detections.yaml

# detections.yaml
schema_version: 1.2

volatility:
  prefer: v3
  v3_binaries: ["vol", "volatility3"]
  v2_binaries: ["vol.py"]

scoring:
  mode: sum               # sum all matched detection weights
  severity_bands:
    - { label: "Informational", max: 1 } # Weight 1
    - { label: "Low",          max: 4 } # Weight 2-4
    - { label: "Medium",       max: 8 } # Weight 5-8
    - { label: "High",         max: 14 } # Weight 9-14
    - { label: "Critical",     max: 999 } # Weight 15+

os_profiles:

  windows:
    plugins:
      - { name: "windows.info",                 format: "text" }
      - { name: "windows.pslist",               format: "csv"  }
      - { name: "windows.psscan",               format: "csv"  }
      - { name: "windows.psxview",              format: "csv"  }
      - { name: "windows.pstree",               format: "txt"  }
      - { name: "windows.cmdline",              format: "csv"  }
      - { name: "windows.netstat",              format: "csv",  fallback: ["windows.netscan"] }
      - { name: "windows.malfind",              format: "text" }
      - { name: "windows.hollowprocesses",      format: "text" }
      - { name: "windows.ldrmodules",           format: "text" }
      - { name: "windows.handles",              format: "text" }
      - { name: "windows.svcscan",              format: "csv" }
      - { name: "windows.scheduled_tasks",      format: "text", fallback: ["windows.registry.scheduled_tasks"] }
      - { name: "windows.filescan",             format: "text" }
      - { name: "windows.registry.printkey",    format: "text" }
      - name: "windows.registry.userassist"
        format: "text"
      - name: "windows.sessions"
        format: "csv"
      - name: "windows.getsids"
        format: "text"
      # --- NEW WINDOWS PLUGINS (kept your earlier adds + appended more) ---
      - { name: "windows.dlllist",              format: "csv"  }
      - { name: "windows.apihooks",             format: "text" }
      - { name: "windows.devicetree",           format: "text" }
      - { name: "windows.modscan",              format: "text" }
      - { name: "windows.consoles",             format: "text" }
      - { name: "windows.clipboard",            format: "text" }
      - { name: "windows.registry.shimcache",   format: "csv"  }
      - { name: "windows.registry.amcache",     format: "csv"  }
      - { name: "windows.envars",               format: "text" }
      # --- ADDITIONAL PLUGINS TO ENABLE NEW DETECTIONS ---
      - { name: "windows.ssdt",                 format: "text" }
      - { name: "windows.callbacks",            format: "text" }
      - { name: "windows.iat",                  format: "text" }
      - { name: "windows.vadinfo",              format: "text" }
      - { name: "windows.vadwalk",              format: "text" }
      - { name: "windows.suspicious_threads",   format: "text" }
      - { name: "windows.suspended_threads",    format: "text" }
      - { name: "windows.thrdscan",             format: "text" }
      - { name: "windows.netscan",              format: "csv"  }
      - { name: "windows.verinfo",              format: "csv"  }
      - { name: "windows.strings",              format: "text" }
      - { name: "windows.modules",              format: "text" }
      - { name: "windows.registry.hivelist",    format: "text" }
      - { name: "windows.registry.hivescan",    format: "text" }
      - { name: "windows.registry.getcellroutine", format: "text" }
      - { name: "windows.statistics",           format: "text" }
      - { name: "windows.pedump",               format: "text" }
      - { name: "windows.shimcachemem",         format: "text" }

    engines:
      - engine_id: network_enrichment
        description: Enriches network connections with geographic and reputation data.

    detections:

      - id: correlation_persistence_execution
        title: High-Confidence Threat (Persistence + Execution)
        narrative: "This is a critical finding! Multiple clues strongly suggest an attacker has successfully gained a persistent foothold on the system and has executed malicious code. This indicates a serious compromise where the attacker can likely maintain access and access and perform further actions."
        mitre: ["T1543.003", "T1053", "T1059", "TA0002", "T1547.001"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["scheduled_tasks_suspicious", "services_suspicious", "registry_run_key_persistence"]
              secondary_ids: ["unknown_process_name", "exec_from_tmp", "filescan_suspicious_names", "suspicious_cmdline_args", "unusual_parent_child"]

      - id: correlation_cred_access_injection
        title: High-Confidence Threat (Credential Access + Injection)
        narrative: "This finding is highly critical. A malicious program likely injected itself into a legitimate process (like LSASS) to steal user credentials. This is a crucial step for attackers to move deeper into your network or access sensitive information."
        mitre: ["T1003.001", "T1055"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["handles_lsass_access"]
              secondary_ids: ["malfind_injection", "unknown_process_name", "suspicious_cmdline_args"]

      - id: correlation_evasion_network
        title: High-Confidence Threat (Evasion + Network Activity)
        narrative: "This is a severe threat. The attacker is actively trying to hide their malicious activities while also communicating with external servers. This strongly suggests an active 'Command and Control' (C2) channel, meaning the attacker is remotely controlling the compromised system."
        mitre: ["T1055", "T1071", "TA0011"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["psxview_hidden", "malfind_injection", "ldr_unlinked_module"]
              secondary_ids: ["suspicious_connection", "suspicious_network_enrichment", "suspicious_port_activity"]

      # --- NEW CORRELATION RULES ---
      - id: correlation_kernel_rootkit
        title: High-Confidence Threat (Kernel Rootkit Detected)
        narrative: "This is a critical finding. Multiple indicators point to a kernel-level rootkit actively hiding processes, drivers, or system modifications. The attacker has deep control over the system, making detection difficult without specialized tools."
        mitre: ["T1014", "T1562.001"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["ssdt_hooks_suspicious", "kernel_callbacks_suspicious", "registry_getcellroutine_hooked", "modules_hidden_vs_modscan"]
              secondary_ids: ["psxview_hidden", "ldr_unlinked_module", "registry_orphan_hives"]

      - id: correlation_evasive_execution
        title: High-Confidence Threat (Evasive Execution and Hiding)
        narrative: "A highly evasive threat was detected. This finding correlates execution from unusual locations with advanced techniques like IAT redirection or VAD anomalies, suggesting an attacker is actively executing code while trying to avoid detection."
        mitre: ["T1055", "T1036"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["vad_exec_private", "iat_redirection", "threads_start_outside_module"]
              secondary_ids: ["unknown_process_name", "exec_from_tmp", "suspicious_cmdline_args", "verinfo_mismatch"]

