allocated directory entry named .task-cache in \u002Fvar\u002Ftmp. The mount table showed no separate mount or overlay covering \u002Fvar\u002Ftmp. The snapshot was acquired three minutes after the live listing. No trusted baseline, module source, or trace of calls through the modified entry was available.","How do the service, module, syscall-table pointer, and differing \u002Fvar\u002Ftmp views inform the hypothesis that a rootkit concealed a filesystem entry?",{"id":633,"relate_table":623,"relate_id":634,"file_size":572,"file_name":635,"path":8,"duration":572,"cate":483,"file_format":626,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":636,"cate_name":628,"expert_answer":637,"evidence_report":638,"investigation_question":639},15361,1098787454,"样例_2.json","{\"expert_answer\": \"**Direct observations:** At 18:05, PID 4180 was absent from the ordinary active-process enumeration but was represented by an EPROCESS object with mapped executable pages and two thread objects in a separate pool scan. The object was not linked into the active-process list. The memory image also contained a wdfmon driver object with a dispatch pointer into an executable nonpaged region outside the mapped driver image and the other enumerated driver ranges. Event records show that the wdfmon service was created at 17:47 and started at 17:48; the corresponding driver file was present on disk.\\n\\n**Assessment:** The disagreement between the active-process list and the independently found, populated process object is strong evidence that PID 4180 was not represented through the normal process enumeration path at capture time. Deliberate unlinking is a plausible explanation, but the evidence does not establish when or how the list relationship changed. The dispatch-pointer destination is an additional kernel-integrity anomaly: it could reflect redirection or another runtime modification, but the pointer alone does not reveal the code's behavior.\\n\\n**Relationship and uncertainty:** The service start precedes the memory capture and establishes that wdfmon was started, but it does not demonstrate that wdfmon concealed PID 4180. The evidence provides no direct call trace, code analysis, or other link between the driver and the process-list discrepancy. The absent process-creation audit record is not evidence that the process was never created, because logging coverage and retention are unknown. The findings warrant treating PID 4180 and wdfmon as related investigative leads and examining their code and acquisition provenance; they do not yet prove that wdfmon is the concealment mechanism or that either artifact is malicious.\", \"evidence_report\": \"A memory image of Windows host win-rd-04 was acquired at 18:05 UTC on 2025-03-06. The normal active-process enumeration did not list PID 4180. A separate pool scan located an EPROCESS object for PID 4180 with image name svcdiag.exe, mapped executable pages, and two associated thread objects. The process object was not reachable through the active-process list at acquisition. The image also contained a driver object named wdfmon whose image path resolved to C:\\\\ProgramData\\\\Cache\\\\wdfmon.sys. One recorded dispatch pointer for that driver resolved to an executable nonpaged region outside the mapped wdfmon.sys image and outside the ranges of the other enumerated loaded drivers. The file was present at the reported path. System event records show that the Service Control Manager created the wdfmon driver service at 17:47 and recorded a start at 17:48. No process-creation audit event for PID 4180 was present in the collected logs; the audit policy and log completeness for that interval were not established. No code analysis or trusted file baseline was available.\", \"investigation_question\": \"Does the evidence support deliberate process concealment, and can the wdfmon driver be identified as the component responsible?\"}","**Direct observations:** At 18:05, PID 4180 was absent from the ordinary active-process enumeration but was represented by an EPROCESS object with mapped executable pages and two thread objects in a separate pool scan. The object was not linked into the active-process list. The memory image also contained a wdfmon driver object with a dispatch pointer into an executable nonpaged region outside the mapped driver image and the other enumerated driver ranges. Event records show that the wdfmon service was created at 17:47 and started at 17:48; the corresponding driver file was present on disk.\n\n**Assessment:** The disagreement between the active-process list and the independently found, populated process object is strong evidence that PID 4180 was not represented through the normal process enumeration path at capture time. Deliberate unlinking is a plausible explanation, but the evidence does not establish when or how the list relationship changed. The dispatch-pointer destination is an additional kernel-integrity anomaly: it could reflect redirection or another runtime modification, but the pointer alone does not reveal the code's behavior.