Detection content

Sigma Rules

Hand-authored Sigma rules for TTPs the corpus shows to be exploited-and-undetected — where live signal is high and community coverage is zero. Quality over volume; base Sigma only (your pipeline converts to its own backend). Bulk IOCs live in Intel Feeds.

Subscribe: manifest.json · rules.lock.json · rules.tar.gz · CHANGELOG · feed

Production rules (3)

Rule	Status	Level	Logsource	ATT&CK	YAML
T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification	`experimental`	medium	linux / file_event	T1037	`.yml`
T1098.004 Account Manipulation — SSH Authorized Keys File Modification	`experimental`	medium	linux / file_event	T1098.004	`.yml`
T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign	`experimental`	medium	mobile / sms	T1566.002	`.yml`

Authoring queue — the editorial calendar

Every row is a technique with live corpus signal and zero coverage anywhere, ranked by a deterministic score (active malware family + KEV CVEs + citing OSINT + exploit probability). This is signal × coverage → gap made concrete: what gets authored next, in order, computed daily — not asserted.

Technique	Name	State	Score	Active families	KEV
T1497	Virtualization/Sandbox Evasion	`candidate`	36	—	4
T1573.001	Symmetric Cryptography	`candidate`	31.8	—	3
T1562.001	—	`candidate`	28	—	0
T1499.002	Service Exhaustion Flood	`candidate`	27.6	—	2
T1530	Data from Cloud Storage	`scaffolded`	24.1	—	2
T1003.008	/etc/passwd and /etc/shadow	`scaffolded`	24	—	1
T1498.001	Direct Network Flood	`candidate`	24	—	1
T1491.002	External Defacement	`candidate`	24	—	1
T1602	Data from Configuration Repository	`candidate`	23.9	—	1
T1070.001	—	`candidate`	23.8	—	0
T1071.002	File Transfer Protocols	`candidate`	22	—	1
T1011	Exfiltration Over Other Network Medium	`candidate`	20	—	4

Sigma Rules

Production rules (3)

Authoring queue — the editorial calendar

Subscription contract