      # --- Network Related Detections (Critical - Weight: 15) ---
      - id: suspicious_network_malicious_ip
        title: Network connections to malicious IPs
        narrative: "The system is communicating with known malicious IP addresses, which are often associated with cybercriminals or hostile infrastructure. This is a very strong sign of an active compromise, potentially for Command and Control (C2) or data theft."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: network_enrichment
        enabled: true
        evidence_fields: ["ip", "country", "isp", "reputation"]
        params:
          allow_cidrs_ref: "baseline.network.allow_cidrs"
        logic:
          - rule_id: malicious_reputation
            match: [{ field: "reputation", value: "Malicious", operator: "==" }]
          - rule_id: suspicious_reputation
            match: [{ field: "reputation", value: "Suspicious", operator: "==" }]

      - id: suspicious_network_enrichment
        title: Network connections to suspicious foreign locations
        narrative: "The system is communicating with IP addresses located in countries identified as suspicious. While not inherently malicious, traffic to these locations can indicate unauthorized activity, data exfiltration, or communication with command and control infrastructure in high-risk regions."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: network_enrichment
        enabled: true
        evidence_fields: ["ip", "country", "isp", "reputation"]
        params:
          allow_cidrs_ref: "baseline.network.allow_cidrs"
        logic:
          - rule_id: suspicious_location_ru
            match: [{ field: country, value: "RU" }]
          - rule_id: suspicious_location_cn
            match: [{ field: country, value: "CN" }]
          - rule_id: suspicious_location_kp
            match: [{ field: country, value: "KP" }]
          - rule_id: suspicious_location_ir
            match: [{ field: country, value: "IR" }]
          - rule_id: suspicious_location_cu
            match: [{ field: country, value: "CU" }]

      - id: suspicious_connection
        title: Suspicious external connection (non-whitelisted)
        narrative: "An unexpected network connection to a server outside your trusted network was found. This could indicate an an attacker communicating with a remote server for control, data exfiltration, or downloading more malicious tools."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: suspicious_connection
        enabled: true
        evidence_fields: ["pid","owner","ForeignAddr","ForeignPort","LocalAddr","LocalPort","State"]
        params:
          allow_cidrs_ref: "baseline.network.allow_cidrs"
          allow_ports_ref: "baseline.network.allow_ports"
          plugin_preference: ["windows.netstat", "windows.netscan"]

      - id: suspicious_port_activity
        title: Suspicious port activity (known bad ports)
        narrative: "Network connections are using ports that are commonly associated with malware, backdoors, or unauthorized communication. Attackers often use non-standard or obscure ports to evade detection."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: suspicious_port_activity
        enabled: true
        evidence_fields: ["pid", "owner", "Proto", "LocalPort", "ForeignPort"]
        params:
          suspicious_ports: [31337, 4444, 1337, 8888, 9999, 10000, 6881, 6969, 2222]

      # --- Confirmed Detections (High - Weight: 10) ---
      - id: psxview_hidden
        title: Hidden or unlinked process (psxview mismatch)
        narrative: "A running program is actively attempting to hide its presence from standard system monitoring tools. This is a strong indicator of rootkit activity or other advanced evasion techniques used by malware to remain undetected."
        mitre: ["T1055", "T1068"]
        weight: 10
        engine: psxview_hidden
        enabled: true
        evidence_fields: ["pid","name","pslist","psscan","thrdscan","csrss"]

      - id: handles_lsass_access
        title: LSASS access by non-system process (credential dumping)
        narrative: "A program that is not part of the core operating system is accessing sensitive memory belonging to the Local Security Authority Subsystem Service (LSASS). This is highly indicative of an attempt to steal user credentials (usernames and passwords), which attackers use to move laterally in a network."
        mitre: ["T1003.001"]
        weight: 10
        engine: handles_dangerous_access
        enabled: true
        evidence_fields: ["requestor_pid","requestor_name","target_pid","target_name","GrantedAccess"]
        params:
          target_process_regex: "(?i)^lsass\\.exe$"
          access_regex: "(?i)(PROCESS_VM_(READ|WRITE)|PROCESS_VM_OPERATION|PROCESS_QUERY_(INFORMATION|LIMITED_INFORMATION)|WRITE_DAC|WRITE_OWNER|DUP_HANDLE)"

      - id: malfind_injection
        title: Code injection indicators (malfind)
        narrative: "Malicious code or shellcode was found secretly injected into the memory space of a legitimate program. This is a common technique used by malware to execute hidden code, bypass security controls, and often to perform stealthy actions without being detected."
        mitre: ["T1055"]
        weight: 10
        engine: malfind_injection
        enabled: true
        evidence_fields: ["pid","process","Start","Protection","PrivateMemory","Notes"]
        params:
          keywords: ["mimikatz", "invoke-mimikatz", "meterpreter", "cobalt", "beacon", "powershell -enc"]

      - id: hollowed_process
        title: Hollowed process detected
        narrative: "A legitimate program (process) has had its original memory content entirely replaced with malicious code. This technique, known as 'process hollowing,' is used by advanced malware to disguise itself as a trusted process and evade detection."
        mitre: ["T1055.012"]
        weight: 10
        engine: hollowed_process
        enabled: true
        evidence_fields: ["pid","process","Details"]
        params:
          keywords: ["svchost.exe", "explorer.exe"]

      - id: ldr_unlinked_module
        title: Unlinked or mapped module anomaly (LdrModules)
        narrative: "A loaded program component (DLL or module) is hidden from standard system lists or loaded in an unusual way. This is a common tactic for stealthy code execution and evasion by malware, making it harder for security tools to see what's running."
        mitre: ["T1055", "T1574"]
        weight: 10
        engine: ldr_unlinked_module
        enabled: true
        evidence_fields: ["pid","process","Base","Path","InLoad","InInit","InMem"]
        params:
          temp_like_paths:
            - "\\\\temp\\\\"
            - "\\\\appdata\\\\"
            - "\\\\users\\\\[^\\\\]+\\\\downloads\\\\"
            - "\\\\recycle"

      # --- NEW High / Medium Detections (added; schema unchanged) ---
      - id: ssdt_hooks_suspicious
        title: Suspicious SSDT hooks (kernel tampering)
        narrative: "System call table entries point outside expected kernel modules. This strongly suggests kernel-level hooking by rootkits or EDR tampering."
        mitre: ["T1014","T1562.001"]
        weight: 10
        engine: windows_ssdt_hooks
        enabled: true
        evidence_fields: ["Index","Table","Target","OwnerModule","Notes"]
        params:
          allowed_modules_regex: "(?i)(ntoskrnl|win32k|ntkrnl|hal)\\.sys"

      - id: kernel_callbacks_suspicious
        title: Suspicious kernel callbacks
        narrative: "Unexpected or duplicate kernel callbacks for process/thread/image/registry notifications owned by unknown or unsigned drivers."
        mitre: ["T1014","T1562.001"]
        weight: 10
        engine: windows_callbacks_suspicious
        enabled: true
        evidence_fields: ["Type","Callback","OwnerModule"]
        params:
          known_good_modules_regex: "(?i)(ntoskrnl|win32k|hal|fltmgr|ndis|tcpip)\\.sys"