\n\n**Relationship and uncertainty:** The service start precedes the memory capture and establishes that wdfmon was started, but it does not demonstrate that wdfmon concealed PID 4180. The evidence provides no direct call trace, code analysis, or other link between the driver and the process-list discrepancy. The absent process-creation audit record is not evidence that the process was never created, because logging coverage and retention are unknown. The findings warrant treating PID 4180 and wdfmon as related investigative leads and examining their code and acquisition provenance; they do not yet prove that wdfmon is the concealment mechanism or that either artifact is malicious.","A memory image of Windows host win-rd-04 was acquired at 18:05 UTC on 2025-03-06. The normal active-process enumeration did not list PID 4180. A separate pool scan located an EPROCESS object for PID 4180 with image name svcdiag.exe, mapped executable pages, and two associated thread objects. The process object was not reachable through the active-process list at acquisition. The image also contained a driver object named wdfmon whose image path resolved to C:\\ProgramData\\Cache\\wdfmon.sys. One recorded dispatch pointer for that driver resolved to an executable nonpaged region outside the mapped wdfmon.sys image and outside the ranges of the other enumerated loaded drivers. The file was present at the reported path. System event records show that the Service Control Manager created the wdfmon driver service at 17:47 and recorded a start at 17:48. No process-creation audit event for PID 4180 was present in the collected logs; the audit policy and log completeness for that interval were not established. No code analysis or trusted file baseline was available.","Does the evidence support deliberate process concealment, and can the wdfmon driver be identified as the component responsible?",{"id":641,"relate_table":623,"relate_id":642,"file_size":572,"file_name":643,"path":8,"duration":572,"cate":483,"file_format":626,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":644,"cate_name":628,"expert_answer":645,"evidence_report":646,"investigation_question":647},15360,2089067110,"样例_1.json","{\"expert_answer\": \"**Direct observations:** The audit record attributes a module-loading system call at 09:12 to PID 732 running net-rotate. At 09:35, the standard live module views did not show veilnet. The later memory image contained a veilnet module object and executable region, but the object was not linked into the module list. The file veilnet.ko was present on disk, although its contents could not be checked against a trusted baseline. Separately, connection tracking reported a TCP tuple that was absent from both ss output and \u002Fproc\u002Fnet\u002Ftcp.\\n\\n**Assessment:** The most coherent reconstruction is that a module was loaded around 09:12 and remained resident at 09:42 while being omitted from the ordinary module-list views. The discrepancy between the memory scan and the linked module list is consistent with deliberate unlinking or another form of kernel-state inconsistency, and therefore raises a substantial concealment concern. It does not, by itself, establish the module's purpose or prove that it is malicious. The connection-tracking versus socket-table discrepancy is compatible with a hidden or terminated connection, but a tracking entry alone does not establish that a live socket existed at collection time.\\n\\n**Limits and conclusion:** The available evidence does not establish what net-rotate did, who controlled PID 732, whether the on-disk file matches the in-memory code, or whether the network tuple was active. No trusted software baseline or independent network capture is provided. The evidence supports treating veilnet as a high-priority suspected concealed kernel module and the tuple as an unresolved network lead, not as proof of a rootkit-controlled session.\", \"evidence_report\": \"Host edge-17 was examined on 2025-02-11. A live status collection at 09:35 UTC showed no veilnet entry in either \u002Fproc\u002Fmodules or \u002Fsys\u002Fmodule. A memory image acquired at 09:42 contained a veilnet module object and executable region found by an allocated-memory scan, but the object was not reachable from the kernel's module list. The file \u002Flib\u002Fmodules\u002F6.1.0\u002Flocal\u002Fveilnet.ko was present; its modification time was 08:57 UTC, and no trusted baseline for its contents was available. An audit record at 09:12 UTC attributed an init_module call to PID 732, whose executable path was \u002Fusr\u002Flocal\u002Fsbin\u002Fnet-rotate; that process was no longer present at acquisition. At 09:35, the connection-tracking table contained an ESTABLISHED TCP tuple from 10.24.6.18:53122 to 192.0.2.44:8443, while ss and \u002Fproc\u002Fnet\u002Ftcp showed no matching socket. The connection-tracking entry's age and whether it represented a live socket could not be established from the collected output.\", \"investigation_question\": \"What sequence of activity is best supported by the evidence, and how strongly does it support a concealed rootkit or hidden network connection?\"}","**Direct observations:** The audit record attributes a module-loading system call at 09:12 to PID 732 running net-rotate. At 09:35, the standard live module views did not show veilnet. The later memory image contained a veilnet module object and executable region, but the object was not linked into the module list. The file veilnet.ko was present on disk, although its contents could not be checked against a trusted baseline. Separately, connection tracking reported a TCP tuple that was absent from both ss output and \u002Fproc\u002Fnet\u002Ftcp.\n\n**Assessment:** The most coherent reconstruction is that a module was loaded around 09:12 and remained resident at 09:42 while being omitted from the ordinary module-list views. The discrepancy between the memory scan and the linked module list is consistent with deliberate unlinking or another form of kernel-state inconsistency, and therefore raises a substantial concealment concern. It does not, by itself, establish the module's purpose or prove that it is malicious. The connection-tracking versus socket-table discrepancy is compatible with a hidden or terminated connection, but a tracking entry alone does not establish that a live socket existed at collection time.