tripline coverage report

Sigma rules replayed against recorded ATT&CK emulation telemetry. Generated 2026-11-12 17:36 UTC by tripline 0.3.0.

Gate passed
Weighted coverage, all scenarios
98%
pending scenarios count as zero
Weighted coverage on unmodified SigmaHQ rules alone
52%
8 scenarios; the other 5 passing scenarios need a rule written for this project
Weighted coverage, scenarios with fixtures
100%
13 of 14 scenarios have fixtures
Scenarios
13 / 14 pass
0 failed, 1 pending
False positives, benign corpus
2 matches
1 of 6 evaluated rules fired on 675 benign events
Evasion sweep (Linux)
200 / 251 variants
command-line variants caught by an expected rule
Expected rules
21
14 techniques across 9 tactics
Prevalence weight points (62 total, weight 1-10 per technique)
Passed 61 Failed 0 Pending (no fixtures) 1

Coverage by tactic

Initial Access 1

T1078.004
Cloud Accounts: console login without MFA
✓ Pass AWS
weight 10
rules fired: 2/2 · 7 events
Rule evidence
  • ✓ AWS Console Login Without MFA
    1/7 applicable events
  • ✓ AWS Root Credentials
    6/7 applicable events

Execution 3

T1059.001
PowerShell: encoded command
✓ Pass Windows
weight 9
rules fired: 1/1 · 154 events
Rule evidence
  • ✓ Suspicious Execution of Powershell with Base64
    3/22 applicable events
T1059.003
Windows Command Shell: cmd output redirected to a suspicious folder
✓ Pass Windows
weight 8
rules fired: 1/1 · 26 events
Rule evidence
  • ✓ CMD Output Redirected to a Relative Path From a Suspicious Working Directory
    2/11 applicable events
T1047
WMI: wmic process call create
✓ Pass Windows
weight 4
rules fired: 1/1 · 12 events
Rule evidence
  • ✓ Process Creation Attempt via Wmic.EXE
    1/5 applicable events

Persistence 3

T1098.001
Account Manipulation: access key created for another IAM user
✓ Pass AWS
weight 3
rules fired: 1/1 · 1 events
Rule evidence
  • ✓ AWS IAM Backdoor Users Keys
    1/1 applicable events
T1053.003
Cron persistence
✓ Pass Linux
weight 2
rules fired: 2/2 · 42 events
Rule evidence
  • ✓ Scheduled Cron Task/Job - Linux
    1/26 applicable events
  • ✓ New Cron File Created
    1/3 applicable events
T1053.005
Scheduled Task persistence via schtasks
✓ Pass Windows
weight 2
rules fired: 2/2 · 11 events
Rule evidence
  • ✓ Scheduled Task Creation Via Schtasks.EXE
    1/4 applicable events
  • ✓ Scheduled Task Created With a Command Interpreter or LOLBin Action
    1/6 applicable events

Privilege Escalation 1

T1548.001
Abuse Elevation Control: setuid/setgid bit set
✓ Pass Linux
weight 2
rules fired: 1/1 · 84 events
Rule evidence
  • ✓ Setuid or Setgid Bit Set via Chmod (Any Mode Form)
    2/36 applicable events

Stealth 2

T1070.003
Indicator Removal: clear command history
✓ Pass Linux
weight 2
rules fired: 2/2 · 38 events
Rule evidence
  • ✓ Linux Command History Tampering
    3/28 applicable events
  • ✓ History File Deletion
    1/26 applicable events
T1027
Obfuscated Files or Information: obfuscated PowerShell one-liner
○ Pending Windows
weight 1
rules: 1 expected
Rule evidence
  • ○ Obfuscated PowerShell OneLiner Execution
    no fixtures

Defense Impairment 1

T1685.002
Disable or Modify Cloud Log: CloudTrail logging stopped
✓ Pass AWS
weight 3
rules fired: 1/1 · 1 events
Rule evidence
  • ✓ AWS CloudTrail Important Change
    1/1 applicable events

Credential Access 1

T1003.001
OS Credential Dumping: LSASS memory via comsvcs MiniDump
✓ Pass Windows
weight 3
rules fired: 2/2 · 70 events
Rule evidence
  • ✓ Process Memory Dump Via Comsvcs.DLL
    2/6 applicable events
  • ✓ Potential Credential Dumping Activity Via LSASS
    1/4 applicable events

Collection 1

T1530
Data from Cloud Storage: S3 bucket made public and enumerated
✓ Pass AWS
weight 7
rules fired: 2/2 · 10 events
Rule evidence
  • ✓ AWS S3 Bucket Made Public via ACL or Bucket Policy
    6/10 applicable events
  • ✓ AWS S3 Bucket Enumeration by IAM User from Non-AWS Tooling
    4/10 applicable events

Command and Control 1

T1105
Ingress Tool Transfer: certutil and bitsadmin downloads
✓ Pass Windows
weight 6
rules fired: 2/2 · 33 events
Rule evidence
  • ✓ Suspicious Download Via Certutil.EXE
    1/9 applicable events
  • ✓ File Download Via Bitsadmin
    1/9 applicable events

No scenarios yet: Reconnaissance, Resource Development, Discovery, Lateral Movement, Exfiltration, Impact.