      - id: iat_redirection
        title: IAT redirection to non-module memory
        narrative: "Import Address Table entries resolved to regions not backed by expected modules, indicating inline hooks or userland patching."
        mitre: ["T1055","T1562.001"]
        weight: 10
        engine: iat_redirection
        enabled: true
        evidence_fields: ["pid","process","Module","Function","ResolvedTo","RegionType"]

      - id: vad_exec_private
        title: Executable private memory regions (VAD)
        narrative: "Private RX/RWX memory regions strongly suggest code injection or unpacked payloads."
        mitre: ["T1055"]
        weight: 10
        engine: vad_private_rx
        enabled: true
        evidence_fields: ["pid","process","Start","End","Protection","Tag","File"]
        params:
          require_executable: true

      - id: threads_start_outside_module
        title: Thread start address outside loaded modules
        narrative: "Threads starting in unmapped memory or outside image sections are indicative of shellcode execution."
        mitre: ["T1055"]
        weight: 10
        engine: threads_start_outside_module
        enabled: true
        evidence_fields: ["pid","process","ThreadId","StartAddress","ModuleAtStart"]

      - id: netscan_beacon_like
        title: Beacon-like network pattern
        narrative: "Outbound connections from unusual processes to remote hosts/ports consistent with C2 beaconing."
        mitre: ["T1071"]
        weight: 10
        engine: netscan_beacon_like
        enabled: true
        evidence_fields: ["pid","owner","LocalAddr","LocalPort","ForeignAddr","ForeignPort","State"]
        params:
          suspicious_process_regex: "(?i)(rundll32|regsvr32|wmic|mshta|powershell|wscript|cscript|certutil|cmd)\\.exe"

      - id: verinfo_mismatch
        title: PE version info mismatch
        narrative: "Product/Company fields do not match filename or path, or missing version info for binaries in system directories."
        mitre: ["T1036"]
        weight: 5
        engine: verinfo_mismatch
        enabled: true
        evidence_fields: ["pid","process","Path","CompanyName","ProductName","FileDescription"]
        params:
          system_dir_regex: "(?i)\\\\windows\\\\(system32|syswow64)\\\\"

      - id: strings_sensitive_iocs
        title: Sensitive IOCs in process memory (strings)
        narrative: "Credentials, toolnames, URLs, or encoded commands found in process memory; attributed to owning PID."
        mitre: ["T1552","T1105","T1059"]
        weight: 5
        engine: strings_ioc_match
        enabled: true
        evidence_fields: ["pid","process","Offset","String"]
        params:
          patterns:
            - "(?i)password="
            - "(?i)Authorization:"
            - "(?i)Invoke-"
            - "(?i)mimikatz"
            - "(?i)(http|https)://[a-z0-9\\.-]+"
            - "(?i)\\b[A-Za-z0-9+/=]{20,}\\b"

      - id: modules_hidden_vs_modscan
        title: Hidden kernel modules (list vs scan)
        narrative: "Modules found by pool scan (modscan) but not in module list indicate hidden drivers/rootkits."
        mitre: ["T1014"]
        weight: 10
        engine: modules_vs_modscan_diff
        enabled: true
        evidence_fields: ["Module","Base","PresentInList","PresentInScan"]

      - id: registry_getcellroutine_hooked
        title: Registry hive GetCellRoutine hook
        narrative: "Hooked registry GetCellRoutine indicates registry virtualization/tampering to hide keys/values."
        mitre: ["T1112","T1562.001"]
        weight: 10
        engine: registry_getcellroutine_hook
        enabled: true
        evidence_fields: ["Hive","Status","HookTarget"]

      - id: registry_orphan_hives
        title: Orphan or hidden registry hives (hivescan)
        narrative: "Hives present by scan but not by list-walk suggest hidden/off-book configuration or persistence."
        mitre: ["T1112","T1014"]
        weight: 5
        engine: registry_orphan_hives
        enabled: true
        evidence_fields: ["HivePath","Offset","PresentInList"]

      - id: statistics_profile_anomaly
        title: System statistics anomaly vs baseline
        narrative: "Unusual counts of processes/threads/handles or memory profile outliers for the OS build; may indicate staging or tampering."
        mitre: ["TA0005"]
        weight: 2
        engine: statistics_baseline_anomaly
        enabled: true
        evidence_fields: ["Metric","Value","ExpectedRange"]

      # --- Probable Detections (Medium - Weight: 5) ---
      - id: suspicious_cmdline_args
        title: Process with suspicious command-line arguments
        narrative: "A program is running with unusual or encoded instructions (command-line arguments). These arguments are often used by malware for stealthy execution, to download additional tools, or to bypass security features without being easily recognized."
        mitre: ["T1059", "T1036"] # Execution, Masquerading
        weight: 5
        engine: suspicious_cmdline
        enabled: true
        evidence_fields: ["pid", "name", "command_line"]
        params:
          suspicious_keywords:
            - "-enc" # PowerShell encoded command
            - "-nop" # PowerShell NoProfile
            - "-w hidden" # Hidden window
            - "IEX" # Invoke-Expression
            - "Invoke-" # Common for PowerShell scripts
            - "powershell.exe -c"
            - "cmd.exe /c"
            - "regsvr32 /s /u /i:" # For Squiblydoo
            - "mshta.exe" # For HTML Application attacks
            - "[System.Convert]::FromBase64String"
            - "http://" # Suspicious direct HTTP downloads
            - "https://" # Suspicious direct HTTPS downloads
            - "/c " # Generic cmd.exe execution
            - "bitsadmin /transfer" # BITSAdmin for downloads
            - "wmic process call create" # WMIC for process creation

      - id: registry_run_key_persistence
        title: Suspicious entry in Run/RunOnce registry keys
        narrative: "An unusual program is configured to automatically launch every time the system starts up or a user logs in. This is a very common method used by malware to maintain persistent access and ensure it runs after a reboot."
        mitre: ["T1547.001", "T1059"] # Boot or Logon Autostart Execution, Command and Scripting Interpreter
        weight: 5
        engine: registry_printkey_matches
        enabled: true
        evidence_fields: ["Key", "Name", "Decoded"]
        params:
          keys:
            - 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'
            - 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'
            - 'Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run'
            - 'Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run'
            - 'Software\\Microsoft\\Windows\\CurrentVersion\\RunServices'
            - 'Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run'
            - 'Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce'
          value_regex: "(?i)(exe|dll|js|vbs|ps1|bat|cmd|hta|py|vbe|jse)" # Look for common executable/script extensions

      - id: unknown_process_name
        title: Unknown process image (not in baseline)
        narrative: "A program is running on the system that is not recognized as a standard or approved process from your baseline. This could indicate the presence of unauthorized software, malware, or a custom tool deployed by an attacker."
        mitre: ["T1059", "TA0002"]
        weight: 5
        engine: unknown_process_name
        enabled: true
        evidence_fields: ["pid","name","path"]
        params:
          process_whitelist_ref: "baseline.process_whitelist"

