Applied Cybernetics Group
Threat intel → detection pipeline
thrunt.me
Friday, September 18, 2026
Data as of 13:09 UTC

Detection content

Sigma Rules

Hand-authored Sigma rules for TTPs the corpus shows to be exploited-and-undetected — where live signal is high and community coverage is zero. Quality over volume; base Sigma only (your pipeline converts to its own backend).

Production rules (16)

Rule Status Level Logsource ATT&CK YAML
T1098.005 Okta Verify Enrollment from a Hypervisor Guest experimental high okta T1098.005 .yml
T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel experimental medium okta T1111, T1557 .yml
T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2 experimental high proxy T1027.013, T1557 .yml
T1557 Okta Verify SVG Asset Served by a Non-Okta Host experimental high proxy T1557 .yml
T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate experimental high proxy T1036.005, T1557 .yml
T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain experimental medium dns T1566.004, T1583.001 .yml
T1055 Process Injection — Rundll32 Spawning Explorer as an Injection Host experimental high windows / process_creation T1055, T1218.011 .yml
T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process experimental medium windows / network_connection T1071.004, T1573 .yml
T1574.002 DLL Side-Loading — Signed javac.exe Loading jli.dll from a User-Writable Path experimental high windows / image_load T1574.002 .yml
T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet experimental high proxy T1102.001 .yml
T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container experimental high proxy T1195.002 .yml
T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution experimental high macos / process_creation T1204.004 .yml
T1204.004 Malicious Copy and Paste — ClickFix Run Dialog Execution experimental high windows / process_creation T1105, T1204.004, T1218.011 .yml
T1037 Boot or Logon Initialization Scripts — Linux Init Script Modification experimental medium linux / file_event T1037 .yml
T1098.004 Account Manipulation — SSH Authorized Keys File Modification experimental medium linux / file_event T1098.004 .yml
T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign experimental medium mobile / sms T1566.002 .yml

Authoring queue — the editorial calendar

Every row is a technique with live corpus signal and zero coverage anywhere, ranked by a deterministic score (active malware family + KEV CVEs + citing OSINT + exploit probability). This is signal × coverage → gap made concrete: what gets authored next, in order, computed daily — not asserted.

Technique Name State Score Active families KEV
T1497 Virtualization/Sandbox Evasion candidate 36 — 4
T1573.001 Symmetric Cryptography candidate 34.8 — 3
T1562.001 — candidate 28 — 0
T1499.002 Service Exhaustion Flood candidate 27.6 — 2
T1530 Data from Cloud Storage scaffolded 24 — 2
T1003.008 /etc/passwd and /etc/shadow scaffolded 24 — 1
T1498.001 Direct Network Flood candidate 24 — 1
T1491.002 External Defacement candidate 24 — 1
T1602 Data from Configuration Repository candidate 23.9 — 1
T1070.001 — candidate 23.8 — 0
T1071.002 File Transfer Protocols candidate 22 — 1
T1011 Exfiltration Over Other Network Medium candidate 20.5 — 4

Subscription contract

Poll /sigma/rules.lock.json: each rule carries a content sha256, a monotonic version, and a change_type. A bumped version means the rule changed; change_type: logic means the detection or logsource changed — re-test before deploying (a metadata-only edit does not). Diff two lock files for an exact, machine-readable list of what churned — the mechanism SigmaHQ's own release notes lack. Bulk-pull all production rules with /sigma/rules.tar.gz; watch /sigma/sigma-feed.xml for new and logic-changed rules. Rule URLs and UUIDs are stable for life; a retired rule is recorded in CHANGELOG.md, never silently dropped.

Status ladder: experimental → test → stable (Sigma standard). Rules on the authoring queue are draft — scaffolds with a TODO detection block, excluded from the default feed and the tarball.