{"schema":"sb.node.v1","id":"sb:e/36ac9afa851dc27b3b73f7c1","kind":"entity","label":{"text":"powershell","locale":"en"},"identity":{"anchor":"label:en:powershell","strength":"label"},"asOf":{"knowledgeCutoff":"2026-10-08T23:32:17.032179+00:00","snapshot":"deploy f53c83974898cc97526b6050ab92612cf967bfc1"},"lens":{"kind":"public"},"build":{"plane":"projected","builtFrom":["entity_graph.slim.json","entity_receipts (deploy asset)","event_graph.json","truth_records (deploy asset)","corroborated_record.json"],"rule":"node-projection.entity@v1"},"standing":{"evidence":{"supporting":45,"separatePublishers":17,"basis":"documents that mention the subject and the outlets that carried them; a mention is evidence the referent is in use, not evidence about any claim"},"admission":{"state":"canonical","reason":"entity graph provenance 'curated'; the node carries no promotion receipt in v1","policy":"EQ-PROMOTION (receipt not carried)"},"disposition":{"state":"served","reason":"public record"},"validity":{"from":"2026-09-06","to":"2026-10-07","basis":"first and last day we saw it mentioned; not the subject's own lifetime"},"measurement":{"state":"partial","blind":["assertion coverage 0.244: about 76% of mentions carry no typed assertion"]}},"dimensions":{"domains":["cybersecurity","auto"],"activeDays":23,"assertions":{"military-action":8,"launch-release":2,"utterance":1}},"up":[],"upNote":"An entity is a root: it is contained by nothing. Pan out by following R.","children":{"count":12,"byKind":{"observation":12},"items":[{"id":"sb:o/10e693c25f3e517b392b24a7","kind":"observation","label":"The Hacker News · 2026-09-22 · TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data","url":"https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html"},{"id":"sb:o/0fd5d9c7b91e19cad07f323d","kind":"observation","label":"shattered.io · 2026-09-21 · Build a Valorant Uninstaller: PowerShell Script in 12 Steps [2026]","url":"https://shattered.io/build-valorant-uninstaller-powershell-script-2026/"},{"id":"sb:o/bd96bf472e57069f0871ebf5","kind":"observation","label":"The Hacker News · 2026-10-07 · 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer","url":"https://thehackernews.com/2026/10/100-compromised-websites-use-fake.html"},{"id":"sb:o/ee19e6c4deed013f55f62be2","kind":"observation","label":"The Hacker News · 2026-10-06 · ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits","url":"https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html"},{"id":"sb:o/eea0eaf46d7ae5d93fd49d6a","kind":"observation","label":"BleepingComputer · 2026-10-03 · The EDR blind spot: 3 ways browser attacks evade endpoint telemetry","url":"https://www.bleepingcomputer.com/news/security/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry/"},{"id":"sb:o/646ebde190c319e151dd5019","kind":"observation","label":"The Hacker News · 2026-10-03 · Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign","url":"https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html"},{"id":"sb:o/cfddde2c901b18803c0b275c","kind":"observation","label":"BleepingComputer · 2026-10-02 · Microsoft says threat actors are ahead in the early AI race","url":"https://www.bleepingcomputer.com/news/security/microsoft-says-threat-actors-are-ahead-in-the-early-ai-race/"},{"id":"sb:o/32d5a310e73194c32c8cb98a","kind":"observation","label":"Tech Times · 2026-10-02 · Microsoft 2026 Security Report: Autonomous Ransomware Has Hacked Real Organizations","url":"https://www.techtimes.com/articles/328467/20261002/microsoft-2026-security-report-autonomous-ransomware-has-hacked-real-organizations.htm"},{"id":"sb:o/0471c9126750668a140f21b4","kind":"observation","label":"Hacker News Top Stories · 2026-10-01 · Pi 1.0","url":"https://earendil.com/posts/pi-1-0/"},{"id":"sb:o/5669c06b8930e305be24fd53","kind":"observation","label":"The Hacker News · 2026-10-01 · Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks","url":"https://thehackernews.com/2026/09/attackers-abuse-msp360-to-deploy.html"}],"cursor":"c1.eyJpZCI6InNiOmUvMzZhYzlhZmE4NTFkYzI3YjNiNzNmN2MxIiwibCI6ImNoaWxkcmVuIiwibyI6MTAsImsiOm51bGwsImEiOiIyMDI2LTEwLTA4VDIzOjMyOjE3LjAzMjE3OSswMDowMCJ9","order":"newest first; we keep the 12 newest receipts for this entity. Its other observations are counted in standing.evidence.supporting but are not addressable in