      - id: unusual_parent_child
        title: Suspicious parent–child process relationship
        narrative: "A command shell process (cmd.exe) was launched by a parent process other than the standard Windows explorer.exe or other common shells. This could indicate malicious activity, such as an attacker executing commands directly from a compromised application or a service, bypassing standard user interaction."
        mitre: ["T1059.003", "T1059.004"]
        weight: 5
        engine: parent_child_analysis
        enabled: true
        evidence_fields: ["parent_name", "parent_pid", "child_name", "child_pid", "command_line"]
        params:
          child_process: "cmd.exe"
          known_good_parents:
            - "explorer.exe"
            - "cmd.exe"
            - "powershell.exe"
            - "wscript.exe"
            - "cscript.exe"
            - "taskeng.exe"
            - "setup.exe"
            - "msiexec.exe"

      - id: services_suspicious
        title: Suspicious service ImagePath (user-writable path or unknown)
        narrative: "A system service is configured to run its executable from a suspicious, user-writable, or unusual location. This is a common method for malware to establish persistence and ensure it starts with the system, often disguised as a legitimate service."
        mitre: ["T1543.003", "T1053"]
        weight: 5
        engine: services_suspicious
        enabled: true
        evidence_fields: ["ServiceName","ServiceType","ImagePath","Start","Pid"]
        params:
          temp_like_paths:
            - "\\\\temp\\\\"
            - "\\\\appdata\\\\"
            - "\\\\users\\\\[^\\\\]+\\\\downloads\\\\"
            - "\\\\programdata\\\\.*\\\\temp"
            - "\\\\windows\\\\temp"
            - "\\\\public\\\\"

      - id: scheduled_tasks_suspicious
        title: Suspicious scheduled task (script in user-writable path)
        narrative: "A task is set to automatically run at specific times, but it launches a script or program from a suspicious or user-writable location. This is a common method for attackers to maintain persistence on a system, ensuring their malicious code is executed regularly."
        mitre: ["T1053.005"]
        weight: 5
        engine: scheduled_tasks_suspicious
        enabled: true
        evidence_fields: ["TaskName","ImagePath","Arguments","User"]
        params:
          temp_like_paths:
            - "\\\\temp\\\\"
            - "\\\\appdata\\\\"
            - "\\\\users\\\\[^\\\\]+\\\\downloads\\\\"
            - "\\\\programdata\\\\.*\\\\temp"
          risky_exts: ["js","jse","vbs","vbe","ps1","bat","cmd","hta","py","dll","exe"]

      - id: userassist_suspicious
        title: UserAssist indicates suspicious GUI-launched items
        narrative: "Windows keeps a record of programs launched by the user through the graphical interface. This finding indicates a suspicious program (like a command prompt or PowerShell) was run directly by a user, which can suggest malicious activity or an attacker directly interacting with the system."
        mitre: ["T1059", "T1204"]
        weight: 5
        engine: userassist_suspicious
        enabled: true
        evidence_fields: ["Path","Count","LastUpdated"]
        params:
          any_path_contains: ["powershell","cmd.exe","wscript","cscript","regsvr32","rundll32",".py",".vbs",".js","mshta","certutil","bitsadmin"]

      - id: sessions_anomalous
        title: Anomalous logon session or SID usage
        narrative: "An unusual or suspicious user logon session was detected. This could indicate unauthorized access, an attacker attempting to blend in, or a legitimate account being misused for malicious purposes to move around the network."
        mitre: ["T1078","T1550"]
        weight: 5
        engine: sessions_anomalous
        enabled: true
        evidence_fields: ["SessionId","User","AuthPackage","LogonType","Pid","Process"]
        params:
          suspicious_auth_packages: ["NTLM", "Negotiate", "Kerberos"]
          ignore_users_ref: "baseline.sessions.ignore_users"

      - id: filescan_suspicious_names
        title: Suspicious files in memory (temp/downloads/deleted)
        narrative: "Files with suspicious names or in unusual locations (like temporary folders or downloads) were found in the system's memory. This often indicates that an attacker has staged tools, scripts, or sensitive data on the system, including files that might have been deleted from disk but are still active."
        mitre: ["T1105","T1106"]
        weight: 2
        engine: filescan_path_match
        enabled: true
        evidence_fields: ["Offset","Path"]
        params:
          any_path_contains:
            - "\\\\users\\\\[^\\\\]+\\\\desktop\\\\"
            - "\\\\temp\\\\"
            - "\\\\appdata\\\\local\\\\temp\\\\"
            - "\\\\downloads\\\\"
            - "(deleted)"
            - "\\\\programdata\\\\"
          any_file_ext: ["py","py.txt","ps1","vbs","js","exe","bat","cmd","hta","vbe","jse"]
          any_name_contains: ["mimikatz","invoke-","meterpreter","cobalt","beacon","powershell",
                               "secret","password","loot","dump","creds","nc.exe","privesc",
                               "psexec","sccm","certutil","bitsadmin","lazagne","procdump",
                               "sharp","rce","exploit","backdoor","shellcode","stager"]

      - id: registry_recentdocs_py_exe
        title: RecentDocs shows scripts/binaries of interest
        narrative: "Windows tracks recently accessed documents and applications. This finding shows that suspicious script or executable files were recently opened or interacted with by a user, which could indicate a user running malicious content or an attacker preparing for execution."
        mitre: ["T1105","T1059"]
        weight: 2
        engine: registry_printkey_match
        enabled: true
        evidence_fields: ["Hive","Key","Name","Decoded"]
        params:
          keys:
            - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.py'
            - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.exe'
            - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.js'
            - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.vbs'
            - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.ps1'
          value_regex: "(?i)(evil|demon|mimikatz|nc\\.(exe|ps1)|powershell -enc|vip\\.txt|cobalt|beacon|c2|payload|exploit|backdoor|shellcode|stager)"

      - id: handles_dangerous_access
        title: Dangerous process/thread handle access (general)
        narrative: "A program has obtained unusually powerful or dangerous access rights to another running program or its internal components. This could mean it's trying to manipulate or inject code into a legitimate process, which is a common technique for malware to hide or elevate privileges."
        mitre: ["T1055", "T1106"]
        weight: 2
        engine: handles_dangerous_access
        enabled: true
        evidence_fields: ["requestor_pid","requestor_name","target_pid","target_name","GrantedAccess"]
        params:
          access_regex: "(?i)(WRITE_DAC|WRITE_OWNER|DELETE|PROCESS_VM_WRITE|PROCESS_VM_OPERATION|PROCESS_QUERY_(INFORMATION|LIMITED_INFORMATION)|THREAD_SET_CONTEXT)"

