refactor: source ares technique credit from loot token_coverage - #28
Merged
Merged
Conversation
**Changed:** - Technique credit now derives from the loot JSON's own `token_coverage` map instead of re-deriving categories from raw vuln_id prefixes, eliminating the second Redis round trip - `transport_ares.go`. ares owns the vuln_id-to-category derivation as of ares-cli dreadnode#366, so `FetchReport` is now a single SSM call. - Replaced the prefix-matching credit path with a `creditableCategories` join table mapping ares category names to answer-key technique IDs, plus a `uncreditableCategories` refusal table for `other`, `golden_ticket`, `printnightmare`, and `zerologon` - `transport_ares.go`. `printnightmare` and `zerologon` are explicit refusals because ares mints them on evidence that precedes success. - Reworked `detectTokenCoverageDrift` to surface only categories that are neither creditable nor deliberately refused, failing closed on unknown categories so new ares techniques warn rather than silently dead-credit - `transport_ares.go`. - `writeTokenCoverageEntries` emits one finding per creditable category with a proven exploit, walking categories in sorted order for deterministic output; evidence now names the category and proven count since ares no longer exposes individual vuln_ids - `transport_ares.go`. - Restructured the test suite around the category join: added coverage for the credit table, refusal classification, drift detection, deterministic output, and evidence formatting - `transport_ares_test.go`. - Updated `synthesizeJSONL` call sites to drop the exploited-set argument and drive golden-ticket-adjacent verification through `TokenCoverage` - `verify_test.go`. **Removed:** - Removed the Redis fetch path (`fetchExploited`, `splitExploitedSets`, `exploitedSetMarker`) that read the `:exploited` and `:superseded` sets, since technique credit no longer needs the proven subset - `transport_ares.go`. - Removed the `aresExploitedToTechniqueIDs` prefix table and its aliases (`driftCategoryAliases`, `driftExemptCategories`), which duplicated ares's own categorisation and drifted from it silently - `transport_ares.go`. - Removed the obsolete tests for the prefix mapping and combined-SMEMBERS parsing (`TestAresExploitedToTechniqueIDs`, `TestSplitExploitedSets`, `TestDriftCategoriesCoverAresTokenCategory`) - `transport_ares_test.go`.
l50
force-pushed
the
feat/credit-techniques-from-ares-token-coverage
branch
from
July 30, 2026 18:03
d1dba78 to
97719b4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key Changes:
token_coveragemap now that ares-cli chore(deps): update pre-commit hook codespell-project/codespell to v2.4.3 dreadnode/DreadGOAD#366 madeExploitedcount only proven techniquesacl_*,gpo_*, andadcs_esc8uncreditable for monthsAdded:
creditableCategories(category-to-answer-key-technique join) anduncreditableCategories(deliberate refusals forother,golden_ticket,printnightmare,zerologon) intransport_ares.go, witharesCategoryToTechniqueIDas the lookup helperwriteTokenCoverageEntriesto emit one deterministic (sorted) finding per creditable category with a proven exploit, deduped against already-emitted findingsTestAresCategoryToTechniqueID,TestAresCreditedTechniquesExistInAnswerKey,TestEveryAresCategoryIsClassified,TestUncreditableCategoriesAreDeliberate,TestNoAresCategoryDrifts,TestWriteTokenCoverageEntries,TestWriteTokenCoverageEntriesIsDeterministic, andTestTokenCoverageEvidenceNamesTheCategoryintransport_ares_test.go, asserting every ares category is exactly one of creditable or refused and that synthesized output stays stable across pollsChanged:
detectTokenCoverageDriftandsynthesizeJSONLnow take only the loot, with drift redefined as "categories neither creditable nor explicitly refused"ares token_coverage: acl_abuse (3 proven)) instead of individual vuln_ids, reflecting thattoken_coverageis aggregatedsynthesizeJSONLcallers inverify_test.goto the single-argument signature and populatedTokenCoveragewhere technique credit was previously injected via the exploited-set sliceRemoved:
fetchExploited,splitExploitedSets, theexploitedSetMarkerconstant, and thearesExploitedToTechniqueIDsprefix table fromtransport_ares.go, along with thedriftCategoryAliasesmap and the olddriftExemptCategoriestableTestAresExploitedToTechniqueIDs,TestSplitExploitedSets,TestAresExploitedTechniquesExistInAnswerKey,TestDriftCategoriesCoverAresTokenCategory, andTestDriftExemptCategoriesAreDeliberate, which pinned the retired prefix-and-Redis approach