Raw benchmark tables¶
The per-scenario tables written by python scripts/bench.py (ATLAS reconstruction from the
analyst IOC, reduction, IsolationForest ranking, Log4Shell fusion) and by the
sealed-coverage workflow (per-capture rule coverage). The methodology, the summary tables
with confidence intervals and the comparison with published work are on
Evaluation.
Full tables (results/RESULTS.md)
ROOTLINE benchmark results¶
Rendered by python scripts/bench.py from results/*.json. Each section names the run that produced it.
ATLAS: attack reconstruction from the analyst IOC (S1-S4 in-sample, M hosts held out)¶
Source: scripts/bench.py --only atlas, rootline 1.1.0, commit cde2a392b1e8, GitHub Actions bench run 37092501921, Python 3.12.14.
| scenario | method | events | gt_events | story_nodes | story_events | precision | recall | f1 | entity_recall | seconds |
|---|---|---|---|---|---|---|---|---|---|---|
| M1-CVE-2015-5122_windows_h1 | ioc-grep | 68307 | 2942 | 6 | 202 | 1.0 | 0.0687 | 0.1285 | 1.0 | 0.0 |
| M1-CVE-2015-5122_windows_h1 | naive-bfs | 68307 | 2942 | 5685 | 52982 | 0.0555 | 1.0 | 0.1052 | 1.0 | 0.006 |
| M1-CVE-2015-5122_windows_h1 | rootline-noreduce | 68307 | 2942 | 1719 | 9172 | 0.3208 | 1.0 | 0.4857 | 1.0 | 0.105 |
| M1-CVE-2015-5122_windows_h1 | rootline | 68307 | 2942 | 1719 | 9172 | 0.3208 | 1.0 | 0.4857 | 1.0 | 0.136 |
| M1-CVE-2015-5122_windows_h2 | ioc-grep | 76490 | 3039 | 2 | 116 | 1.0 | 0.0382 | 0.0735 | 1.0 | 0.0 |
| M1-CVE-2015-5122_windows_h2 | naive-bfs | 76490 | 3039 | 3641 | 50288 | 0.0604 | 0.999 | 0.1139 | 1.0 | 0.005 |
| M1-CVE-2015-5122_windows_h2 | rootline-noreduce | 76490 | 3039 | 12 | 190 | 1.0 | 0.0625 | 0.1177 | 1.0 | 0.033 |
| M1-CVE-2015-5122_windows_h2 | rootline | 76490 | 3039 | 12 | 190 | 1.0 | 0.0625 | 0.1177 | 1.0 | 0.054 |
| M2-CVE-2015-5119_windows_py_h1 | ioc-grep | 81766 | 11514 | 6 | 378 | 1.0 | 0.0328 | 0.0636 | 1.0 | 0.0 |
| M2-CVE-2015-5119_windows_py_h1 | naive-bfs | 81766 | 11514 | 9119 | 68894 | 0.1671 | 1.0 | 0.2864 | 1.0 | 0.008 |
| M2-CVE-2015-5119_windows_py_h1 | rootline-noreduce | 81766 | 11514 | 5720 | 22226 | 0.518 | 0.9999 | 0.6825 | 1.0 | 0.141 |
| M2-CVE-2015-5119_windows_py_h1 | rootline | 81766 | 11514 | 5720 | 22226 | 0.518 | 0.9999 | 0.6825 | 1.0 | 0.243 |
| M2-CVE-2015-5119_windows_py_h2 | ioc-grep | 81624 | 11152 | 2 | 230 | 1.0 | 0.0206 | 0.0404 | 1.0 | 0.0 |
| M2-CVE-2015-5119_windows_py_h2 | naive-bfs | 81624 | 11152 | 6988 | 43864 | 0.2525 | 0.9931 | 0.4026 | 1.0 | 0.004 |
| M2-CVE-2015-5119_windows_py_h2 | rootline-noreduce | 81624 | 11152 | 14 | 275 | 1.0 | 0.0247 | 0.0481 | 1.0 | 0.027 |
| M2-CVE-2015-5119_windows_py_h2 | rootline | 81624 | 11152 | 14 | 275 | 1.0 | 0.0247 | 0.0481 | 1.0 | 0.171 |
| M3-CVE-2015-3105_windows_py_h1 | ioc-grep | 76081 | 11700 | 6 | 301 | 1.0 | 0.0257 | 0.0502 | 1.0 | 0.0 |
| M3-CVE-2015-3105_windows_py_h1 | naive-bfs | 76081 | 11700 | 8439 | 47881 | 0.2443 | 0.9999 | 0.3927 | 1.0 | 0.005 |
| M3-CVE-2015-3105_windows_py_h1 | rootline-noreduce | 76081 | 11700 | 6092 | 18809 | 0.6219 | 0.9998 | 0.7669 | 1.0 | 0.097 |
| M3-CVE-2015-3105_windows_py_h1 | rootline | 76081 | 11700 | 6092 | 18809 | 0.6219 | 0.9998 | 0.7669 | 1.0 | 0.106 |
| M3-CVE-2015-3105_windows_py_h2 | ioc-grep | 89799 | 11146 | 2 | 230 | 1.0 | 0.0206 | 0.0404 | 1.0 | 0.0 |
| M3-CVE-2015-3105_windows_py_h2 | naive-bfs | 89799 | 11146 | 6352 | 39709 | 0.2789 | 0.9937 | 0.4356 | 1.0 | 0.005 |
| M3-CVE-2015-3105_windows_py_h2 | rootline-noreduce | 89799 | 11146 | 17 | 282 | 1.0 | 0.0253 | 0.0494 | 1.0 | 0.027 |
| M3-CVE-2015-3105_windows_py_h2 | rootline | 89799 | 11146 | 17 | 282 | 1.0 | 0.0253 | 0.0494 | 1.0 | 0.186 |
| M4-CVE_2018_8174_windows_h1 | ioc-grep | 77635 | 2984 | 7 | 120 | 1.0 | 0.0402 | 0.0773 | 0.6 | 0.0 |
| M4-CVE_2018_8174_windows_h1 | naive-bfs | 77635 | 2984 | 5732 | 59964 | 0.0497 | 0.9993 | 0.0947 | 0.8 | 0.007 |
| M4-CVE_2018_8174_windows_h1 | rootline-noreduce | 77635 | 2984 | 2453 | 20170 | 0.1475 | 0.997 | 0.257 | 0.8 | 0.185 |
| M4-CVE_2018_8174_windows_h1 | rootline | 77635 | 2984 | 2453 | 20170 | 0.1475 | 0.997 | 0.257 | 0.8 | 0.131 |
| M4-CVE_2018_8174_windows_h2 | ioc-grep | 67792 | 3026 | 3 | 116 | 1.0 | 0.0383 | 0.0738 | 1.0 | 0.0 |
| M4-CVE_2018_8174_windows_h2 | naive-bfs | 67792 | 3026 | 3088 | 36589 | 0.0826 | 0.9993 | 0.1527 | 1.0 | 0.003 |
| M4-CVE_2018_8174_windows_h2 | rootline-noreduce | 67792 | 3026 | 13 | 191 | 1.0 | 0.0631 | 0.1187 | 1.0 | 0.019 |
| M4-CVE_2018_8174_windows_h2 | rootline | 67792 | 3026 | 13 | 191 | 1.0 | 0.0631 | 0.1187 | 1.0 | 0.144 |
| M5-CVE-2017-0199_windows_py_h1 | ioc-grep | 214035 | 11146 | 9 | 235 | 1.0 | 0.0211 | 0.0413 | 0.75 | 0.0 |
| M5-CVE-2017-0199_windows_py_h1 | naive-bfs | 214035 | 11146 | 10705 | 102350 | 0.1089 | 0.9999 | 0.1964 | 1.0 | 0.013 |
| M5-CVE-2017-0199_windows_py_h1 | rootline-noreduce | 214035 | 11146 | 5700 | 33161 | 0.3357 | 0.9987 | 0.5024 | 1.0 | 0.233 |
| M5-CVE-2017-0199_windows_py_h1 | rootline | 214035 | 11146 | 5700 | 33161 | 0.3357 | 0.9987 | 0.5024 | 1.0 | 0.46 |
| M5-CVE-2017-0199_windows_py_h2 | ioc-grep | 75423 | 11125 | 2 | 230 | 1.0 | 0.0207 | 0.0405 | 1.0 | 0.0 |
| M5-CVE-2017-0199_windows_py_h2 | naive-bfs | 75423 | 11125 | 6151 | 25074 | 0.4403 | 0.9924 | 0.61 | 1.0 | 0.004 |
| M5-CVE-2017-0199_windows_py_h2 | rootline-noreduce | 75423 | 11125 | 12 | 272 | 1.0 | 0.0244 | 0.0477 | 1.0 | 0.03 |
| M5-CVE-2017-0199_windows_py_h2 | rootline | 75423 | 11125 | 12 | 272 | 1.0 | 0.0244 | 0.0477 | 1.0 | 0.075 |
| M6-CVE-2017-11882_windows_h1 | ioc-grep | 84581 | 4097 | 10 | 139 | 0.9928 | 0.0337 | 0.0652 | 0.8 | 0.0 |
| M6-CVE-2017-11882_windows_h1 | naive-bfs | 84581 | 4097 | 5941 | 63999 | 0.0639 | 0.9976 | 0.12 | 1.0 | 0.005 |