      - id: dumpit_present
        title: Memory acquisition tool present (informational)
        narrative: "A memory acquisition tool (like DumpIt or WinPMEM) was detected on the system. While these tools are legitimate for forensic purposes, attackers can also use them to collect sensitive data (like credentials) from memory for later analysis."
        mitre: ["TA0007"]
        weight: 12
        engine: filescan_path_match
        enabled: true
        evidence_fields: ["Offset","Path"]
        params:
          any_name_contains: ["dumpit.exe","winpmem","ramcapture","fmem"]

      # --- NEW Windows Detection Rules ---
      - id: exec_from_tmp
        title: Process executing from temporary/user-writable directory
        narrative: "A process is running from a temporary or user-writable directory (e.g. %TEMP%, %APPDATA%, Downloads). Legitimate applications rarely execute from these paths. This is a very common staging technique used by malware after initial delivery."
        mitre: ["T1204", "T1036.005"]
        weight: 10
        engine: exec_from_tmp
        enabled: true
        evidence_fields: ["pid", "name", "path"]
        params:
          temp_like_paths:
            - "\\\\temp\\\\"
            - "\\\\appdata\\\\"
            - "\\\\users\\\\[^\\\\]+\\\\downloads\\\\"
            - "\\\\programdata\\\\.*\\\\temp"
            - "\\\\windows\\\\temp"
            - "\\\\public\\\\"

      - id: lsass_credential_dump
        title: LSASS credential dump tool or pattern detected
        narrative: "A command line or injected memory region matches known credential dumping tools or patterns targeting LSASS. This strongly indicates an attacker is attempting to harvest credentials for lateral movement or privilege escalation."
        mitre: ["T1003.001", "T1059"]
        weight: 15
        engine: lsass_credential_dump
        enabled: true
        evidence_fields: ["pid", "name", "command_line", "Notes"]

      - id: entropy_anomaly
        title: High-entropy executable memory (packed shellcode)
        narrative: "Private memory regions with executable permissions show abnormally high Shannon entropy, strongly suggesting packed, encrypted, or obfuscated shellcode. Legitimate code typically has much lower entropy."
        mitre: ["T1055", "T1027"]
        weight: 10
        engine: entropy_anomaly
        enabled: true
        evidence_fields: ["pid", "process", "Start", "End", "Protection", "Entropy", "Notes"]
        params:
          threshold: 7.0

      # ── Modern Attack Technique Detections ────────────────────────────────

      - id: amsi_bypass
        title: AMSI bypass attempt detected
        narrative: "A process is attempting to disable or patch the Anti-Malware Scan Interface (AMSI), which would blind security products from inspecting PowerShell and script execution. This is a critical prerequisite step for running malicious scripts undetected, commonly seen in fileless malware and advanced adversary toolkits."
        mitre: ["T1562.001", "T1027", "T1059.001"]
        weight: 10
        engine: amsi_bypass
        enabled: true
        evidence_fields: ["pid", "name", "command_line", "pattern", "Notes"]

      - id: etw_patching
        title: ETW or audit-log disablement detected
        narrative: "Event Tracing for Windows (ETW) or Windows Event Log service is being patched, cleared, or disabled. Attackers do this to blind detection tools and remove forensic evidence of their activity. Clearing event logs before or during an attack is a well-known defense evasion technique."
        mitre: ["T1562.001", "T1070.001", "T1070.002"]
        weight: 8
        engine: etw_patching
        enabled: true
        evidence_fields: ["pid", "name", "command_line", "pattern", "Notes"]

      - id: token_impersonation
        title: Token impersonation / privilege theft detected
        narrative: "A non-system process is holding a Token handle with impersonation or duplication rights. Token impersonation allows an attacker to execute code under a different user's identity — typically SYSTEM or a domain admin — without knowing their credentials. This is a key privilege escalation technique."
        mitre: ["T1134", "T1134.001", "T1134.002"]
        weight: 10
        engine: token_impersonation
        enabled: true
        evidence_fields: ["pid", "name", "access_mask", "Notes"]

      - id: lateral_movement_ports
        title: Lateral movement network activity (SMB/WinRM/RPC)
        narrative: "A non-system process is making outbound connections on ports commonly used for lateral movement: SMB (445), WinRM (5985/5986), or DCOM/RPC (135). These are the same protocols abused by PsExec, WMI remote execution, and 'Pass-the-Hash' attacks to spread through the network."
        mitre: ["T1021.002", "T1021.006", "T1021.003", "T1550.002"]
        weight: 8
        engine: lateral_movement_ports
        enabled: true
        evidence_fields: ["pid", "name", "ForeignAddr", "ForeignPort", "State", "Notes"]

      - id: wmi_suspicious_spawn
        title: WMI or MMC spawning suspicious child process
        narrative: "WmiPrvSE.exe (Windows WMI Provider) or mmc.exe is spawning command shells, script interpreters, or utility binaries. This is a hallmark of remote WMI execution (wmic /node:, Invoke-WmiMethod) — an attacker's common method for lateral movement and remote code execution that bypasses many endpoint controls."
        mitre: ["T1047", "T1059", "T1218"]
        weight: 8
        engine: wmi_suspicious_spawn
        enabled: true
        evidence_fields: ["pid", "name", "parent_pid", "parent_name", "Notes"]

      - id: lolbin_enhanced
        title: Living-off-the-Land binary abuse (targeted patterns)
        narrative: "A signed Windows binary is being used in a way consistent with known attack techniques: certutil as a download tool, mshta loading remote HTML applications, rundll32 running JavaScript, regsvr32 loading remote scriptlets (Squiblydoo), or msiexec installing remote packages. These patterns go far beyond normal administrative use."
        mitre: ["T1218.001", "T1218.003", "T1218.005", "T1218.007", "T1218.010", "T1218.011", "T1105", "T1047"]
        weight: 8
        engine: lolbin_enhanced
        enabled: true
        evidence_fields: ["pid", "name", "command_line", "lolbin", "Notes"]

      - id: archive_staging
        title: Archive file staged in suspicious location (pre-exfiltration)
        narrative: "Archive files (zip, rar, 7z, tar) were found in temporary directories, the user's Desktop, or Downloads folder. Attackers commonly compress and archive sensitive data immediately before exfiltrating it. The presence of unexpected archives in these locations — especially alongside outbound connections — is a strong exfiltration indicator."
        mitre: ["T1560.001", "T1074.001"]
        weight: 5
        engine: archive_staging
        enabled: true
        evidence_fields: ["Offset", "Path", "Notes"]

