anti 9056e33962 feat(ttp): Ipv6LeakLifter + R0059 rule for IPv6 link-local opsec failures ...

Ipv6LeakLifter subscribes to source_kind="ipv6_leak" events from both
the passive sniffer and active prober. Emits T1090 (Proxy) under TA0011
(C2) when fe80:: source address is observed — the attacker's VPN only
tunnels IPv4 so their link-local IID leaks their NIC identity.

Rule R0059 sets base confidence 0.85; iid_kind in the evidence carries
the per-observation strength (eui64 = MAC-derived, deterministic;
stable_privacy = RFC 7217; temporary = RFC 4941).

2026-05-17 20:22:26 -04:00

..

R0001.yaml

feat(ttp): E.3.13 IdentityLifter + CredentialLifter (R0001-R0006)

2026-05-01 20:52:56 -04:00

R0002.yaml

feat(ttp): E.3.13 IdentityLifter + CredentialLifter (R0001-R0006)

2026-05-01 20:52:56 -04:00

R0003.yaml

feat(ttp): E.3.13 IdentityLifter + CredentialLifter (R0001-R0006)

2026-05-01 20:52:56 -04:00

R0004.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0005.yaml

feat(ttp): E.3.13 IdentityLifter + CredentialLifter (R0001-R0006)

2026-05-01 20:52:56 -04:00

R0006.yaml

feat(ttp): E.3.13 IdentityLifter + CredentialLifter (R0001-R0006)

2026-05-01 20:52:56 -04:00

R0007.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0008.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0009.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0010.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0011.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0012.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0013.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0014.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0015.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0016.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0017.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0018.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0019.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0020.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0021.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0022.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0023.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0024.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0025.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0026.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0027.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0028.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0029.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0030.yaml

feat(ttp): E.3.8 R0001-R0030 command cohort

2026-05-01 09:16:38 -04:00

R0031.yaml

refactor(ttp): normalise lifter:<owner>_<name> match.kind prefix

2026-05-01 20:10:33 -04:00

R0032.yaml

feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

2026-05-01 20:17:59 -04:00

R0033.yaml

refactor(ttp): normalise lifter:<owner>_<name> match.kind prefix

2026-05-01 20:10:33 -04:00

R0034.yaml

refactor(ttp): normalise lifter:<owner>_<name> match.kind prefix

2026-05-01 20:10:33 -04:00

R0035.yaml

refactor(ttp): normalise lifter:<owner>_<name> match.kind prefix

2026-05-01 20:10:33 -04:00

R0036.yaml

feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

2026-05-01 20:17:59 -04:00

R0037.yaml

feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

2026-05-01 20:17:59 -04:00

R0038.yaml

refactor(ttp): normalise lifter:<owner>_<name> match.kind prefix

2026-05-01 20:10:33 -04:00

R0039.yaml

refactor(ttp): normalise lifter:<owner>_<name> match.kind prefix

2026-05-01 20:10:33 -04:00

R0040.yaml

feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

2026-05-01 20:17:59 -04:00

R0041.yaml

refactor(ttp): normalise lifter:<owner>_<name> match.kind prefix

2026-05-01 20:10:33 -04:00

R0042.yaml

feat(ttp): E.3.8 R0041-R0048 email cohort

2026-05-01 09:19:56 -04:00

R0043.yaml

feat(ttp): E.3.8 R0041-R0048 email cohort

2026-05-01 09:19:56 -04:00

R0044.yaml

feat(ttp): E.3.8 R0041-R0048 email cohort

2026-05-01 09:19:56 -04:00

R0045.yaml

feat(ttp): E.3.8 R0041-R0048 email cohort

2026-05-01 09:19:56 -04:00

R0046.yaml

feat(ttp): E.3.8 R0041-R0048 email cohort

2026-05-01 09:19:56 -04:00

R0047.yaml

feat(ttp): E.3.8 R0041-R0048 email cohort

2026-05-01 09:19:56 -04:00

R0048.yaml

feat(ttp): E.3.8 R0041-R0048 email cohort

2026-05-01 09:19:56 -04:00

R0049.yaml

feat(ttp): E.3.8 R0049-R0053 canary fingerprint cohort

2026-05-01 09:21:01 -04:00

R0050.yaml

feat(ttp): E.3.8 R0049-R0053 canary fingerprint cohort

2026-05-01 09:21:01 -04:00

R0051.yaml

feat(ttp): E.3.8 R0049-R0053 canary fingerprint cohort

2026-05-01 09:21:01 -04:00

R0052.yaml

feat(ttp): E.3.8 R0049-R0053 canary fingerprint cohort

2026-05-01 09:21:01 -04:00

R0053.yaml

feat(ttp): E.3.8 R0049-R0053 canary fingerprint cohort

2026-05-01 09:21:01 -04:00

R0054.yaml

fix(ttp): expand R0054/R0055/R0057 emits + LAST_REVIEWED markers

2026-05-02 18:09:03 -04:00

R0055.yaml

fix(ttp): expand R0054/R0055/R0057 emits + LAST_REVIEWED markers

2026-05-02 18:09:03 -04:00

R0056.yaml

fix(ttp): expand R0054/R0055/R0057 emits + LAST_REVIEWED markers

2026-05-02 18:09:03 -04:00

R0057.yaml

fix(ttp): expand R0054/R0055/R0057 emits + LAST_REVIEWED markers

2026-05-02 18:09:03 -04:00

R0058.yaml

fix(ttp): expand R0054/R0055/R0057 emits + LAST_REVIEWED markers

2026-05-02 18:09:03 -04:00

R0059.yaml

feat(ttp): Ipv6LeakLifter + R0059 rule for IPv6 link-local opsec failures

2026-05-17 20:22:26 -04:00