| M6-CVE-2017-11882_windows_h1 | rootline-noreduce | 84581 | 4097 | 2705 | 25332 | 0.1609 | 0.9949 | 0.277 | 1.0 | 0.279 |
| M6-CVE-2017-11882_windows_h1 | rootline | 84581 | 4097 | 2705 | 25332 | 0.1609 | 0.9949 | 0.277 | 1.0 | 0.12 |
| M6-CVE-2017-11882_windows_h2 | ioc-grep | 89866 | 3048 | 5 | 138 | 1.0 | 0.0453 | 0.0866 | 1.0 | 0.0 |
| M6-CVE-2017-11882_windows_h2 | naive-bfs | 89866 | 3048 | 3859 | 61536 | 0.0495 | 0.9993 | 0.0943 | 1.0 | 0.006 |
| M6-CVE-2017-11882_windows_h2 | rootline-noreduce | 89866 | 3048 | 1329 | 3039 | 0.972 | 0.9692 | 0.9706 | 1.0 | 0.029 |
| M6-CVE-2017-11882_windows_h2 | rootline | 89866 | 3048 | 1329 | 3039 | 0.972 | 0.9692 | 0.9706 | 1.0 | 0.074 |
| S1-CVE-2015-5122_windows | ioc-grep | 53538 | 3363 | 6 | 265 | 1.0 | 0.0788 | 0.1461 | 1.0 | 0.0 |
| S1-CVE-2015-5122_windows | naive-bfs | 53538 | 3363 | 4735 | 40143 | 0.0837 | 0.9994 | 0.1545 | 1.0 | 0.004 |
| S1-CVE-2015-5122_windows | rootline-noreduce | 53538 | 3363 | 1880 | 8904 | 0.3776 | 0.9997 | 0.5481 | 1.0 | 0.049 |
| S1-CVE-2015-5122_windows | rootline | 53538 | 3363 | 1880 | 8904 | 0.3776 | 0.9997 | 0.5481 | 1.0 | 0.142 |
| S2-CVE-2015-3105_windows | ioc-grep | 50390 | 9519 | 8 | 157 | 1.0 | 0.0165 | 0.0325 | 1.0 | 0.0 |
| S2-CVE-2015-3105_windows | naive-bfs | 50390 | 9519 | 5450 | 39032 | 0.2439 | 1.0 | 0.3921 | 1.0 | 0.005 |
| S2-CVE-2015-3105_windows | rootline-noreduce | 50390 | 9519 | 3246 | 18954 | 0.5022 | 0.9999 | 0.6686 | 1.0 | 0.128 |
| S2-CVE-2015-3105_windows | rootline | 50390 | 9519 | 3246 | 18954 | 0.5022 | 0.9999 | 0.6686 | 1.0 | 0.207 |
| S3-CVE-2017-11882_windows | ioc-grep | 68835 | 3689 | 9 | 124 | 0.9919 | 0.0333 | 0.0645 | 0.8 | 0.0 |
| S3-CVE-2017-11882_windows | naive-bfs | 68835 | 3689 | 5099 | 46725 | 0.0788 | 0.9986 | 0.1461 | 1.0 | 0.005 |
| S3-CVE-2017-11882_windows | rootline-noreduce | 68835 | 3689 | 2677 | 22826 | 0.1609 | 0.9957 | 0.2771 | 1.0 | 0.105 |
| S3-CVE-2017-11882_windows | rootline | 68835 | 3689 | 2677 | 22826 | 0.1609 | 0.9957 | 0.2771 | 1.0 | 0.204 |
| S4-CVE-2017-0199_windows_py | ioc-grep | 71044 | 11624 | 9 | 381 | 1.0 | 0.0328 | 0.0635 | 0.75 | 0.0 |
| S4-CVE-2017-0199_windows_py | naive-bfs | 71044 | 11624 | 8323 | 49337 | 0.2356 | 1.0 | 0.3814 | 1.0 | 0.01 |
| S4-CVE-2017-0199_windows_py | rootline-noreduce | 71044 | 11624 | 5893 | 19670 | 0.5902 | 0.9988 | 0.742 | 1.0 | 0.305 |
| S4-CVE-2017-0199_windows_py | rootline | 71044 | 11624 | 5893 | 19670 | 0.5902 | 0.9988 | 0.742 | 1.0 | 0.256 |
ATLAS: graph reduction (research question: shrink while preserving attack edges)¶
| scenario | edges_before | edges_after | edge_ratio | nodes_before | nodes_after | attack_edges_preserved | seconds |
|---|---|---|---|---|---|---|---|
| M1-CVE-2015-5122_windows_h1 | 69286 | 16364 | 4.23 | 6489 | 6489 | 1.0 | 0.042 |
| M1-CVE-2015-5122_windows_h2 | 75711 | 13206 | 5.73 | 5085 | 5085 | 1.0 | 0.047 |
| M2-CVE-2015-5119_windows_py_h1 | 82949 | 19085 | 4.35 | 9758 | 9758 | 1.0 | 0.059 |
| M2-CVE-2015-5119_windows_py_h2 | 80890 | 15658 | 5.17 | 8324 | 8324 | 1.0 | 0.063 |
| M3-CVE-2015-3105_windows_py_h1 | 76755 | 19327 | 3.97 | 9913 | 9913 | 1.0 | 0.165 |
| M3-CVE-2015-3105_windows_py_h2 | 89972 | 17621 | 5.11 | 9523 | 9523 | 1.0 | 0.059 |
| M4-CVE_2018_8174_windows_h1 | 77819 | 18006 | 4.32 | 6965 | 6965 | 1.0 | 0.174 |
| M4-CVE_2018_8174_windows_h2 | 67931 | 11842 | 5.74 | 4841 | 4841 | 1.0 | 0.042 |
| M5-CVE-2017-0199_windows_py_h1 | 215333 | 45016 | 4.78 | 21867 | 21867 | 1.0 | 0.37 |
| M5-CVE-2017-0199_windows_py_h2 | 75196 | 15265 | 4.93 | 8321 | 8321 | 1.0 | 0.172 |
| M6-CVE-2017-11882_windows_h1 | 84694 | 19141 | 4.42 | 7291 | 7291 | 1.0 | 0.16 |
| M6-CVE-2017-11882_windows_h2 | 89398 | 15381 | 5.81 | 6270 | 6270 | 1.0 | 0.174 |
| S1-CVE-2015-5122_windows | 54589 | 12548 | 4.35 | 5502 | 5502 | 1.0 | 0.034 |
| S2-CVE-2015-3105_windows | 58327 | 15348 | 3.8 | 7458 | 7458 | 1.0 | 0.148 |
| S3-CVE-2017-11882_windows | 69994 | 16586 | 4.22 | 6554 | 6554 | 1.0 | 0.047 |
| S4-CVE-2017-0199_windows_py | 72237 | 19000 | 3.8 | 10196 | 10196 | 1.0 | 0.057 |
ATLAS: anomaly tagging of process vertices (unsupervised)¶
IsolationForest rows are the mean over 10 seeds with a 95 % t-interval clipped to the metric's valid range (recall in [0, 1], rank >= 1). The interval covers seed variance on one fixed graph only, not data or scenario variance. iforest-no-userdir drops the exec_user_dir feature, which was written alongside the ATLAS benchmark; the user-dir heuristic (images under a user-writable directory first, then by degree) and degree ranking are deterministic baselines.
| scenario | method | processes | malicious | seeds | first_hit_rank | first_hit_rank_ci95 | hits@10 | recall@10 | recall@10_ci95 |
|---|---|---|---|---|---|---|---|---|---|
| M1-CVE-2015-5122_windows_h1 | iforest | 367 | 2 | 10 | 2.0 | [2.0, 2.0] | 1.3 | 0.65 | [0.477, 0.823] |
| M1-CVE-2015-5122_windows_h1 | iforest-no-userdir | 367 | 2 | 10 | 3.2 | [2.898, 3.502] | 1.0 | 0.5 | [0.5, 0.5] |
| M1-CVE-2015-5122_windows_h1 | user-dir image first (heuristic) | 367 | 2 | 1 | 2 | 1.0 | |||
| M1-CVE-2015-5122_windows_h1 | degree | 367 | 2 | 7 | 1 | 0.5 | |||
| M1-CVE-2015-5122_windows_h1 | random (expected) | 367 | 2 | 122.7 | 0.054 | 0.027 | |||
| M1-CVE-2015-5122_windows_h2 | iforest | 402 | 3 | 10 | 1.7 | [1.354, 2.046] | 2.8 | 0.933 | [0.833, 1.0] |
| M1-CVE-2015-5122_windows_h2 | iforest-no-userdir | 402 | 3 | 10 | 2.0 | [2.0, 2.0] | 1.0 | 0.333 | [0.333, 0.333] |
| M1-CVE-2015-5122_windows_h2 | user-dir image first (heuristic) | 402 | 3 | 1 | 3 | 1.0 | |||
| M1-CVE-2015-5122_windows_h2 | degree | 402 | 3 | 8 | 1 | 0.333 | |||
| M1-CVE-2015-5122_windows_h2 | random (expected) | 402 | 3 | 100.8 | 0.075 | 0.025 | |||
| M2-CVE-2015-5119_windows_py_h1 | iforest | 287 | 4 | 10 | 2.0 | [2.0, 2.0] | 4.0 | 1.0 | [1.0, 1.0] |