      - id: exfil_connections
        title: Suspicious high-volume outbound connections (data exfiltration)
        narrative: "A non-browser process has five or more simultaneous established outbound connections to external IP addresses. Legitimate applications rarely maintain this many concurrent external connections. This pattern is consistent with data exfiltration via multiple upload streams or a C2 beacon maintaining redundant connections."
        mitre: ["T1041", "T1048", "T1071.001"]
        weight: 7
        engine: exfil_connections
        enabled: true
        evidence_fields: ["pid", "name", "connection_count", "unique_ips", "sample_ips", "Notes"]

      # ── New Correlation Rules (Modern Techniques) ──────────────────────────

      - id: correlation_evasion_priv_esc
        title: High-Confidence Threat (Evasion + Privilege Escalation)
        narrative: "This is a severe finding. Security tool blinding (AMSI bypass or ETW patching) is combined with privilege escalation indicators (token impersonation or process injection). The attacker is simultaneously disabling detection and gaining elevated privileges — a pattern consistent with advanced ransomware and APT post-exploitation toolkits."
        mitre: ["T1562.001", "T1134", "T1027", "T1055"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["amsi_bypass", "etw_patching"]
              secondary_ids: ["token_impersonation", "malfind_injection", "handles_lsass_access"]

      - id: correlation_lolbin_chain
        title: High-Confidence Threat (LOLBin Execution Chain)
        narrative: "LOLBin abuse is chained with persistence or network activity. A trusted Windows binary is being weaponized for execution, followed by persistence mechanisms or C2 communication. This multi-stage pattern is characteristic of fileless malware and living-off-the-land attacks that deliberately avoid touching disk with malicious files."
        mitre: ["T1218", "T1071", "T1547.001", "T1053"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["lolbin_enhanced", "wmi_suspicious_spawn"]
              secondary_ids: ["suspicious_connection", "netscan_beacon_like", "registry_run_key_persistence", "scheduled_tasks_suspicious"]

      - id: correlation_exfil_chain
        title: High-Confidence Threat (Data Staging + Exfiltration)
        narrative: "Archive creation is correlated with high-volume outbound connections or suspicious network activity. This chain — compress data then upload — is a textbook data theft pattern. The combination strongly suggests an attacker is actively exfiltrating collected data to external infrastructure."
        mitre: ["T1560.001", "T1041", "T1048", "T1074"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["archive_staging"]
              secondary_ids: ["exfil_connections", "suspicious_connection", "suspicious_network_enrichment"]

      # --- NEW Correlation Rules ---
      - id: correlation_lateral_movement
        title: High-Confidence Threat (Lateral Movement Indicators)
        narrative: "Multiple indicators suggest active lateral movement. Suspicious network connections combined with credential access or unusual process relationships strongly suggest the attacker is pivoting through the network."
        mitre: ["T1021", "T1078", "T1550"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["handles_lsass_access", "lsass_credential_dump", "malfind_injection"]
              secondary_ids: ["suspicious_connection", "suspicious_network_enrichment", "netscan_beacon_like"]

      - id: correlation_credential_dumping
        title: High-Confidence Threat (Credential Dumping Chain)
        narrative: "This is a critical finding. Evidence shows a coordinated credential theft attack: a tool or injected code is targeting LSASS memory, combined with process injection or file-based staging. The attacker is likely harvesting credentials to escalate privileges or move laterally."
        mitre: ["T1003.001", "T1055", "T1105"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["lsass_credential_dump", "handles_lsass_access"]
              secondary_ids: ["malfind_injection", "exec_from_tmp", "filescan_suspicious_names", "entropy_anomaly"]

      - id: correlation_defense_evasion
        title: High-Confidence Threat (Defense Evasion Chain)
        narrative: "Multiple defense evasion techniques are being used simultaneously. Hidden processes, unlinked modules, and high-entropy memory together indicate a sophisticated attacker actively working to avoid detection while maintaining access."
        mitre: ["T1014", "T1027", "T1055", "T1036"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["psxview_hidden", "ldr_unlinked_module", "entropy_anomaly"]
              secondary_ids: ["verinfo_mismatch", "exec_from_tmp", "unusual_parent_child", "malfind_injection"]

      - id: correlation_discovery
        title: High-Confidence Threat (Active Discovery + Staging)
        narrative: "A process is exhibiting discovery behavior combined with staging artifacts. Suspicious command lines performing enumeration (whoami, ipconfig, net) alongside files staged in temporary locations suggest an attacker is actively mapping the environment before their next move."
        mitre: ["T1082", "T1057", "T1105", "T1059"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["suspicious_cmdline_args", "userassist_suspicious"]
              secondary_ids: ["exec_from_tmp", "filescan_suspicious_names", "registry_run_key_persistence", "scheduled_tasks_suspicious"]

  linux:
    plugins:
      - { name: "linux.pslist",          format: "csv"  }
      - { name: "linux.psscan",          format: "csv"  }
      - { name: "linux.psaux",           format: "text" }
      - { name: "linux.lsof",            format: "text" }
      - { name: "linux.sockstat",        format: "text" }
      - { name: "linux.check_syscall",   format: "text" }
      - { name: "linux.check_modules",   format: "text" }
      - { name: "linux.bash",            format: "text" }
      # --- NEW LINUX PLUGINS ---
      - { name: "linux.envars",          format: "text" }
      - { name: "linux.librarylist",     format: "text" }
      - { name: "linux.lsmod",           format: "text" }
      - { name: "linux.bash",            format: "text" }
      - { name: "linux.lsof",            format: "csv" }
      - { name: "linux.sockstat",        format: "csv" }
      - { name: "linux.check_syscall",   format: "text" }
      - { name: "linux.check_modules",   format: "text" }

    detections:
      - id: suspicious_network_malicious_ip
        title: Network connections to malicious IPs
        narrative: "The system is communicating with known malicious IP addresses, which are often associated with cybercriminals or hostile infrastructure. This is a very strong sign of an active compromise, potentially for Command and Control (C2) or data theft."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: network_enrichment
        enabled: true
        evidence_fields: ["ip", "country", "isp", "reputation"]
        params:
          allow_cidrs_ref: "baseline.network.allow_cidrs"
        logic:
          - rule_id: malicious_reputation
            match:
              - field: "reputation"
                value: "Malicious"
                operator: "=="
          - rule_id: suspicious_reputation
            match:
              - field: "reputation"
                value: "Suspicious"
                operator: "=="

      - id: suspicious_network_enrichment
        title: Network connections to suspicious foreign locations
        narrative: "The system is communicating with IP addresses located in countries identified as suspicious. While not inherently malicious, traffic to these locations can indicate unauthorized activity, data exfiltration, or communication with command and control infrastructure in high-risk regions."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: network_enrichment
        enabled: true
        evidence_fields: ["ip", "country", "isp", "reputation"]
        params:
          allow_cidrs_ref: "baseline.network.allow_cidrs"
        logic:
          - rule_id: suspicious_location_ru
            match: [{ field: country, value: "RU" }]
          - rule_id: suspicious_location_cn
            match: [{ field: country, value: "CN" }]
          - rule_id: suspicious_location_kp
            match: [{ field: country, value: "KP" }]
          # FR and BE removed — NATO allies, generates excessive false positives
          - rule_id: suspicious_location_ir
            match: [{ field: country, value: "IR" }]
          - rule_id: suspicious_location_cu
            match: [{ field: country, value: "CU" }]

