Starting from a single SHA-256 dropper hash observed across many customer tenants worldwide, this proof of concept:

  1. Generates synthetic telemetry - realistic data modeling a global email-based malware campaign across 25+ countries, multiple tenants, and thousands of hosts
  2. Builds an entity graph - transforms raw telemetry into interconnected nodes (files, hosts, emails, domains, IPs, users, campaigns) and edges (relationships between them)
  3. Visualizes the graph in 3D - a browser-based interactive graph where analysts can rotate, zoom, filter, search, and inspect entities to understand how the malware spreads

Try the interactive demo to explore the graph in your browser – rotate, zoom, filter by node type or country, and click nodes to inspect their properties.

Architecture

generator/      Synthetic telemetry generator (Python, seeded for reproducibility)
pipeline/       Graph construction pipeline (Python, transforms telemetry into nodes + edges)
api/            Backend API (Python / FastAPI, serves graph data)
frontend/       Web application (React / TypeScript, 3D force-directed graph)

Entity Types

TypeExamples
File / MalwareSHA-256 hashes, file names, paths, dropped files, process trees
Host / DeviceHostname, OS, device type, country, tenant, security posture
EmailSender, subject, attachment, delivery time, auth results
Network / InfraURLs, domains, IPs, ASN, ports, SSL certs
ExecutionProcess events, persistence, C2 connections, follow-on payloads
CampaignCluster ID, region variant, lure family, time window

Analyst Questions This Answers

  • Which countries saw this dropper most often?
  • What file paths were most commonly used?
  • Which domains and IPs were reused across tenants?
  • Were there regional campaign variants?
  • What follow-on payloads were associated with this hash?