| M2-CVE-2015-5119_windows_py_h1 | iforest-no-userdir | 287 | 4 | 10 | 2.2 | [1.898, 2.502] | 2.0 | 0.5 | [0.5, 0.5] |
| M2-CVE-2015-5119_windows_py_h1 | user-dir image first (heuristic) | 287 | 4 | 1 | 4 | 1.0 | |||
| M2-CVE-2015-5119_windows_py_h1 | degree | 287 | 4 | 1 | 1 | 0.25 | |||
| M2-CVE-2015-5119_windows_py_h1 | random (expected) | 287 | 4 | 57.6 | 0.139 | 0.035 | |||
| M2-CVE-2015-5119_windows_py_h2 | iforest | 336 | 5 | 10 | 1.9 | [1.674, 2.126] | 3.9 | 0.78 | [0.735, 0.825] |
| M2-CVE-2015-5119_windows_py_h2 | iforest-no-userdir | 336 | 5 | 10 | 2.0 | [2.0, 2.0] | 2.0 | 0.4 | [0.4, 0.4] |
| M2-CVE-2015-5119_windows_py_h2 | user-dir image first (heuristic) | 336 | 5 | 1 | 5 | 1.0 | |||
| M2-CVE-2015-5119_windows_py_h2 | degree | 336 | 5 | 1 | 1 | 0.2 | |||
| M2-CVE-2015-5119_windows_py_h2 | random (expected) | 336 | 5 | 56.2 | 0.149 | 0.03 | |||
| M3-CVE-2015-3105_windows_py_h1 | iforest | 371 | 3 | 10 | 1.5 | [1.123, 1.877] | 2.2 | 0.734 | [0.633, 0.834] |
| M3-CVE-2015-3105_windows_py_h1 | iforest-no-userdir | 371 | 3 | 10 | 2.1 | [1.874, 2.326] | 2.0 | 0.667 | [0.667, 0.667] |
| M3-CVE-2015-3105_windows_py_h1 | user-dir image first (heuristic) | 371 | 3 | 1 | 3 | 1.0 | |||
| M3-CVE-2015-3105_windows_py_h1 | degree | 371 | 3 | 1 | 1 | 0.333 | |||
| M3-CVE-2015-3105_windows_py_h1 | random (expected) | 371 | 3 | 93.0 | 0.081 | 0.027 | |||
| M3-CVE-2015-3105_windows_py_h2 | iforest | 397 | 4 | 10 | 1.9 | [1.674, 2.126] | 3.6 | 0.9 | [0.775, 1.0] |
| M3-CVE-2015-3105_windows_py_h2 | iforest-no-userdir | 397 | 4 | 10 | 2.0 | [2.0, 2.0] | 2.0 | 0.5 | [0.5, 0.5] |
| M3-CVE-2015-3105_windows_py_h2 | user-dir image first (heuristic) | 397 | 4 | 1 | 4 | 1.0 | |||
| M3-CVE-2015-3105_windows_py_h2 | degree | 397 | 4 | 1 | 1 | 0.25 | |||
| M3-CVE-2015-3105_windows_py_h2 | random (expected) | 397 | 4 | 79.6 | 0.101 | 0.025 | |||
| M4-CVE_2018_8174_windows_h1 | iforest | 388 | 2 | 10 | 1.9 | [1.674, 2.126] | 1.9 | 0.95 | [0.837, 1.0] |
| M4-CVE_2018_8174_windows_h1 | iforest-no-userdir | 388 | 2 | 10 | 3.0 | [3.0, 3.0] | 1.0 | 0.5 | [0.5, 0.5] |
| M4-CVE_2018_8174_windows_h1 | user-dir image first (heuristic) | 388 | 2 | 1 | 2 | 1.0 | |||
| M4-CVE_2018_8174_windows_h1 | degree | 388 | 2 | 9 | 1 | 0.5 | |||
| M4-CVE_2018_8174_windows_h1 | random (expected) | 388 | 2 | 129.7 | 0.052 | 0.026 | |||
| M4-CVE_2018_8174_windows_h2 | iforest | 344 | 3 | 10 | 1.9 | [1.674, 2.126] | 3.0 | 1.0 | [1.0, 1.0] |
| M4-CVE_2018_8174_windows_h2 | iforest-no-userdir | 344 | 3 | 10 | 2.0 | [2.0, 2.0] | 2.0 | 0.667 | [0.667, 0.667] |
| M4-CVE_2018_8174_windows_h2 | user-dir image first (heuristic) | 344 | 3 | 1 | 3 | 1.0 | |||
| M4-CVE_2018_8174_windows_h2 | degree | 344 | 3 | 8 | 1 | 0.333 | |||
| M4-CVE_2018_8174_windows_h2 | random (expected) | 344 | 3 | 86.2 | 0.087 | 0.029 | |||
| M5-CVE-2017-0199_windows_py_h1 | iforest | 837 | 3 | 10 | 1.7 | [1.354, 2.046] | 1.0 | 0.333 | [0.333, 0.333] |
| M5-CVE-2017-0199_windows_py_h1 | iforest-no-userdir | 837 | 3 | 10 | 2.4 | [2.031, 2.769] | 1.0 | 0.333 | [0.333, 0.333] |
| M5-CVE-2017-0199_windows_py_h1 | user-dir image first (heuristic) | 837 | 3 | 1 | 3 | 1.0 | |||
| M5-CVE-2017-0199_windows_py_h1 | degree | 837 | 3 | 6 | 1 | 0.333 | |||
| M5-CVE-2017-0199_windows_py_h1 | random (expected) | 837 | 3 | 209.5 | 0.036 | 0.012 | |||
| M5-CVE-2017-0199_windows_py_h2 | iforest | 333 | 4 | 10 | 2.0 | [2.0, 2.0] | 4.0 | 1.0 | [1.0, 1.0] |
| M5-CVE-2017-0199_windows_py_h2 | iforest-no-userdir | 333 | 4 | 10 | 2.0 | [2.0, 2.0] | 2.0 | 0.5 | [0.5, 0.5] |
| M5-CVE-2017-0199_windows_py_h2 | user-dir image first (heuristic) | 333 | 4 | 1 | 4 | 1.0 | |||
| M5-CVE-2017-0199_windows_py_h2 | degree | 333 | 4 | 1 | 1 | 0.25 | |||
| M5-CVE-2017-0199_windows_py_h2 | random (expected) | 333 | 4 | 66.8 | 0.12 | 0.03 | |||
| M6-CVE-2017-11882_windows_h1 | iforest | 427 | 7 | 10 | 2.3 | [1.954, 2.646] | 3.7 | 0.528 | [0.479, 0.577] |
| M6-CVE-2017-11882_windows_h1 | iforest-no-userdir | 427 | 7 | 10 | 3.1 | [2.874, 3.326] | 3.6 | 0.514 | [0.462, 0.567] |
| M6-CVE-2017-11882_windows_h1 | user-dir image first (heuristic) | 427 | 7 | 1 | 1 | 0.143 | |||
| M6-CVE-2017-11882_windows_h1 | degree | 427 | 7 | 9 | 1 | 0.143 | |||
| M6-CVE-2017-11882_windows_h1 | random (expected) | 427 | 7 | 53.5 | 0.164 | 0.023 | |||
| M6-CVE-2017-11882_windows_h2 | iforest | 453 | 2 | 10 | 1.6 | [1.231, 1.969] | 1.0 | 0.5 | [0.5, 0.5] |
| M6-CVE-2017-11882_windows_h2 | iforest-no-userdir | 453 | 2 | 10 | 2.0 | [2.0, 2.0] | 1.0 | 0.5 | [0.5, 0.5] |
| M6-CVE-2017-11882_windows_h2 | user-dir image first (heuristic) | 453 | 2 | 1 | 2 | 1.0 | |||
| M6-CVE-2017-11882_windows_h2 | degree | 453 | 2 | 9 | 1 | 0.5 | |||
| M6-CVE-2017-11882_windows_h2 | random (expected) | 453 | 2 | 151.3 | 0.044 | 0.022 | |||
| S1-CVE-2015-5122_windows | iforest | 324 | 2 | 10 | 1.9 | [1.674, 2.126] | 1.9 | 0.95 | [0.837, 1.0] |
| S1-CVE-2015-5122_windows | iforest-no-userdir | 324 | 2 | 10 | 2.4 | [2.031, 2.769] | 1.0 | 0.5 | [0.5, 0.5] |
| S1-CVE-2015-5122_windows | user-dir image first (heuristic) | 324 | 2 | 1 | 2 | 1.0 | |||
| S1-CVE-2015-5122_windows | degree | 324 | 2 | 5 | 1 | 0.5 | |||
| S1-CVE-2015-5122_windows | random (expected) | 324 | 2 | 108.3 | 0.062 | 0.031 | |||
| S2-CVE-2015-3105_windows | iforest | 704 | 1 | 10 | 1.1 | [1.0, 1.326] | 1.0 | 1.0 | [1.0, 1.0] |
| S2-CVE-2015-3105_windows | iforest-no-userdir | 704 | 1 | 10 | 1.9 | [1.674, 2.126] | 1.0 | 1.0 | [1.0, 1.0] |
| S2-CVE-2015-3105_windows | user-dir image first (heuristic) | 704 | 1 | 1 | 1 | 1.0 | |||
| S2-CVE-2015-3105_windows | degree | 704 | 1 | 3 | 1 | 1.0 | |||
| S2-CVE-2015-3105_windows | random (expected) | 704 | 1 | 352.5 | 0.014 | 0.014 | |||
| S3-CVE-2017-11882_windows | iforest | 334 | 6 | 10 | 2.0 | [2.0, 2.0] | 4.0 | 0.667 | [0.667, 0.667] |