      - id: suspicious_connection
        title: Suspicious external connection
        narrative: "An unexpected network connection to a server outside your trusted network was found. This could indicate an attacker communicating with a remote server for control, data exfiltration, or downloading more malicious tools."
        mitre: ["T1071","TA0011"]
        weight: 15
        engine: suspicious_connection
        enabled: true
        evidence_fields: ["pid","owner","ForeignAddr","ForeignPort","LocalAddr","LocalPort","State"]
        params:
          allow_cidrs_ref: "baseline.network.allow_cidrs"
          allow_ports_ref: "baseline.network.allow_ports"
          
      - id: suspicious_port_activity
        title: Suspicious port activity (known bad ports)
        narrative: "Network connections are using ports that are commonly associated with malware, backdoors, or unauthorized communication. Attackers often use non-standard or obscure ports to evade detection."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: suspicious_port_activity
        enabled: true
        evidence_fields: ["pid", "owner", "Proto", "LocalPort", "ForeignPort"]
        params:
          suspicious_ports: [31337, 4444, 1337, 8888, 9999, 10000, 6881, 6969, 2222]
      
      - id: correlation_evasion_network
        title: High-Confidence Threat (Evasion + Network Activity)
        narrative: "This is a severe threat. The system shows signs that an attacker is actively trying to hide their malicious activities while also communicating with external servers. This strongly suggests an active 'Command and Control' (C2) channel, meaning the attacker is remotely controlling the compromised system."
        mitre: ["T1055", "T1071", "TA0011"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["linux_hidden_process"]
              secondary_ids: ["suspicious_connection", "suspicious_network_enrichment", "suspicious_port_activity"]

      - id: linux_hidden_process
        title: Hidden process (pslist vs psscan mismatch)
        narrative: "A program running on the system is hidden from standard process lists, but is detected by deeper scans. This indicates potential rootkit activity or other advanced evasion techniques used by malware to operate undetected on Linux."
        mitre: ["T1055"]
        weight: 10
        engine: linux_hidden_process
        enabled: true
        evidence_fields: ["pid","name","pslist_present","psscan_present"]

      - id: linux_syscall_hooks
        title: Potential syscall hooks detected
        narrative: "Unauthorized modifications were detected to the system call tables (syscalls). This is a highly advanced technique often used by rootkits to intercept or redirect core operating system functions, allowing them to gain deep control and hide malicious activity."
        mitre: ["T1014"]
        weight: 10
        engine: linux_syscall_hooks
        enabled: true
        evidence_fields: ["Syscall","HookOwner","Address","Notes"]

      - id: linux_unsigned_module
        title: Suspicious/unsigned kernel module
        narrative: "An unsigned or unexpected program component (kernel module) is loaded directly into the Linux kernel. Kernel modules run with the highest privileges, and unsigned or unknown modules are a strong indicator of a malicious rootkit or backdoor designed to deeply compromise the system."
        mitre: ["T1014"]
        weight: 10
        engine: linux_unsigned_module
        enabled: true
        evidence_fields: ["module","reason"]
      
      - id: lsof_suspicious_open
        title: Suspicious open file (deleted/tmp) with context
        narrative: "A running program has an active connection (open file handle) to a file that has been deleted from disk or is located in a temporary directory. This often indicates that malware has staged or executed transient files, which are then deleted to avoid detection."
        mitre: ["T1105","T1106"]
        weight: 5
        engine: lsof_suspicious_open
        enabled: true
        evidence_fields: ["pid","comm","fd","type","node","path","cmdline"]
        params:
          any_path_contains: ["/tmp/", "/dev/shm/", "/var/tmp/", "(deleted)"]
          any_name_contains: ["(deleted)"]

      - id: exec_from_tmp
        title: Executable/script from /tmp or /dev/shm
        narrative: "A program or script is running directly from a temporary directory (like `/tmp` or `/dev/shm`), which is highly unusual for legitimate applications. This is a common tactic for malware to execute itself from a non-standard and often less-monitored location."
        mitre: ["T1204","T1036"]
        weight: 12
        engine: exec_from_tmp
        enabled: true
        evidence_fields: ["pid","name","path"]
        params:
          temp_like_paths: ["/tmp/", "/dev/shm/", "/var/tmp/", "/home/[^/]+/Downloads/"]

      - id: bash_history_suspicious
        title: Suspicious commands in Bash history
        narrative: "Commands that are often associated with malicious activities (e.g., downloading tools, deleting logs, privilege escalation attempts) were found in the user's Bash command history. This suggests a user, or an attacker using a user's account, has performed suspicious actions on the system."
        mitre: ["T1059.004", "T1070.003"]
        weight: 5
        engine: bash_history_grep
        enabled: true
        evidence_fields: ["User", "Command"]
        params:
          suspicious_keywords:
            - "wget"
            - "curl"
            - "nc "
            - "chmod +x"
            - "rm -rf"
            - "shred"
            - "python -c"
            - "perl -e"
            - "php -r"
            - "cat /etc/shadow"
            - "sudo su"
            - "sshpass"
            - "msfvenom"
            - "/dev/tcp/"

      # --- NEW Linux Detection Rules ---
      - id: linux_ldpreload
        title: LD_PRELOAD / LD_LIBRARY_PATH hijacking detected
        narrative: "A process has LD_PRELOAD or LD_LIBRARY_PATH set in its environment, which forces custom shared libraries to load before system libraries. Attackers use this to intercept system calls, hook functions, or inject malicious code into legitimate processes without modifying them on disk."
        mitre: ["T1574.006"]
        weight: 10
        engine: linux_ldpreload
        enabled: true
        evidence_fields: ["pid", "process", "Variable", "Value", "Notes"]

      - id: linux_cron_persistence
        title: Cron/at-based persistence indicators
        narrative: "Commands in bash history or open file handles point to cron or at-job manipulation. Attackers commonly abuse cron to ensure their malicious code re-executes after reboots or on a schedule, maintaining persistent access to the system."
        mitre: ["T1053.003"]
        weight: 8
        engine: linux_cron_persistence
        enabled: true
        evidence_fields: ["source", "Command", "Notes"]

