Example: snapshot

Inputs
Profile
Report outputs
- Triage report (converted from triage_report.json)
- CSV outputs

Inputs

examples/inputs/snapshot-samples/system_state.txt

Profile

# System Snapshot Example
# Note: This demonstrates the --system-snapshot feature
# The actual snapshot captures live system state (processes, network, etc.)

decode = []

tag = "snapshot"

# Process patterns
[[patterns]]
  name = "Suspicious Process Name"
  pattern = "mimikatz|procdump|lazagne|rubeus"
  type = "regex"
  case-insensitive = true

[[patterns]]
  name = "PowerShell Hidden"
  pattern = "powershell.*-w.*hidden"
  type = "regex"
  case-insensitive = true

[[patterns]]
  name = "Encoded PowerShell"
  pattern = "powershell.*-enc"
  type = "regex"
  case-insensitive = true

# Network patterns
[[patterns]]
  name = "Suspicious Port"
  pattern = ":4444|:5555|:1337|:31337"
  type = "regex"

[[patterns]]
  name = "Outbound Connection"
  pattern = "ESTABLISHED.*[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+"
  type = "regex"

# Module/DLL patterns
[[patterns]]
  name = "Suspicious DLL"
  pattern = "amsi\\.dll|clrjit\\.dll"
  type = "regex"
  case-insensitive = true

[[patterns]]
  name = "Reflective Loading"
  pattern = "clr\\.dll.*loaded"
  type = "regex"
  case-insensitive = true

Report outputs

Triage report (converted from triage_report.json)

total_files	1
critical_count	0
high_count	0
medium_count	0
low_count	0
minimal_count	1
must_investigate_count	0
all_scores	None
generated_at	2025-12-03T09:19:44.817739057+00:00

top_scores

characteristics_score	file_type	file_type_score	must_investigate	path	pattern_count_score	pattern_matches	pattern_severity_score	reasons	risk_level	score	sha256
0	Other	0	False	/system_state.txt	15	14	13	["14 suspicious patterns detected"]	Minimal	28	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71

CSV outputs

errors.csv

Empty CSV

files.csv

path	file_name	sha256	file_created	file_modified	file_accessed	mime_types_from_file_extension	is_symbolic_link	is_extracted_file	is_decoded_file	is_deobfuscated_file	tag
/system_state.txt	system_state.txt	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	2025-12-03T08:56:20.496889204Z	2025-12-03T08:56:20.496889204Z	2025-12-03T08:56:20.496889204Z	["text/plain"]	0	0	0	0

pattern_matches.csv

id	sha256	pattern_name	match_type	match	location	length
1	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious Process Name	regex	mimikatz	8:17	8
2	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious Process Name	regex	mimikatz	8:44	8
3	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious Process Name	regex	procdump	9:17	8
4	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious Process Name	regex	procdump	9:44	8
5	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	PowerShell Hidden	regex	powershell.exe, CommandLine: powershell -w hidden	5:17	49
6	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Encoded PowerShell	regex	powershell.exe, CommandLine: powershell -w hidden -enc	5:17	54
7	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious Port	regex	:4444	13:59	5
8	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious Port	regex	:5555	14:57	5
9	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious Port	regex	:1337	15:26	5
10	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious Port	regex	:31337	16:26	6
11	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious DLL	regex	amsi.dll	19:33	8
12	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious DLL	regex	amsi.dll	19:69	8
13	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Suspicious DLL	regex	clrjit.dll	20:30	10
14	ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	Reflective Loading	regex	clr.dll, Status: loaded	21:30	23

signature_matches.csv

Empty CSV

unique_files.csv

sha256	sha1	md5	file_size	mime_type_for_content	shannon_entropy
ffb4c31ae38df4db765bec14e2892e10e1e5fe6bb8c762e340d992d37e7c7f71	d02f4f12e100aa1bbdea10dc5f79463d74d6e19e	6c6797a5077959fc4637e4b556085bed	1426	text/plain	5.19923754732871

Keyboard shortcuts

sus - Systematic Universal Scanner - Documentation