\n\n**Limits and conclusion:** The available evidence does not establish what net-rotate did, who controlled PID 732, whether the on-disk file matches the in-memory code, or whether the network tuple was active. No trusted software baseline or independent network capture is provided. The evidence supports treating veilnet as a high-priority suspected concealed kernel module and the tuple as an unresolved network lead, not as proof of a rootkit-controlled session.","Host edge-17 was examined on 2025-02-11. A live status collection at 09:35 UTC showed no veilnet entry in either \u002Fproc\u002Fmodules or \u002Fsys\u002Fmodule. A memory image acquired at 09:42 contained a veilnet module object and executable region found by an allocated-memory scan, but the object was not reachable from the kernel's module list. The file \u002Flib\u002Fmodules\u002F6.1.0\u002Flocal\u002Fveilnet.ko was present; its modification time was 08:57 UTC, and no trusted baseline for its contents was available. An audit record at 09:12 UTC attributed an init_module call to PID 732, whose executable path was \u002Fusr\u002Flocal\u002Fsbin\u002Fnet-rotate; that process was no longer present at acquisition. At 09:35, the connection-tracking table contained an ESTABLISHED TCP tuple from 10.24.6.18:53122 to 192.0.2.44:8443, while ss and \u002Fproc\u002Fnet\u002Ftcp showed no matching socket. The connection-tracking entry's age and whether it represented a live socket could not be established from the collected output.","What sequence of activity is best supported by the evidence, and how strongly does it support a concealed rootkit or hidden network connection?","{\"expert_answer\":\"**Direct observations:** The journal and audit record place the start of thermald-helper.service and an init_module call by PID 661 at approximately 02:56. At acquisition, kguard appeared in both standard module views, and its file was present on disk. The memory inspection found the getdents64 syscall-table entry pointing into kguard's executable range. The live listing omitted .task-cache, whereas an offline parse of a read-only snapshot acquired three minutes later found an allocated directory entry with that name. The reported mount table showed no separate mount or overlay over \\\u002Fvar\\\u002Ftmp. Neither file was recorded as owned by an installed package.\\n\\n**Assessment:** These observations form a plausible sequence in which the helper started, loaded kguard, and the resident module was positioned to affect directory enumeration. The pointer into kguard's range, together with the live-versus-offline directory discrepancy, is consistent with a mechanism that filters directory results and conceals .task-cache. This is a significant rootkit hypothesis, but the evidence does not show the module's code or prove that this pointer was invoked or caused the differing views.\\n\\n**Uncertainty and conclusion:** The two directory observations were not simultaneous, so a filesystem change between them cannot be excluded. The absence of package ownership raises provenance concerns but does not establish maliciousness. No trusted baseline, module source, or execution trace is available to confirm the module's behavior or establish who installed the files. The evidence supports prioritizing kguard and .task-cache for code-level and timeline examination; it does not, on its own, prove that a rootkit concealed the entry.\",\"evidence_report\":\"Linux host build-22 was examined on 2025-04-18. The system journal records thermald-helper.service starting at 02:56 UTC. An audit record at the same time attributes an init_module call to PID 661, running \\\u002Fusr\\\u002Flocal\\\u002Flibexec\\\u002Fthermald-helper. At acquisition, \\\u002Fproc\\\u002Fmodules and \\\u002Fsys\\\u002Fmodule both listed kguard. The root filesystem contained \\\u002Fusr\\\u002Flib\\\u002Fmodules\\\u002F6.1.0\\\u002Flocal\\\u002Fkguard.ko and \\\u002Fetc\\\u002Fsystemd\\\u002Fsystem\\\u002Fthermald-helper.service; the package database recorded no owner for either file. A memory inspection found the getdents64 entry in sys_call_table pointing into the executable memory range assigned to kguard. During live collection, a directory listing of \\\u002Fvar\\\u002Ftmp did not show the name .task-cache. A read-only snapshot of the same ext4 root volume, parsed offline, contained an allocated directory entry named .task-cache in \\\u002Fvar\\\u002Ftmp. The mount table showed no separate mount or overlay covering \\\u002Fvar\\\u002Ftmp. The snapshot was acquired three minutes after the live listing. No trusted baseline, module source, or trace of calls through the modified entry was available.\",\"investigation_question\":\"How do the service, module, syscall-table pointer, and differing \\\u002Fvar\\\u002Ftmp views inform the hypothesis that a rootkit concealed a filesystem entry?\"}","MOBIUSI INC","https:\u002F\u002Fstatic.mobiusi.com\u002Fmobiwusi\u002F20250829\u002F7bf4ac62b4533e2b809998a6f1c5491e.png?Expires=1792463130&OSSAccessKeyId=LTAI5tH8MQqhgeiAtrzCHrxM&Signature=v6Tr8jBrdm4s5wU1SnnyGsYg%2Bhw%3D&x-oss-process=image%2Fresize%2Cm_fill%2Cw_35%2Ch_35",[652,658],{"type":653,"title":654,"count_data":655},"bar","Length distribution",[656],{"name":657,"value":483},"1k lower",{"type":659,"title":660,"count_data":661},"pie","Language distribution",[662],{"name":663,"value":483},"English"]