      - id: correlation_linux_evasion_network
        title: High-Confidence Linux Threat (Evasion + Network)
        narrative: "Hidden processes or library hijacking combined with suspicious network connections strongly indicate an active Linux compromise. The attacker is hiding their presence while maintaining command and control communication."
        mitre: ["T1055", "T1071", "T1574.006"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["linux_hidden_process", "linux_ldpreload", "linux_unsigned_module"]
              secondary_ids: ["suspicious_connection", "suspicious_network_enrichment", "suspicious_port_activity"]

  macos:
    plugins:
      - { name: "mac.pslist",        format: "csv"  }
      - { name: "mac.lsof",          format: "text" }
      - { name: "mac.netstat",       format: "csv"  }
      - { name: "mac.malfind",       format: "text" }
      - { name: "mac.bash",          format: "text" }
      # --- NEW MACOS PLUGINS ---
      - { name: "mac.sessions",      format: "csv"  }
      - { name: "mac.mount",         format: "text" }
      - { name: "mac.volumes",       format: "text" }
      - { name: "mac.dmesg",         format: "text" }

    detections:
      - id: suspicious_network_malicious_ip
        title: Network connections to malicious IPs
        narrative: "The system is communicating with known malicious IP addresses, which are often associated with cybercriminals or hostile infrastructure. This is a very strong sign of an active compromise, potentially for Command and Control (C2) or data theft."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: network_enrichment
        enabled: true
        evidence_fields: ["ip", "country", "isp", "reputation"]
        params:
          allow_cidrs_ref: "baseline.network.allow_cidrs"
        logic:
          - rule_id: malicious_reputation
            match:
              - field: "reputation"
                value: "Malicious"
                operator: "=="
          - rule_id: suspicious_reputation
            match:
              - field: "reputation"
                value: "Suspicious"
                operator: "=="

      - id: suspicious_network_enrichment
        title: Network connections to suspicious foreign locations
        narrative: "The system is communicating with IP addresses located in countries identified as suspicious. While not inherently malicious, traffic to these locations can indicate unauthorized activity, data exfiltration, or communication with command and control infrastructure in high-risk regions."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: network_enrichment
        enabled: true
        evidence_fields: ["ip", "country", "isp", "reputation"]
        params:
          allow_cidrs_ref: "baseline.network.allow_cidrs"
        logic:
          - rule_id: suspicious_location_ru
            match: [{ field: country, value: "RU" }]
          - rule_id: suspicious_location_cn
            match: [{ field: country, value: "CN" }]
          - rule_id: suspicious_location_kp
            match: [{ field: country, value: "KP" }]
          # FR and BE removed — NATO allies, generates excessive false positives
          - rule_id: suspicious_location_ir
            match: [{ field: country, value: "IR" }]
          - rule_id: suspicious_location_cu
            match: [{ field: country, value: "CU" }]

      - id: suspicious_connection
        title: Suspicious external connection
        narrative: "An unexpected network connection to a server outside your trusted network was found. This could indicate an attacker communicating with a remote server for control, data exfiltration, or downloading more malicious tools."
        mitre: ["T1071","TA0011"]
        weight: 15
        engine: suspicious_connection
        enabled: true
        evidence_fields: ["pid","owner","ForeignAddr","ForeignPort","LocalAddr","LocalPort","State"]
        params:
          allow_cidrs_ref: "baseline.network.allow_cidrs"
          allow_ports_ref: "baseline.network.allow_ports"
          
      - id: suspicious_port_activity
        title: "Suspicious port activity (known bad ports)"
        narrative: "Network connections are using ports that are commonly associated with malware, backdoors, or unauthorized communication. Attackers often use non-standard or obscure ports to evade detection."
        mitre: ["T1071", "TA0011"]
        weight: 15
        engine: suspicious_port_activity
        enabled: true
        evidence_fields: ["pid", "owner", "Proto", "LocalPort", "ForeignPort"]
        params:
          suspicious_ports: [31337, 4444, 1337, 8888, 9999, 10000, 6881, 6969, 2222]
      
      - id: correlation_evasion_network
        title: High-Confidence Threat (Evasion + Network Activity)
        narrative: "This is a severe threat. The system shows signs that an attacker is actively trying to hide their malicious activities while also communicating with external servers. This strongly suggests an active 'Command and Control' (C2) channel, meaning the attacker is remotely controlling the compromised system."
        mitre: ["T1055", "T1071", "TA0011"]
        weight: 15
        engine: correlated_findings
        enabled: true
        evidence_fields: ["correlated_finding_ids"]
        params:
          correlation_pairs:
            - primary_ids: ["lsof_suspicious_open", "exec_from_tmp"]
              secondary_ids: ["suspicious_connection", "suspicious_network_enrichment", "suspicious_port_activity"]

      - id: unknown_process_name
        title: Unknown process image (not in baseline)
        narrative: "A program is running on the system that is not recognized as a standard or approved process from your baseline. This could indicate the presence of unauthorized software, malware, or a custom tool deployed by an attacker."
        mitre: ["T1059","TA0002"]
        weight: 5
        engine: unknown_process_name
        enabled: true
        evidence_fields: ["pid","name","path"]
        params:
          process_whitelist_ref: "baseline.process_whitelist"

      - id: lsof_suspicious_open
        title: Suspicious open file (tmp/private/tmp/deleted)
        narrative: "A running program has an active connection (open file handle) to a file that has been deleted from disk or is located in a temporary directory. This often indicates that malware has staged or executed transient files, which are then deleted to avoid detection."
        mitre: ["T1105","T1106"]
        weight: 5
        engine: lsof_suspicious_open
        enabled: true
        evidence_fields: ["pid","comm","fd","type","node","path","cmdline"]
        params:
          any_path_contains: ["/tmp/", "/private/tmp/", "/var/folders/", "(deleted)"]

      - id: exec_from_tmp
        title: Executable from temporary path
        narrative: "A program or script is running directly from a temporary directory, which is highly unusual for legitimate applications. This is a common tactic for malware to execute itself from a non-standard and often less-monitored location."
        mitre: ["T1204","T1036"]
        weight: 5
        engine: exec_from_tmp
        enabled: true
        evidence_fields: ["pid","name","path"]
        params:
          temp_like_paths: ["/tmp/", "/private/tmp/", "/var/folders/", "/Users/[^/]+/Downloads/"]

      - id: bash_history_suspicious
        title: "Suspicious commands in Bash history"
        narrative: "Commands that are often associated with malicious activities (e.g., downloading tools, deleting logs, privilege escalation attempts) were found in the user's Bash command history. This suggests a user, or an attacker using a user's account, has performed suspicious actions on the system."
        mitre: ["T1059.004", "T1070.003"]
        weight: 5
        engine: bash_history_grep
        enabled: true
        evidence_fields: ["User", "Command"]
        params:
          suspicious_keywords:
            - "wget"
            - "curl"
            - "nc "
            - "chmod +x"
            - "rm -rf"
            - "shred"
            - "python -c"
            - "perl -e"
            - "php -r"
            - "cat /etc/shadow"
            - "sudo su"
            - "sshpass"
            - "msfvenom"
            - "/dev/tcp/"