ghostlogic-demo
22-minute forensic breach replay for GhostLogic. Ships 352K events to a Blackbox server, escalating from normal telemetry through a full APT compromise. Forces capsule seal after each batch.
Install
pip install .
Usage
# Live — sends to your Blackbox server
ghostlogic-demo --url https://api.ghostlogic.tech --key glk_YOUR_KEY
# Dry run — generates events, doesn't send
ghostlogic-demo --dry-run
# Quick test — 3 batches instead of 22
ghostlogic-demo --url https://api.ghostlogic.tech --key glk_YOUR_KEY --batches 3
What It Does
Sends 16,000 events every 60 seconds (22 batches = 352,000 events total). Forces a capsule seal after each batch so the Blackbox seals immediately.
Phase timeline:
- Batches 1-6 (min 0-6): Normal telemetry (processes, network, disk, services)
- Batches 7-9 (min 6-9): Initial access (Chrome extension attack)
- Batches 10-13 (min 9-13): C2 + persistence (DNS C2, rogue ports, scheduled tasks)
- Batches 14-17 (min 13-17): Credential access (lsass targeting, registry persistence)
- Batches 18-22 (min 17-22): Data exfiltration (staging, upload, network spike)
Zero Dependencies
Standard library only. No pip requirements.
1 maintainer
Release files for ghostlogic-demo 1.6.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| ghostlogic_demo-1.6.0.tar.gz | 42.5 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| ghostlogic_demo-1.6.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 84.9 MB
Release files / ghostlogic_demo-1.6.0.tar.gz
| Download URL | ghostlogic_demo-1.6.0.tar.gz |
|---|---|
| Size | 42.5 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
291cc5d2323cd8df2eebee5206f8a5b790d3b28b213b14b1584f08a514061297
|
|
BLAKE2b-256 checksum How to use checksums |
a124ec08b902a788a276bc8f7f1618dd56d68e5c88edec66faf2af9cd661672d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.10
|
Release files / ghostlogic_demo-1.6.0-py3-none-any.whl
| Download URL | ghostlogic_demo-1.6.0-py3-none-any.whl |
|---|---|
| Size | 42.5 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c95d99e021e6eed7a71a3bcb2468a62c403f60b2ae6566a1a76a23913618ee47
|
|
BLAKE2b-256 checksum How to use checksums |
905a70f885bca00ead9d2e402d9b4634ff2c0f7a1e16f14bb5016bd97b917f14
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.10
|
