anti/DECNET
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ttp): expand R0054/R0055/R0057 emits + LAST_REVIEWED markers

Browse Source 
The IntelLifter's _emit_filtered fans out only the rule.emits entries
whose technique_id appears in the predicate's decision set. v1's emits
lists were narrow supersets of the common case, silently dropping the
rest of the predicate's possible emissions:

  R0054 dropped: T1046 (cat 14), T1078 (cat 20), T1090 (cats 9/13),
                 T1496 (cat 11), T1595 (cats 14/19)
  R0055 dropped: T1090 (tor_exit_node), T1110 (ssh_bruteforcer),
                 T1588 (the second emit of every C2-framework tag)
  R0057 dropped: T1105 (payload_delivery, download_url)

Bump rule_version 1->2 on R0054/R0055/R0057, expand emits to cover
every technique the predicate produces. R0056 (Feodo) and R0058
(aggregate bump) carry no enum and stay at v1.

All five YAMLs gain `last_reviewed: "2026-05-02"` and
`next_review: "2026-08-02"` markers; the rule YAML is now the
canonical record of when the mapping was last reconciled against
upstream, with DEBT.md as the calendar reminder.
This commit is contained in:
anti
2026-05-02 18:09:03 -04:00
parent 75ff0ede1f
commit f8dee596e5
5 changed files with 84 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rules/ttp/R0058.yaml
View File

@@ -1,5 +1,7 @@
rule_id: R0058
rule_version: 1
last_reviewed: "2026-05-02"
next_review: "2026-08-02"
name: aggregate_malicious_verdict_bump
description: |
Aggregate intel verdict = "malicious" with no specific provider