anti
806301e179
10 YAMLs for the behavioral / cross-event cohort per Appendix B: beaconing, data destruction, ransom note, web exfil, DB mass-read, credentials-in-files, k8s SA token harvest, Docker host escape, LLMNR poisoning, TFTP router-config retrieval. Every rule is lifter-bound (BehavioralLifter / IdentityLifter) — the v0 RuleEngine cannot count, aggregate, or compose cross-event signals, so these YAMLs declare the technique mappings the lifter will consume by rule_id at E.3.9. Their match specs use a 'kind: lifter:*' shape inert to the regex matcher. test_behavioral_rules.py asserts each YAML compiles, none fire from the v0 engine (FP regression guard against a YAML drifting into a regex), and an xfail(strict=True, reason='impl phase E.3.9') precision case that will flip green when the lifter lands.
26 lines
594 B
YAML
26 lines
594 B
YAML
rule_id: R0036
|
|
rule_version: 1
|
|
name: credentials_in_files
|
|
description: |
|
|
Reading .env / .git/config / cloud credential files —
|
|
credential-from-file harvesting. Lifter-driven so the rule
|
|
composes the file-access signal with the path discriminator.
|
|
applies_to:
|
|
- session
|
|
- http_request
|
|
match:
|
|
kind: lifter:credentials_in_files
|
|
paths:
|
|
- '\\.env'
|
|
- '\\.git/config'
|
|
- '\\.aws/credentials'
|
|
- '\\.ssh/id_rsa'
|
|
- 'wp-config\\.php'
|
|
emits:
|
|
- tactic: TA0006
|
|
technique_id: T1552
|
|
sub_technique_id: T1552.001
|
|
confidence: 0.9
|
|
evidence_fields:
|
|
- matched_path
|