| S3-CVE-2017-11882_windows | iforest-no-userdir | 334 | 6 | 10 | 3.3 | [2.817, 3.783] | 3.0 | 0.5 | [0.5, 0.5] |
| S3-CVE-2017-11882_windows | user-dir image first (heuristic) | 334 | 6 | 1 | 2 | 0.333 | |||
| S3-CVE-2017-11882_windows | degree | 334 | 6 | 8 | 1 | 0.167 | |||
| S3-CVE-2017-11882_windows | random (expected) | 334 | 6 | 47.9 | 0.18 | 0.03 | |||
| S4-CVE-2017-0199_windows_py | iforest | 318 | 3 | 10 | 2.0 | [2.0, 2.0] | 2.5 | 0.834 | [0.708, 0.959] |
| S4-CVE-2017-0199_windows_py | iforest-no-userdir | 318 | 3 | 10 | 2.0 | [2.0, 2.0] | 2.0 | 0.667 | [0.667, 0.667] |
| S4-CVE-2017-0199_windows_py | user-dir image first (heuristic) | 318 | 3 | 1 | 3 | 1.0 | |||
| S4-CVE-2017-0199_windows_py | degree | 318 | 3 | 1 | 1 | 0.333 | |||
| S4-CVE-2017-0199_windows_py | random (expected) | 318 | 3 | 79.8 | 0.094 | 0.031 |
Tagger coverage: Splunk attack_data Linux captures (dev / dev2 / sealed)¶
Source: commit 60e35616b128, GitHub Actions sealed-coverage run 36994398382.
Protocol: docs/protocol.md. dev and dev2 are in-sample for v0.3; sealed was scored once with the frozen rules. Technique match is at parent-technique level. Intervals are 95 % Wilson. Alert precision is the share of alerts naming the capture's technique (a lower-bound proxy). unparsed captures yielded zero events and are excluded.
| split | captures | unparsed | parsed | v01 detected | v01 technique | v01 alert prec. | v02 detected | v02 technique | v02 alert prec. | v03 detected | v03 technique | v03 alert prec. |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| dev | 46 | 1 | 45 | 3/45 [0.02, 0.18] | 0/45 [0.00, 0.08] | 0.0 | 32/45 [0.57, 0.82] | 27/45 [0.46, 0.73] | 0.83 | 34/45 [0.61, 0.86] | 27/45 [0.46, 0.73] | 0.8 |
| dev2 | 27 | 0 | 27 | 9/27 [0.19, 0.52] | 4/27 [0.06, 0.33] | 0.724 | 12/27 [0.28, 0.63] | 5/27 [0.08, 0.37] | 0.391 | 23/27 [0.68, 0.94] | 14/27 [0.34, 0.69] | 0.367 |
| sealed | 160 | 96 | 64 | 3/64 [0.02, 0.13] | 1/64 [0.00, 0.08] | 0.25 | 4/64 [0.03, 0.15] | 1/64 [0.00, 0.08] | 0.2 | 4/64 [0.03, 0.15] | 1/64 [0.00, 0.08] | 0.2 |
| sealed-unseen-technique | 73 | 45 | 28 | 1/28 [0.01, 0.18] | 0/28 [0.00, 0.12] | 0.0 | 2/28 [0.02, 0.23] | 0/28 [0.00, 0.12] | 0.0 | 2/28 [0.02, 0.23] | 0/28 [0.00, 0.12] | 0.0 |
| sealed-excluding-v03-target-techniques | 117 | 66 | 51 | 3/51 [0.02, 0.16] | 1/51 [0.00, 0.10] | None |
Per-dataset
| split | technique | dataset | events | v01_alerts | v02_alerts | v03_alerts | v03_rules |
|---|---|---|---|---|---|---|---|
| dev | T1082 | attack_techniques/T1082/atomic_red_team/linux-sysmon.log | 2 | 0 | 0 | 0 | [] |
| dev | T1068 | attack_techniques/T1068/pkexec/linux-sysmon.log | 2 | 0 | 1 | 1 | ['RL-016'] |
| dev | T1021.004 | attack_techniques/T1021.004/atomic_red_team/linux-sysmon.log | 2 | 0 | 1 | 1 | ['RL-014'] |
| dev | T1548 | attack_techniques/T1548/telnet/sysmon_linux.log | 2 | 0 | 1 | 1 | ['RL-016'] |
| dev | T1068 | attack_techniques/T1068/linux_pedit/sysmon_linux.log | 2 | 0 | 0 | 0 | [] |
| dev | T1027 | attack_techniques/T1027/url_encoded_curl/linux-sysmon.log | 2 | 0 | 2 | 2 | ['RL-009', 'RL-010'] |
| dev | T1489 | attack_techniques/T1489/linux_auditd_sysmon_service_stop/linux_auditd_sysmon_service_stop.log | 0 | 0 | 0 | 0 | [] |
| dev | T1548 | attack_techniques/T1548/busybox/sysmon_linux.log | 4 | 0 | 1 | 2 | ['RL-008', 'RL-021'] |
| dev | T1548 | attack_techniques/T1548/rpm/sysmon_linux.log | 4 | 0 | 0 | 0 | [] |
| dev | T1548 | attack_techniques/T1548/apt_get/sysmon_linux.log | 4 | 0 | 1 | 1 | ['RL-008'] |
| dev | T1098.004 | attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon.log | 5 | 1 | 1 | 1 | ['RL-005'] |
| dev | T1548 | attack_techniques/T1548/c99/sysmon_linux.log | 6 | 0 | 0 | 0 | [] |
| dev | T1548 | attack_techniques/T1548/csvtool/sysmon_linux.log | 8 | 0 | 1 | 1 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/gawk/sysmon_linux.log | 8 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/gem/sysmon_linux.log | 8 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1014 | attack_techniques/T1014/medusa_rootkit/sysmon_linux.log | 7 | 0 | 5 | 5 | ['RL-017'] |
| dev | T1548 | attack_techniques/T1548/puppet/sysmon_linux.log | 8 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1068 | attack_techniques/T1068/linux_dirtyfrag/linux_sysmon.log | 8 | 0 | 1 | 1 | ['RL-016'] |
| dev | T1548 | attack_techniques/T1548/make/sysmon_linux.log | 4 | 0 | 0 | 0 | [] |
| dev | T1548 | attack_techniques/T1548/ruby/sysmon_linux.log | 12 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/find/sysmon_linux.log | 12 | 0 | 3 | 3 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/octave/sysmon_linux.log | 12 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/composer/sysmon_linux.log | 12 | 0 | 0 | 0 | [] |
| dev | T1548 | attack_techniques/T1548/sqlite3/sysmon_linux.log | 16 | 0 | 3 | 3 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/openvpn/sysmon_linux.log | 16 | 0 | 3 | 3 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/mysql/sysmon_linux.log | 16 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/cpulimit/sysmon_linux.log | 18 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/php/sysmon_linux.log | 20 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/c89/sysmon_linux.log | 20 | 0 | 0 | 0 | [] |
| dev | T1548 | attack_techniques/T1548/node/sysmon_linux.log | 20 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1572 | attack_techniques/T1572/ngrok/ngrok_linux-sysmon.log | 10 | 0 | 2 | 2 | ['RL-013'] |
| dev | T1548 | attack_techniques/T1548/gdb/sysmon_linux.log | 26 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1027 | attack_techniques/T1027/atomic_red_team/linux-sysmon.log | 27 | 0 | 6 | 6 | ['RL-009'] |
