Turn a full five-signal DLL-injection telemetry chain into an explainable detection—without injecting a DLL or touching a live process.
What changed
- Added deterministic
classicand cleancooperativesynthetic scenarios. - Added ordered actor/target/module correlation mapped to ATT&CK T1055.001.
- Added
simulate,detect,demo, and compatibilityartifactsCLI modes. - Added JSONL fixtures plus JSON, Markdown, and SARIF reporting.
- Added an enforced offline boundary and expanded the suite to 32 tests.
- Added a zero-install interactive browser demo.
Try it
pip install dll_injection_lab-0.2.0-py3-none-any.whl
dll-injection-lab demoExpected result: one high-severity synthetic finding across five events. Run dll-injection-lab demo --scenario cooperative for the zero-finding clean control.