Skip to content

feat(detect): MITRE ATLAS 5.6 agentic coverage — 40 new community rules, built-in catalog, rules list, enforced mappings (v0.14.0) #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
efij merged 1 commit into from
Sep 3, 2026
Merged

feat(detect): MITRE ATLAS 5.6 agentic coverage — 40 new community rules, built-in catalog, rules list, enforced mappings (v0.14.0) #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,61 @@ and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.

## [Unreleased]

## [0.14.0] — 2026-09-03

Detection coverage release: every HIGH/CRITICAL detection now maps to MITRE
ATLAS 5.6 and/or ATT&CK, the agentic ATLAS technique family is covered, and the
mapping is enforced by tests.

### Added
- **40 community-pack rules** (v3, 77 rules total; 58 HIGH/CRITICAL) covering the
MITRE ATLAS agentic techniques and the ATT&CK gaps: agent credential-store
access (`AGENT_CREDENTIAL_STORE_ACCESS`, AML.T0083), agent config written via
shell / MCP server added by the agent / nested agent launched with permission
bypass (AML.T0081, AML.T0103), instruction files populated from remote content
and standing instructions that order network activity (`MEMORY_INSTRUCTION_CALLOUT`,
AML.T0080.000), exfiltration via tool invocation (cloud storage upload, scp/rsync
to remote, curl file upload, git push to URL — AML.T0086), jailbreak templates,
system-prompt extraction, prompt self-replication and chat-template role-marker
smuggling (AML.T0054/T0056/T0061/T0051.001), agent config discovery (AML.T0084.001),
unsafe AI artifact deserialization and package-from-URL installs (AML.T0011),
OS credential dumping toolkit (CRITICAL, AML.T0090), bulk file encryption
(CRITICAL, T1486), persistence (shell rc, systemd/launchd/Windows services,
Run keys, scheduled tasks, git hooks, SUID, kernel modules), PowerShell encoded /
remote execution, Windows Defender/firewall weakening, cloud IAM persistence and
cloud audit-log disabling, privileged Kubernetes workloads, database dumps,
toolchain credential files, SSH private-key reads, cryptominers, timestomp
commands, secrets in URLs and echoed secret env vars. Every rule ships with a
hit/miss sample table (`internal/rulepack/mitre_test.go`).
- **`mitre_atlas` on existing pack rules** where a valid technique exists (22 rules,
e.g. `REVERSE_SHELL` → AML.T0072 Reverse Shell, `MCP_UNPINNED_PACKAGE` → AML.T0010.005).
- **Built-in rule catalog** (`internal/catalog`): machine-readable index of all 51
built-in rules across detect / mcpaudit / provenance / correlate with their
MITRE mapping; a test fails the build if a `RuleID` appears in source without a
catalog entry or vice versa.
- **`agentdfir rules list [--packs dir] [--json]`**: every detection with severity,
surface, ATT&CK and ATLAS (with technique name).
- **`docs/detection-coverage.md`**: generated matrix (ATLAS technique → rules,
ATT&CK technique → rules, full table) via `scripts/coverage-matrix.sh`.
- **Embedded MITRE ATLAS 5.6.0 technique table** (`internal/rulepack/atlas_ids.go`,
regenerated by `scripts/gen-atlas-ids.sh`); `rulepack.ValidATLAS` / `ATLASName`.
Tests reject any `mitre_atlas` that is not a real technique.

### Changed
- Built-in mappings updated to the ATLAS 5.x agentic techniques:
`MCP_TOOL_POISONING` → AML.T0099 (AI Agent Tool Data Poisoning),
`TOOL_POISONING_INDICATOR` and `MCP_TOOL_DESCRIPTION_POISONING` → AML.T0110
(AI Agent Tool Poisoning), `AGENT_CONTEXT_POISONING` and
`INSTRUCTION_FROM_TOOL_RESULT` → AML.T0080.000 (AI Agent Context Poisoning:
Memory), `INVISIBLE_UNICODE_INSTRUCTION` → AML.T0068 (LLM Prompt Obfuscation).
ATLAS added to `DESTRUCTIVE_COMMAND` (AML.T0101), `POTENTIAL_DATA_EXFILTRATION`
(AML.T0086), `AGENT_SELF_MODIFICATION` / `PERMISSION_BYPASS_ENABLED` /
`PERMISSION_ESCALATION` (AML.T0081), `SENSITIVE_FILE_READ` / `SECRET_ACCESS`
(AML.T0055), `UNEXPECTED_NETWORK_DESTINATION` metadata variant (AML.T0075),
`AGENT_SPAWN_EXPLOSION` (AML.T0034.002), `SHELL_EXECUTION` (T1059 / AML.T0050).
- Starter pack v2 carries `mitre_atlas`; `PACKAGE_PUBLISH` refined to T1195.002,
`MCP_AUTO_APPROVE_ALL` / `MCP_WILDCARD_PERMISSIONS` gain T1562.001.

## [0.13.0] — 2026-09-03

### Added
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ Add a second witness and the same commands upgrade every finding from *the agent
```

Other ways in: `collect --path <copied home>`, `--import <KAPE/Velociraptor tree>`, `--docker <container>`, `--archive <zip|tar>`.
Other ways out: `report --format pdf|html|ocsf|sarif|timesketch|…`, `rules export --sigma`. Before an incident: `monitor --detect --alert <url>`, `mcp audit`.
Other ways out: `report --format pdf|html|ocsf|sarif|timesketch|…`, `rules list --packs rules` (every detection → [MITRE ATLAS / ATT&CK](docs/detection-coverage.md)), `rules export --sigma`. Before an incident: `monitor --detect --alert <url>`, `mcp audit`.
Every command is listed by workflow step in `agentdfir help`.

Example finding:
Expand Down Expand Up @@ -144,7 +144,7 @@ Ships with wrappers for tools IR teams already run:
|---|---|
| ✅ | Sealed `.adfir` packages, hash-chained custody, `verify` |
| ✅ | Claude Code: detect, collect, normalize, timeline, triage |
| ✅ | 36 deterministic detections (full plan set): rogue/orphan agents, exfiltration, context/tool/MCP poisoning, secret & sensitive-file access, self-modification, log deletion, timestomping, session tampering… with MITRE ATLAS/ATT&CK mapping |
| ✅ | [132 deterministic detections](docs/detection-coverage.md) (51 built-in + 81 pack rules; 88 HIGH/CRITICAL, every one mapped to MITRE ATLAS 5.6 / ATT&CK — 27 ATLAS and 65 ATT&CK techniques): rogue/orphan agents, exfiltration via tool invocation, context/memory/tool/MCP poisoning, agent credential-store theft, agent config modification, jailbreak & system-prompt extraction, secret & sensitive-file access, persistence (rc files, services, run keys, git hooks), credential dumping, bulk encryption, self-modification, log deletion, timestomping, session tampering… `agentdfir rules list` prints the matrix |
| ✅ | `simulate` — synthetic incident generation (adversary emulation for AI agents) |
| ✅ | Full parsers for 12 products: Claude Code, Codex, Gemini CLI, Cursor, Copilot CLI, Copilot Chat (VS Code), Cline, Roo, OpenClaw, OpenCode, Aider, Warp |
| ✅ | [Endpoint corroboration](docs/endpoint-corroboration.md) — auditd, Sysmon XML, Velociraptor/osquery/eslogger/EDR exports: tool calls → CORROBORATED / CONTRADICTED, unlogged agent processes and connections surfaced |
Expand Down
Loading
Loading