| dev | T1548 | attack_techniques/T1548/awk/sysmon_linux.log | 36 | 0 | 2 | 2 | ['RL-008'] |
| dev | T1548 | attack_techniques/T1548/emacs/sysmon_linux.log | 38 | 0 | 0 | 0 | [] |
| dev | T1115 | attack_techniques/T1115/atomic_red_team/linux-sysmon.log | 43 | 0 | 5 | 5 | ['RL-015'] |
| dev | T1105 | attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log | 68 | 0 | 24 | 24 | ['RL-010'] |
| dev | T1548 | attack_techniques/T1548/apt/sysmon_linux.log | 66 | 0 | 1 | 1 | ['RL-008'] |
| dev | T1105 | attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log | 154 | 0 | 0 | 0 | [] |
| dev | T1190 | attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log | 157 | 0 | 0 | 0 | [] |
| dev | T1053.003 | attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux.log | 355 | 0 | 0 | 0 | [] |
| dev | malware/awfulshred | malware/awfulshred/test3/sysmon_linux.log | 530 | 0 | 0 | 3 | ['RL-021'] |
| dev | T1548 | attack_techniques/T1548/docker/sysmon_linux.log | 631 | 0 | 1 | 1 | ['RL-010'] |
| dev | T1485 | attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux.log | 812 | 1 | 6 | 6 | ['RL-006', 'RL-011'] |
| dev | T1485 | attack_techniques/T1485/rm_boot_dir/sysmon_linux.log | 726 | 1 | 9 | 9 | ['RL-006', 'RL-011'] |
| dev | T1059.004 | attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log | 3731 | 0 | 0 | 1 | ['RL-024'] |
| dev2 | T1003.008 | attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log | 11120 | 0 | 0 | 2 | ['RL-021', 'RL-024'] |
| dev2 | T1016 | attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log | 18203 | 0 | 1 | 1 | ['RL-018'] |
| dev2 | T1053.002 | attack_techniques/T1053.002/at_execution/sysmon_linux.log | 54025 | 3 | 3 | 3 | ['RL-002', 'RL-005'] |
| dev2 | T1053.003 | attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log | 59682 | 18 | 21 | 21 | ['RL-002', 'RL-005', 'RL-008'] |
| dev2 | T1053.003 | attack_techniques/T1053.003/cronjobs_entry/sysmon_linux_cron_append.log | 7598 | 8 | 8 | 8 | ['RL-005'] |
| dev2 | T1053.003 | attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux.log | 57862 | 18 | 18 | 18 | ['RL-002', 'RL-005'] |
| dev2 | T1053.006 | attack_techniques/T1053.006/service_systemd/sysmon_linux.log | 59809 | 2 | 2 | 21 | ['RL-005', 'RL-023'] |
| dev2 | T1098.004 | attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log | 14571 | 0 | 0 | 0 | [] |
| dev2 | T1190 | attack_techniques/T1190/outbound_java/linux-sysmon.log | 12229 | 1 | 1 | 1 | ['RL-003'] |
| dev2 | T1485 | attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log | 6922 | 0 | 2 | 2 | ['RL-011'] |
| dev2 | T1489 | attack_techniques/T1489/linux_service_stop_disable/sysmon_linux.log | 4486 | 1 | 10 | 18 | ['RL-006', 'RL-008', 'RL-011', 'RL-023'] |
| dev2 | T1546.004 | attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log | 42359 | 0 | 0 | 1 | ['RL-023'] |
| dev2 | T1547.006 | attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log | 15662 | 0 | 0 | 5 | ['RL-020'] |
| dev2 | T1548.001 | attack_techniques/T1548.001/chmod_uid/sysmon_linux.log | 23666 | 0 | 0 | 3 | ['RL-019'] |
| dev2 | T1548.001 | attack_techniques/T1548.001/linux_setcap/sysmon_linux.log | 16027 | 0 | 0 | 1 | ['RL-019'] |
| dev2 | T1548.003 | attack_techniques/T1548.003/doas/sysmon_linux.log | 7588 | 0 | 0 | 1 | ['RL-021'] |
| dev2 | T1548.003 | attack_techniques/T1548.003/doas_exec/sysmon_linux.log | 14888 | 0 | 0 | 0 | [] |
| dev2 | T1548.003 | attack_techniques/T1548.003/linux_adduser/sysmon_linux.log | 11448 | 2 | 3 | 3 | ['RL-005', 'RL-008'] |
| dev2 | T1548.003 | attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log | 33785 | 0 | 0 | 2 | ['RL-021'] |
| dev2 | T1548.003 | attack_techniques/T1548.003/sudo_su/sysmon_linux.log | 12271 | 0 | 0 | 1 | ['RL-021'] |
| dev2 | T1548.003 | attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log | 6748 | 0 | 0 | 0 | [] |
| dev2 | T1548.003 | attack_techniques/T1548.003/visudo/sysmon_linux.log | 29830 | 0 | 0 | 3 | ['RL-021'] |
| dev2 | T1574.006 | attack_techniques/T1574.006/lib_hijack/sysmon_linux.log | 27457 | 0 | 0 | 0 | [] |
| dev2 | malware/acidrain | malware/acidrain/sysmon_linux.log | 17326 | 5 | 39 | 46 | ['RL-006', 'RL-008', 'RL-019', 'RL-023'] |
| dev2 | malware/awfulshred | malware/awfulshred/test1/sysmon_linux.log | 31708 | 0 | 2 | 2 | ['RL-011'] |
| dev2 | malware/awfulshred | malware/awfulshred/test2/sysmon_linux.log | 42623 | 0 | 0 | 2 | ['RL-021'] |
| dev2 | malware/cyclopsblink | malware/cyclopsblink/sysmon_linux.log | 80736 | 0 | 0 | 1 | ['RL-021'] |
| sealed | T1003.008 | attack_techniques/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1003.008 | attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1014 | attack_techniques/T1014/snapattack/snapattack_linux.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1016 | attack_techniques/T1016/linux_auditd_net_tool/linux_auditd_net_tool.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1016 | attack_techniques/T1016/linux_auditd_net_tool_new/linux_auditd_net_tool_bucket_new.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1021.004 | attack_techniques/T1021.004/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1030 | attack_techniques/T1030/linux_auditd_split_b_exec/auditd_execve_split.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1030 | attack_techniques/T1030/linux_auditd_split_b_exec/linux_auditd_split_b_exec.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1030 | attack_techniques/T1030/linux_auditd_split_syscall/linux_auditd_split_syscall.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1030 | attack_techniques/T1030/linux_auditd_split_syscall_new/linux_auditd_new_split.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1033 | attack_techniques/T1033/linux_auditd_whoami/linux_auditd_whoami.log | 3 | 0 | 0 | 0 | [] |