v1"},"relations":{"count":10,"byKind":{"co-mentioned":10},"items":[{"kind":"relation","label":"co-mentioned with microsoft (28 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/630273477b96a808e7729e5f"},{"kind":"relation","label":"co-mentioned with ai (27 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/c2a0149ab73808be374e2c46"},{"kind":"relation","label":"co-mentioned with clickfix (22 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/58f4220073fd09d9a3f57b8b"},{"kind":"relation","label":"co-mentioned with google (20 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/8ab8da6072528fe37737ab99"},{"kind":"relation","label":"co-mentioned with captcha (15 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/34d22a953347e90cbcfc4d38"},{"kind":"relation","label":"co-mentioned with chrome (13 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/c43716cd34df011215f20f0b"},{"kind":"relation","label":"co-mentioned with github (13 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/4e60bce92f56caaa30cc148a"},{"kind":"relation","label":"co-mentioned with crypto (13 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/55221eefc78053dc59dba2f7"},{"kind":"relation","label":"co-mentioned with russia (13 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/82a447812f7262451389a628"},{"kind":"relation","label":"co-mentioned with linux (11 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/ed96cc1022a0bd43e7ebb153"}],"cursor":null,"order":"situations first, then claims (the subject's own maintained record, then site-wide corroborated clusters; each label ends with its standing), then co-mentions by shared documents, descending. Co-mentions are the ten strongest the entity graph keeps per entity"},"edge":{"state":"continues"},"links":{"rest":"/api/v1/node/e/36ac9afa851dc27b3b73f7c1","mcp":"traverse {\"id\":\"sb:e/36ac9afa851dc27b3b73f7c1\"}","page":"/entity/powershell/"},"limits":{"levelsPerCall":1,"pageSize":10,"maxPageSize":50,"membersMax":50,"statement":"One level per call: depth is 1 and only 1, and there is no whole-graph dump. pageSize 1-50 (default 10); a page limit is a cursor, never an edge. Members are listed up to 50. At most 60 traverse calls a minute per caller (runaway-loop protection, not a meter). One knowledge cutoff is served: the deploy's."},"actions":[{"verb":"unfold","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/36ac9afa851dc27b3b73f7c1\",\"level\":\"children\"}"},{"verb":"fold","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/36ac9afa851dc27b3b73f7c1\"}"},{"verb":"panOut","lit":false,"effect":"read","layer":"cantina","reason":"An entity is a root: it is contained by nothing. Pan out by following R."},{"verb":"follow","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/36ac9afa851dc27b3b73f7c1\",\"level\":\"relations\"}"},{"verb":"receipts","lit":false,"effect":"read","layer":"cantina","reason":"receipts are the observations below this node; unfold to reach them"},{"verb":"edge","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/36ac9afa851dc27b3b73f7c1\"}"},{"verb":"asOf","lit":false,"effect":"read","layer":"cantina","reason":"v1 serves one knowledge cutoff, this deploy's; walking an earlier cutoff needs retained history (EQ-REPLAY), which v1 does not keep"},{"verb":"switchObserver","lit":false,"effect":"read","layer":"cantina","reason":"the public record is the same for every observer; traversal through a Watch's lens is not served in v1"},{"verb":"readOriginal","lit":false,"effect":"read","layer":"cantina","reason":"no translation is applied on this node; every label is the source's own text"},{"verb":"save","lit":false,"effect":"watch-declaration","layer":"workshop","reason":"saving applies to a configured Watch; configure one around this node first (free), then save it"},{"verb":"deliver","lit":false,"effect":"watch-declaration","layer":"workshop","reason":"delivery applies to a saved Watch"},{"verb":"format","lit":false,"effect":"watch-declaration","layer":"workshop","reason":"output format applies to a saved Watch"},{"verb":"deltaR","lit":false,"effect":"read","layer":"workshop","reason":"Delta R needs a saved Watch with a previous reading"},{"verb":"read","lit":false,"effect":"read","layer":"docking-bay","reason":"one-time Reads are parked until the Commander decides their shape (#938)"}]}