Scenarios

ScenarioTechniqueTacticPlaneWeightStatusExpected rules (hits / applicable events)
t1078-004-console-login-without-mfa T1078.004 Initial Access AWS 10 ✓ Pass
  • AWS Console Login Without MFA (1/7)
  • AWS Root Credentials (6/7)
t1059-001-powershell-encoded-download T1059.001 Execution Windows 9 ✓ Pass
  • Suspicious Execution of Powershell with Base64 (3/22)
t1059-003-cmd-suspicious-redirect T1059.003 Execution Windows 8 ✓ Pass
  • CMD Output Redirected to a Relative Path From a Suspicious Working Directory (2/11)
t1530-s3-bucket-exposure T1530 Collection AWS 7 ✓ Pass
  • AWS S3 Bucket Made Public via ACL or Bucket Policy (6/10)
  • AWS S3 Bucket Enumeration by IAM User from Non-AWS Tooling (4/10)
t1105-certutil-bitsadmin-download T1105 Command and Control Windows 6 ✓ Pass
  • Suspicious Download Via Certutil.EXE (1/9)
  • File Download Via Bitsadmin (1/9)
t1047-wmic-process-call-create T1047 Execution Windows 4 ✓ Pass
  • Process Creation Attempt via Wmic.EXE (1/5)
t1003-001-lsass-memory-dump T1003.001 Credential Access Windows 3 ✓ Pass
  • Process Memory Dump Via Comsvcs.DLL (2/6)
  • Potential Credential Dumping Activity Via LSASS (1/4)
t1098-001-iam-backdoor-access-key T1098.001 Persistence AWS 3 ✓ Pass
  • AWS IAM Backdoor Users Keys (1/1)
t1562-008-cloudtrail-stop T1685.002 Defense Impairment AWS 3 ✓ Pass
  • AWS CloudTrail Important Change (1/1)
t1053-003-cron-persistence T1053.003 Persistence Linux 2 ✓ Pass
  • Scheduled Cron Task/Job - Linux (1/26)
  • New Cron File Created (1/3)
t1053-005-scheduled-task-persistence T1053.005 Persistence Windows 2 ✓ Pass
  • Scheduled Task Creation Via Schtasks.EXE (1/4)
  • Scheduled Task Created With a Command Interpreter or LOLBin Action (1/6)
t1070-003-clear-command-history T1070.003 Stealth Linux 2 ✓ Pass
  • Linux Command History Tampering (3/28)
  • History File Deletion (1/26)
t1548-001-setuid-setgid T1548.001 Privilege Escalation Linux 2 ✓ Pass
  • Setuid or Setgid Bit Set via Chmod (Any Mode Form) (2/36)
t1027-obfuscated-powershell-oneliner T1027 Stealth Windows 1 ○ Pending
  • Obfuscated PowerShell OneLiner Execution (no fixtures)

False positives on the benign corpus

Every compiled rule replayed over 675 events recorded while ordinary work ran on a runner (Linux only). Rules with no applicable benign events are listed as not evaluated, not as clean.

RuleMatchedApplicable eventsExample matches
History File Deletion 0 488
Scheduled Cron Task/Job - Linux 0 488
New Cron File Created 2 2 /etc/cron.daily/chkrootkit.dpkg-new
/etc/cron.daily/chkrootkit
Setuid or Setgid Bit Set via Chmod (Any Mode Form) 0 488
Setuid and Setgid 0 488
Linux Command History Tampering 0 613

Not evaluated (no applicable benign events): 20 of 26 rules.

Evasion sweep

Deterministic variants of each Linux attack command (seed 20261111); a rule catches a variant when it matches at least one event the variant produces. Counts are variants caught / variants the rule applies to.

ScenarioRuleCommand-line variantsAlternative-tool variants
t1053-003-cron-persistence Scheduled Cron Task/Job - Linux 12 / 24 -
New Cron File Created 11 / 16 -
t1070-003-clear-command-history Linux Command History Tampering 69 / 103 -
History File Deletion 34 / 103 -
t1548-001-setuid-setgid Setuid or Setgid Bit Set via Chmod (Any Mode Form) 106 / 108 0 / 4
Setuid and Setgid (comparison, not expected by the scenario) 0 / 108 0 / 4