| sealed | T1033 | attack_techniques/T1033/linux_auditd_whoami_new/linux_auditd_new_whoami.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1033 | attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1033 | attack_techniques/T1033/snapattack/snapattack_linux.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1036.004 | attack_techniques/T1036.004/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1036 | attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1036 | attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1036 | attack_techniques/T1036/snapattack/snapattack_linux.log | 3 | 1 | 1 | 1 | ['RL-007'] |
| sealed | T1037.005 | attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1037.005 | attack_techniques/T1037.005/snapattack/snapattack_linux.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1046 | attack_techniques/T1046/open_dns_port/linux_dns_openports.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1046 | attack_techniques/T1046/open_ports_discovery/linux_known_openports.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1053.002 | attack_techniques/T1053.002/linux_auditd_at/linux_auditd_at_execution.log | 5 | 0 | 0 | 0 | [] |
| sealed | T1053.002 | attack_techniques/T1053.002/linux_auditd_chown_root/auditd_proctitle_chown_root.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1053.002 | attack_techniques/T1053.002/linux_auditd_chown_root/linux_auditd_chown_root.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1053.002 | attack_techniques/T1053.002/linux_new_auditd_at/linux_auditd_new_at.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1053.003 | attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_auditd_cron_file_audited2.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1053.003 | attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_path_cron.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1053.003 | attack_techniques/T1053.003/linux_auditd_crontab_edit/linux_auditd_crontab_edit.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1053.003 | attack_techniques/T1053.003/linux_auditd_crontab_edit_new/linux_auditd_new_crontab.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1053.006 | attack_techniques/T1053.006/linux_services_restart/auditd_proctitle_service_restart.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1053.006 | attack_techniques/T1053.006/linux_services_restart/linux_services_restart.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1059.004 | attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1059.004 | attack_techniques/T1059.004/snapattack/snapattack_linux.log | 5 | 0 | 0 | 0 | [] |
| sealed | T1059 | attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1059 | attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log | 2 | 1 | 1 | 1 | ['RL-002'] |
| sealed | T1059 | attack_techniques/T1059/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1068 | attack_techniques/T1068/linux_auditd_copy_fail/linux_auditd.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1068 | attack_techniques/T1068/linux_dirtyfrag/audit.log | 12 | 0 | 0 | 0 | [] |
| sealed | T1068 | attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed.log | 3 | 0 | 0 | 0 | [] |
| sealed | T1068 | attack_techniques/T1068/linux_pedit/linux_auditd.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1068 | attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1068 | attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1068 | attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1068 | attack_techniques/T1068/snapattack/snapattack_linux.log | 7 | 0 | 0 | 0 | [] |
| sealed | T1082 | attack_techniques/T1082/linux_auditd_lsmod/linux_auditd_lsmod.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1082 | attack_techniques/T1082/linux_auditd_lsmod_new/linux_auditd_new_lsmod.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1082 | attack_techniques/T1082/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1083 | attack_techniques/T1083/linux_auditd_find_db/linux_auditd_find_db.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1083 | attack_techniques/T1083/linux_auditd_find_document/auditd_execve_file_dir_discovery.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1083 | attack_techniques/T1083/linux_auditd_find_document/linux_auditd_find_document.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1083 | attack_techniques/T1083/linux_auditd_find_virtual_disk/auditd_execve_find_vhd.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1083 | attack_techniques/T1083/linux_auditd_find_virtual_disk/linux_auditd_find_virtual_disk.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1083 | attack_techniques/T1083/linux_auditd_hidden_file/auditd_execve_hidden_file.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1083 | attack_techniques/T1083/linux_auditd_hidden_file/linux_auditd_hidden_file.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1098.004 | attack_techniques/T1098.004/linux_auditd_nopasswd/linux_auditd_ssh_config.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1098.004 | attack_techniques/T1098.004/linux_auditd_nopasswd/linux_path_ssh_config.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1098 | attack_techniques/T1098/linux_password_change/linux_unix_change_pwd.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1098 | attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1098 | attack_techniques/T1098/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1102 | attack_techniques/T1102/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1105 | attack_techniques/T1105/download_to_pipe_exec/download_to_pipe_exec_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1115 | attack_techniques/T1115/linux_auditd_xclip/linux_auditd_xclip.