{
  "manifest_version": 2,
  "generated_at": "2026-07-14T20:11:34.263Z",
  "subscription": {
    "rules_url": "/sigma/manifest.json",
    "lock_url": "/sigma/rules.lock.json",
    "tarball_url": "/sigma/rules.tar.gz",
    "changelog_url": "/sigma/CHANGELOG.md",
    "feed_url": "/sigma/sigma-feed.xml",
    "intel_context_url": "/sigma/evidence.json",
    "protocol": "Compare rules.lock.json: a rule's `version` bumped ⇒ changed; `change_type: logic` ⇒ re-test before deploy. drafts[] are scaffolds — not production-ready. Each rule's `intel_summary` is the live corpus signal it responds to; full context (KEV CVEs, OSINT events, active families) is in evidence.json keyed by slug."
  },
  "rules": [
    {
      "id": "af60fbd6-51c7-5814-b803-bdb24f984d9c",
      "slug": "t1037-linux-init-script-modification",
      "title": "T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification",
      "description": "Creation or modification of legacy init-system entry points (/etc/rc.local, /etc/init.d/, /etc/rc*.d/). Adversaries plant scripts there for root-context execution at boot — old-school, still routinely effective on servers and appliances that keep sysvinit compatibility. (Systemd-unit persistence is T1543.002 — separate rule.) Authored from the thrunt.me detection-gap queue (corpus signal with zero SigmaHQ/thrunt tag coverage for T1037 at authoring time); analyst-reviewed 2026-06-11.",
      "status": "experimental",
      "level": "medium",
      "logsource": {
        "category": "file_event",
        "product": "linux"
      },
      "attack_techniques": [
        "T1037"
      ],
      "modified": "2026-06-11",
      "sha256": "32369192b8f294fc9a59579158ff6f4e02685a6fff4d616871cd67375a607318",
      "yaml_url": "/sigma/t1037-linux-init-script-modification.yml",
      "intel_summary": {
        "kev": 3,
        "misp": 0,
        "families": 0,
        "live": true
      }
    },
    {
      "id": "f430d288-7ffd-5675-b9e4-5276a2a5faf0",
      "slug": "t1098-004-ssh-authorized-keys-write",
      "title": "T1098.004 Account Manipulation — SSH Authorized Keys File Modification",
      "description": "Creation or modification of an SSH authorized_keys file. Adversaries add their own public key to maintain persistent access after initial compromise — a one-line write that survives credential rotation and (on many estates) every patch cycle. Authored from the thrunt.me detection-gap queue (corpus signal with zero SigmaHQ/thrunt tag coverage for T1098.004 at authoring time); analyst-reviewed 2026-06-11.",
      "status": "experimental",
      "level": "medium",
      "logsource": {
        "category": "file_event",
        "product": "linux"
      },
      "attack_techniques": [
        "T1098.004"
      ],
      "modified": "2026-06-11",
      "sha256": "ca4e7f54c30a70b21bdca27c53403610520bd0c8d95f676d0a4ac3489990a7d9",
      "yaml_url": "/sigma/t1098-004-ssh-authorized-keys-write.yml",
      "intel_summary": {
        "kev": 1,
        "misp": 0,
        "families": 0,
        "live": true
      }
    },
    {
      "id": "d4809b9b-47f0-54ea-b8ee-7a986643871e",
      "slug": "t1566-002-luxembourg-hospitality-sms-phish",
      "title": "T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign",
      "description": "Smishing campaign targeting hotel customers in Luxembourg. The CIRCL MISP event lists six SMS sender phone numbers (NL/UK/ID country codes) that delivered the lure linking to a credential-harvesting page. This rule fires on SMS or mobile-threat-defense telemetry showing inbound messages from any of those senders. Source IOCs are sender numbers only — the source event does not publish the lure URL or landing domain, so URL/DNS coverage is left as a follow-up if those indicators surface. Tagged T1566.002 (Phishing: Spearphishing Link); the SMS delivery angle maps to MISP galaxy \"phishing:techniques=sms-phishing\".",
      "status": "experimental",
      "level": "medium",
      "logsource": {
        "category": "sms",
        "product": "mobile"
      },
      "attack_techniques": [
        "T1566.002"
      ],
      "modified": "2026-06-10",
      "sha256": "0463cb0ec067942d9dab39fd71a09bfa2905f063a4a246dacd72e3f636210efc",
      "yaml_url": "/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml",
      "intel_summary": {
        "kev": 5,
        "misp": 0,
        "families": 0,
        "live": true
      }
    }
  ],
  "drafts": [
    {
      "id": "dab62e1a-5112-5840-b484-24ec05969a27",
      "slug": "t1003-008-etc-shadow-access",
      "title": "T1003.008 OS Credential Dumping — /etc/shadow and /etc/gshadow Access",
      "description": "Read access to /etc/shadow or /etc/gshadow outside the small set of binaries with a legitimate need. Password hashes in shadow are the canonical Linux credential-dumping target for offline cracking. Gap signal: 1 KEV CVE maps to this technique with zero community/thrunt rule coverage. Authored from the thrunt.me detection-gap queue (corpus signal with zero SigmaHQ/thrunt coverage for T1003.008 at scaffold time). The detection.selection block is a TODO sentinel; a reviewed proposal is commented directly above it — uncomment-and-swap after analyst review, then promote experimental → test.",
      "status": "draft",
      "level": "medium",
      "logsource": {
        "product": "linux",
        "service": "auditd"
      },
      "attack_techniques": [
        "T1003.008"
      ],
      "modified": "2026-06-11",
      "sha256": "67d939dd08519dbf5e8c8a79d998f9a57c44a7ac1f0f6b48f8aa9fd97bc7b109"
    },
    {
      "id": "bb49cb3f-b866-51a2-8673-9521ad1433c6",
      "slug": "t1530-data-cloud-storage",
      "title": "T1530 Data from Cloud Storage — Detection",
      "description": "Detects Data from Cloud Storage (T1530). Authored from the thrunt.me detection-gap queue: corpus signal with zero SigmaHQ/thrunt coverage at scaffold time. The detection.selection block is a TODO sentinel — the analyst authors it from the evidence bundle in the comment header, then promotes experimental → test.",
      "status": "draft",
      "level": "medium",
      "logsource": {
        "product": "aws",
        "service": "cloudtrail"
      },
      "attack_techniques": [
        "T1530"
      ],
      "modified": "2026-07-04",
      "sha256": "2d4b8c2e3d8c0c742a0865b9e371a059960c50c49c29fd14a3acd1ff20bd503b"
    }
  ]
}