feat: backlog detection rules, atomics, and pack wiring#23
Merged
Conversation
Implement the RULES_BACKLOG.md detection set across all three waves. Rules (37 new artifacts): - Windows Sigma (15): WMI subscription, bcdedit/wbadmin recovery tamper, fsutil USN wipe, Procdump LSASS, IFEO/SilentProcessExit, Winlogon helper, sc/net security-service stop, AMSI bypass, unmanaged PowerShell, netsh portproxy, bitsadmin download, startup-folder drop, LOLBin outbound, unsigned-DLL sideload (hunting), recon-command burst (hunting) - Linux Sigma (11): nc/socat exec shell, kmod from susp path, duplicate-UID-0 account, shell outbound, history tamper, log clear, chmod suid, udev persistence, webshell write, base64-pipe-shell, security-service stop - macOS Sigma (5): TCC.db access, browser credential theft, ssh authorized_keys, launchctl load, history tamper - YARA (6): Windows XMRig, msfvenom (ELF+PE), Sliver (ELF+PE), Cobalt Strike Atomic firing tests (20 new): scripts + manifest entries for every rule on a channel the harness reliably exercises. New/uncertain channels (wmi_event, image_load, network_connection, ps_script, Linux file-delete) are test_status manual with a test_reason; macOS is none per existing convention. Packs: all 7 manifests updated (rules, attack_coverage, telemetry_requirements); Windows Essential reaches the target composition. Added 23 ATT&CK techniques to tools/attack_techniques.json so the catalog builds with no warnings. validate.py, build_packs.py, build_catalog.py, ruff, ty, and the --check-coverage --strict-essential gate all pass.
…n-rules # Conflicts: # packs/linux/advanced/pack.yml # packs/linux/essential/pack.yml # packs/macos/advanced/pack.yml # packs/macos/essential/pack.yml # packs/windows/advanced/pack.yml # packs/windows/essential/pack.yml # packs/windows/hunting/pack.yml # tests/atomic/manifest.json
…sfvenom yara into pack The 6 linux process_creation atomics ran the copied shell as `sh -c 'sleep 1'` with the detection tokens as trailing args. Because dash/bash tail-exec a single `-c` command, the process replaced itself with `sleep 1` before /proc command-line enrichment ran, dropping both its Image (nc/insmod/useradd/...) and the detection tokens, so the CommandLine-keyed rules never fired. Use 'sleep 1; :' so the shell no longer tail-execs and lives ~1s as itself. Also add yara-win-msfvenom-stager to the windows-essential pack (it was only wired on linux), so the windows_msfvenom_yara_fixture atomic has a rule to match.
…dowing The engine emits one Sigma alert per process event (check_event returns the first matching rule). Running the renamed nc/insmod/useradd/journalctl/chmod/ systemctl copies from /tmp meant the broad 'Execution from World-Writable / Temporary Directory' rule matched first and shadowed the specific rule, which was never returned (confirmed via engine logs: the 6 rules never even logged as triggered, while world-writable fired on those exact /tmp events). Stage the copies under /opt instead (root-writable, not world-writable), so each specific rule is the sole match and fires. This also better mirrors reality where these tools live in system bin dirs, not /tmp.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's in it
37 new detection artifacts (81 total, up from 44):
New telemetry channels get their first rules:
wmi_event,image_load,network_connection(Win+Linux), and Windowsfile_event.20 new atomic firing tests (52 total) — scripts under
tests/atomic/atomics/+manifest.jsonentries — for every rule on a channel the CI harness reliably exercises.Pack + catalog wiring: all 7
pack.ymlmanifests updated (rules,attack_coverage,telemetry_requirements); Windows Essential reaches the target composition from §7 of the backlog. 23 ATT&CK techniques added totools/attack_techniques.json(catalog builds with 0 warnings).Design notes
test_statusrespects the coverage gate (--check-coverage --strict-essentialruns on every push). Essentials areatomic(with scripts) ormanual+test_reason. Channels the harness doesn't reliably exercise on hosted runners —wmi_event,image_load,network_connection,ps_script, Linux history-delete — aremanual+ reason. macOS isnone(excluded from the gate, matching existing convention).TargetObjectorDetails(Rustinel reportsTargetObjectas the key path without the value name), and their atomics create a key whose path ends in the value name — same idiom as the existing WDigest/Defender rules.Image|endswithatomics copy/bin/shto a temp subdir with the exact tool basename (<dir>/nc, not..._nc) and run it with-c 'sleep 1' <tokens>so the process lives long enough for/proccommand-line enrichment.Checks (all green locally)
validate.py·build_packs.py·build_catalog.py(0 warnings) ·ruff check·ruff format --check·ty check·run_atomics.py --check-coverage --strict-essential.The P2/P3 atomic firing tests only execute end-to-end on the Windows/Linux CI runners. A few new rules use the
windashmodifier andcidr/Signedfields, which are documented inrustinel-support.mdbut not yet used by any pre-existing rule — worth watching theatomicworkflow for any load-time rejection.