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1115 | attack_techniques/T1115/linux_auditd_xclip/linux_auditd_xclip2.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1129 | attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1129 | attack_techniques/T1129/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1136.001 | attack_techniques/T1136.001/linux_auditd_add_user/auditd_proctitle_user_add.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1136.001 | attack_techniques/T1136.001/linux_auditd_add_user/linux_auditd_add_user.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1136.001 | attack_techniques/T1136.001/linux_auditd_add_user_type/linux_auditd_add_user_type.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1136 | attack_techniques/T1136/linux_unix_new_user/linux_new_user.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1140 | attack_techniques/T1140/linux_auditd_base64/auditd_execve_base64.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1140 | attack_techniques/T1140/linux_auditd_base64/linux_auditd_base64.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1190 | attack_techniques/T1190/linux_cve-2023-33246_rocketmq_exploitation/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1190 | attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1190 | attack_techniques/T1190/snapattack/snapattack_linux.log | 7 | 0 | 0 | 0 | [] |
| sealed | T1200 | attack_techniques/T1200/linux_auditd_swapoff/linux_auditd_swapoff.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1200 | attack_techniques/T1200/linux_auditd_swapoff/linux_auditd_swapoff2.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1204.002 | attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1204.002 | attack_techniques/T1204.002/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1222.002 | attack_techniques/T1222.002/linux_auditd_chattr_i/auditd_proctitle_chattr.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1222.002 | attack_techniques/T1222.002/linux_auditd_chattr_i/linux_auditd_chattr_i.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1222.002 | attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/auditd_proctitle_chmod.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1222.002 | attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1485 | attack_techniques/T1485/linux_auditd_dd_overwrite/auditd_proctitle_dd_overwrite.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1485 | attack_techniques/T1485/linux_auditd_dd_overwrite/linux_auditd_dd_overwrite.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1485 | attack_techniques/T1485/linux_auditd_no_preserve_root/auditd_proctitle_rm_rf.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1485 | attack_techniques/T1485/linux_auditd_no_preserve_root/linux_auditd_no_preserve_root.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1485 | attack_techniques/T1485/linux_auditd_shred/auditd_proctitle_shred.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1485 | attack_techniques/T1485/linux_auditd_shred/linux_auditd_shred.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1489 | attack_techniques/T1489/linux_auditd_auditd_service_stop/linux_auditd_auditd_service_stop.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1489 | attack_techniques/T1489/linux_auditd_osquerd_service_stop/linux_auditd_osquerd_service_stop.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1489 | attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1496 | attack_techniques/T1496/process_high_cpu_usage/linux_max_cpu2.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1496 | attack_techniques/T1496/process_high_mem_usage/linux_max_mem.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1505 | attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1505 | attack_techniques/T1505/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1529 | attack_techniques/T1529/linux_sysrq_abuse/linux_sysrq_abuse.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1531 | attack_techniques/T1531/linux_unix_delete_user/linux_del_user.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1542 | attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1542 | attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1542 | attack_techniques/T1542/snapattack/snapattack_linux.log | 3 | 0 | 0 | 0 | [] |
| sealed | T1543.002 | attack_techniques/T1543.002/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1546.004 | attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_auditd_unix_shell_mod_config.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1546.004 | attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_path_profile_d.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1547.006 | attack_techniques/T1547.006/linux_auditd_insmod/linux_auditd_insmod.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1547.006 | attack_techniques/T1547.006/linux_auditd_insmod_new/linux_auditd_new_insmod.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1547.006 | attack_techniques/T1547.006/linux_auditd_modprobe/linux_auditd_modprobe.log | 3 | 0 | 0 | 0 | [] |
| sealed | T1547.006 | attack_techniques/T1547.006/linux_auditd_modprobe_new/linux_auditd_new_modprobe.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1547.006 | attack_techniques/T1547.006/linux_auditd_modprobe_unload_module/auditd_execve_modprobe.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1547.006 | attack_techniques/T1547.006/linux_auditd_modprobe_unload_module/linux_auditd_modprobe_unload_module.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1547.006 | attack_techniques/T1547.006/linux_auditd_rmmod/linux_auditd_rmmod.log | 1 | 0 | 0 | 0 | [] |
