[depalmar]

Pull request

What this PR does

Reference data

• MITRE ATLAS 2026.07 → 2026.09. The pin is now bucketed by object type (tactics, techniques, mitigations, case studies) and keeps no upstream free text.
• ATT&CK 19.2 groups and campaigns are pinned by id and name only.
• New schema/owasp.json holds the OWASP LLM 2026 and Agentic 2026 (ASI01–ASI10) lists. Appendix A's 2025 LLM ids are stored translated to 2026 ids.
• New schema/cve-status.json pins the CISA KEV status of every cited CVE. cve_status.py fails any line that calls a CVE KEV-listed when the pin disagrees. It corrected the Ray rule, which said CVE-2023-48022 is on KEV; it is not.
• The ATLAS id gate now covers every surface: rules, MAPPINGS, cases, actors, playbooks and the guide.
  • Retired ids were remapped: AML.T0104 → T0115.002, and T0019 → T0049 (per ATLAS's own ShadowRay case study).
  • Parser fixes: MAPPINGS section 04 was silently dropped, atlas.aml-tNNNN tags were discarded, and ATT&CK ids were read as ATLAS ids.
• MAPPINGS:
  • an ASI column on every row
  • index tables generated from the pins (sync_mappings.py)
  • rows reconciled so each includes every technique its rule is tagged with

Threat intel

• 20 actor profiles (artifacts/intel/actors/), covering attributed groups and reporter-named clusters.
• New case studies AIRT-CS-0015 to 0022:
  • s1ngularity / Nx using the victim's AI CLIs
  • UNC6780 (TeamPCP) DUSTMAKER and trojanised MCP servers
  • MIDNIGHT NEPTUNE's Claude Code hook poisoning
  • five clusters from Anthropic's September 2026 report, carrying the 131 cyber-operations indicators from its IOC release
• Existing cases gain structured actor, victim and framework fields.
• Closed schemas: case-study.schema.json, actor.schema.json, intel-vocab.json.
• intel_graph.py derives, per actor, the techniques used, which rule detects each one (a coverage gap where none does), and which catalogued artifacts to collect. It also computes analytics: IDF-weighted similarity, clusters, technique co-occurrence and a detection backlog.
• Exports (deterministic): intel.json, a STIX 2.1 bundle and Maltego import CSVs.
• Two Sigma rules:
  • ai_cli_permission_bypass_invocation.yml: an AI CLI started with its approval-bypass flag by a package manager (the s1ngularity pattern)
  • ai_agent_hook_config_modification.yml: writes to Claude Code settings/hooks
• ai_agent_credential_file_access.yml remapped from T0082 to T0083 and T0055.

Site

• Threat intel view:
  • cross-filtering, with pivots to cases, rules, the graph and the collection plan
  • timeline, ATLAS matrix with coverage-gap layer, victimology
  • technique × actor heatmap, similarity matrix and clusters, co-occurrence table
• Graph workbench: Cytoscape.js 3.34.3, vendored with its sha256 in vendor/VENDOR.json and loaded only when the tab opens.
• The collection plan generates a triage script: PowerShell, or bash for macOS/Linux.
  • Credentials are hashed, not copied, including any swept up by a directory row.
  • It also gives the Velociraptor, KAPE and Python-collector commands for the same plan.
• A wider, resizable drawer. Tabs scroll instead of wrapping. All embedded data is escaped against </script>.

Automation

• framework-refresh.yml runs weekly. It re-pins, runs every gate, and auto-merges only when refresh_guard.py finds the diff confined to reference data.
• intel-watch.yml runs weekly and files intel-candidate issues from CISA KEV, ATLAS, AVID, AIID (MIT AI Risk Repository domains 2.2 and 4.2), the OWASP ASI tracker, vendor feeds and GitHub advisories. It never merges anything.
• forbidden_terms.py fails CI on terms held in a FORBIDDEN_TERMS secret. The terms are never committed or printed.

Docs: CLAUDE.md, CONTRIBUTING, the authoring skill, both READMEs, LICENSE-DATA (third-party facts policy), CHANGELOG, VERIFICATION.

Type

• New detection rule
• Rule tuning (FP reduction or coverage improvement)
• Test artifact
• Documentation
• Bug fix
• Other: reference-data refresh, threat-intel layer, site views, CI automation

Attack technique / reference

• New rules: ATLAS AML.T0053 / T0098 / T0081; Nx advisory GHSA-cxm3-wv7p-598c; GTIG AI Threat Tracker, 8 Sep 2026.
• Reference data: ATLAS 2026.09 (atlas-data), ATT&CK 19.2, CISA KEV catalog 2026.09.29, OWASP Top 10 for Agentic Applications 2026.

Checklist

• Rule references an attack technique (ATLAS / CVE / published research)
• Test artifact added in tests/ (for new rules). Not added; the two new rules are Sigma process/file events with no file fixture.
• False positives documented in rule metadata
• Filename is lowercase, snake_case, matches threat
• MAPPINGS.md updated (for new rules)
• Category README.md updated (for new rules): artifacts/detections/README.md
• tests/validate.sh passes locally (YARA rules). Not run: the YARA CLI isn't installed here. Every .yar compiles under yara-python instead.
• For Sigma: converts cleanly with at least one pySigma backend (Splunk, all catalog rules)

Testing

• All gates pass:
  • validate.py, validate_techniques.py, cve_status.py
  • sync_mappings.py --check, intel_graph.py --check, data_sources.py --check
  • export_kape.py --check, export_velociraptor.py --check, normalize_notes.py --check
  • readme_counts.py --check, build_site.py --check
  • gen_credential_targets.py --check, check_target_drift.py
  • validate_mappings.py, the CACAO playbook validator
• Feeds regenerated. The intel exports are byte-identical across runs.
• STIX bundle: all 509 objects parse under stix2, and every indicator pattern validates.
• Site checked in headless Chromium, light and dark:
  • no console errors
  • no horizontal scroll at 390 px
  • Cytoscape not loaded until the Graph tab opens
  • cross-filter and pivots checked (financial filter → 8 actors / 5 cases → 28 rules)
• The generated bash triage script was run against a fixture home. It copies non-secret files, records credentials hashed-only (none copied, including inside a swept directory), and SHA256SUMS verifies. The PowerShell variant was reviewed but not executed (no pwsh available); please test it on a Windows host.
• refresh_guard.py was tested in a scratch worktree: a pin-only change is auto-merge, while an unrelated file or a forbidden term is held for review.
• intel_watch.py was run offline against local mirrors. After tightening matching to tool names and aliases, it raises 5 real candidates (Langflow KEV additions) instead of 420 noisy ones.

Additional context

• One-time setup:
  • Add a FORBIDDEN_TERMS repository secret. Until it exists, the check passes with a notice.
  • For refresh auto-merge, add an AUTOMATION_TOKEN secret, branch protection on main, and "Allow auto-merge". Without them the refresh PR opens and waits.
• Research boundaries. Claims rest only on pages actually fetched. Anything from a secondary summary says so in the case's basis. last_verified was not stamped from search results.
• Actor scope.
  • Out of scope: influence-operation, surveillance and scam clusters (no host artifacts), and private individuals.
  • ATT&CK vendor alias lists are no longer republished.
• ASI values are our own assessment. OWASP maps no detection content, and MAPPINGS says so.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V2zNmjhpmRmMobbbDgSmSY

---

Generated by Claude Code