| sealed | T1547.006 | attack_techniques/T1547.006/linux_auditd_rmmod_new/linux_auditd_new_rmmod.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1547 | attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1547 | attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1547 | attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1547 | attack_techniques/T1547/snapattack/snapattack_linux.log | 3 | 0 | 0 | 0 | [] |
| sealed | T1548.001 | attack_techniques/T1548.001/linux_auditd_setuid/auditd_execve_setcap.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.001 | attack_techniques/T1548.001/linux_auditd_setuid/auditd_proctitle_setuid.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.001 | attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setcap_priv.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.001 | attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setuid.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_auditd_doas/linux_auditd_doas.log | 7 | 2 | 2 | 2 | ['RL-004'] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_auditd_doas_new/linux_auditd_new_doas.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd2.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_auditd_sudo_su/auditd_proctitle_sudo.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_auditd_sudo_su/linux_auditd_sudo_su.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_path_sudoers.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_audited_doas_conf/linux_audited_doas_conf.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_audited_doas_conf/linux_path_doas_config.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/linux_suspicious_sudo_parameter/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1548.003 | attack_techniques/T1548.003/snapattack/snapattack_linux.log | 2 | 0 | 0 | 0 | [] |
| sealed | T1548 | attack_techniques/T1548/linux_risk/linuxrisk.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1552.001 | attack_techniques/T1552.001/password_in_username/linux_secure.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1552.003 | attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1552.003 | attack_techniques/T1552.003/snapattack/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1552.004 | attack_techniques/T1552.004/linux_auditd_find_gpg/auditd_execve_find_gpg.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1552.004 | attack_techniques/T1552.004/linux_auditd_find_gpg/linux_auditd_find_gpg.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1552.004 | attack_techniques/T1552.004/linux_auditd_find_ssh_files/auditd_execve_find_ssh.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1552.004 | attack_techniques/T1552.004/linux_auditd_find_ssh_files/linux_auditd_find_ssh_files.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1555.005 | attack_techniques/T1555.005/linux_auditd_find_credentials/auditd_execve_find_creds.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1555.005 | attack_techniques/T1555.005/linux_auditd_find_credentials/linux_auditd_find_credentials.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1555.005 | attack_techniques/T1555.005/linux_auditd_find_password_db/auditd_execve_pwd_mgr.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1555.005 | attack_techniques/T1555.005/linux_auditd_find_password_db/linux_auditd_find_password_db.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1562.004 | attack_techniques/T1562.004/linux_auditd_disable_firewall/linux_auditd_disable_firewall.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1562.012 | attack_techniques/T1562.012/auditd_daemon_end/linux_daemon_end.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1562.012 | attack_techniques/T1562.012/auditd_daemon_type/linux_auditd_daemon.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1562 | attack_techniques/T1562/disable_linux_firewall/Linux_service_inactive.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1564.001 | attack_techniques/T1564.001/linux_auditd_hidden_file/linux_auditd_hidden_file.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1567 | attack_techniques/T1567/gdrive/gdrive_linux.log | 6 | 0 | 0 | 0 | [] |
| sealed | T1569.002 | attack_techniques/T1569.002/linux_service_start/auditd_proctitle_service_start.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1569.002 | attack_techniques/T1569.002/linux_service_start/linux_service_start.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1574.006 | attack_techniques/T1574.006/linux_auditd_ldpreload/auditd_execve_ldpreload.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1574.006 | attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1574.006 | attack_techniques/T1574.006/linux_auditd_preload_file/linux_auditd_preload_file.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1574.006 | attack_techniques/T1574.006/linux_auditd_preload_file/linux_path_preload.log | 0 | 0 | 0 | 0 | [] |
| sealed | T1608 | attack_techniques/T1608/snapattack/snapattack_linux.log | 2 | 0 | 1 | 1 | ['RL-010'] |
| sealed | T1610 | attack_techniques/T1610/linux_suspicious_docker_build/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1610 | attack_techniques/T1610/linux_suspicious_privileged_container/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
| sealed | T1610 | attack_techniques/T1610/snapattack/snapattack_linux.log | 4 | 0 | 0 | 0 | [] |
OTRF Log4Shell (CVE-2021-44228): single sensor vs fused sensors¶
Source: scripts/bench.py --only log4shell, rootline 1.1.0, commit cde2a392b1e8, GitHub Actions bench run 37092501921, Python 3.12.14.
| input | events | vertices | alerts | story_vertices | root_causes | reaches_java | reaches_ldap_1389 | seconds |
|---|---|---|---|---|---|---|---|---|
| sysmon-only | 103 | 101 | 2 | 10 | [] | False | False | 0.058 |
| sysmon+auoms | 108 | 105 | 2 | 13 | ['192.168.2.6:8888', '192.168.2.6:1389'] | True | True | 0.024 |