Purple team

Every attack, beside its detection

The role layers are two halves of one loop. dotfiles-Offense runs the attack; dotfiles-Defense ships the Sigma rule that catches it. The pairing itself is the source of truth: it lives inhtpxas ATT&CK-tagged red↔blue entries, and this table is generated straight from them.

Each row is a technique you can execute on demand from Kali and confirm firing in Defense — the purple loop closed in a single line. Filter by platform, and follow a badge to its ATT&CK page. See thethree-layer architecture → for how the layers fit together.

101paired attack ↔ detection concepts
16platforms & data sources
71ATT&CK techniques
13ATT&CK tactics

On-prem AD / Windows 46

AttackDetectionATT&CK
/etc/shadow dump (offline hash cracking)Detect /etc/shadow read (auditd read watch, non-auth reader)T1003.008
Account access removal (lock out admins & responders)Detect account access removal (admin disable/delete/reset + group removal)T1531
AD CS ESC1 (request a cert as admin via arbitrary SAN)Detect AD CS SAN abuse (4886/4887 ESC1/relay)T1649
AS-REP roast (no-preauth accounts)Detect AS-REP roast (4768 no-preauth)T1558.004
BloodHound collection (SharpHound / bloodhound-ce-python)Detect BloodHound collection (4662 directory-read burst; 1644 LDAP)T1087.002T1069.002T1482
C2 over a legitimate web service (Telegram / Slack / Gist)Detect web-service C2 (non-browser process to SaaS API)T1102.002
Coerce DC auth (PetitPotam / printerbug)Detect coercion (5145 named-pipe access)T1187
Cron persistence (crontab / cron.d callback)Detect cron persistence (auditd watches on cron paths)T1053.003
Data encrypted for impact (mass file encryption)Detect mass encryption (4663 file-write burst + note drop)T1486
DCShadow (register a rogue DC, push directory changes)Detect DCShadow (rogue DC registration, 4742 GC SPN)T1207
DCSync — dump domain hashes via replicationDetect DCSync / NTDS replication (4662)T1003.006
Device-code phishing (steal M365/Entra tokens)Detect device-code phishing (Entra sign-in, deviceCode flow)T1528
DGA rendezvous domains (resilient C2 resolution)Detect DGA beacons (NXDOMAIN burst + label entropy)T1568.002
DNS-tunnel C2 (iodine / dnscat2 / Sliver DNS)Detect DNS tunneling (Sysmon 22 query volume + label length)T1071.004
Domain-fronted C2 (high-reputation CDN edge)Detect domain fronting (CDN edge from a non-browser process; SNI vs Host mismatch)T1090.004
DPAPI domain backup key (decrypt any user's secrets)Detect DPAPI backup-key theft (protected_storage pipe, 5145)T1555
Golden Ticket (forge a TGT from the krbtgt hash)Detect Golden Ticket (4769 with no preceding 4768)T1558.001
GPP cpassword (decrypt the SYSVOL AES key)Detect GPP cpassword hunt (5145 SYSVOL Groups.xml read)T1552.006
HTTPS beacon with long sleep + jitter (Sliver / Cobalt / Havoc)Detect HTTPS beaconing by inter-arrival regularity (proxy logs)T1071.001
ICMP-tunnel C2 (echo-payload smuggling)Detect ICMP tunneling (echo volume + payload size)T1095
Inhibit system recovery (delete shadow copies + backups)Detect recovery inhibition (4688 vssadmin / wbadmin / bcdedit)T1490
Kerberoast SPNs (request + crack offline)Detect Kerberoasting (4769 RC4 TGS)T1558.003
LDAP reconnaissance (raw directory queries)Detect LDAP reconnaissance (4662 targeted reads; 1644 broad filters)T1087.002T1069.002
Mutual-TLS C2 session (Sliver mTLS implant)Detect mTLS C2 — outbound client certificate + TLS fingerprint (JA4 / JA3)T1573.002
NTDS.dit dump on the DC (ntdsutil / VSS, offline)Detect NTDS theft via ntdsutil/VSS (4688 + 8222)T1003.003
NTLM relay (ntlmrelayx → SMB, no signing)Detect NTLM relay (4624 workstation mismatch)T1557.001
Pass-the-hash lateral movement (SMB / WinRM / psexec)Detect pass-the-hash lateral movement (4624 type-3 NTLM fan-out)T1550.002
Password spray (kerbrute, low & slow)Detect password spray (one source, many accounts — 4771 + 4625)T1110.003
RDP session hijack (tscon as SYSTEM)Detect RDP session hijack (4688 tscon)T1563.002
Remote LSASS dump (NetExec lsassy)Detect LSASS access (4656 dump-shaped handle)T1003.001
Resource hijacking (cryptomining on compromised hosts)Detect cryptojacking (Stratum pool connections + CPU peg)T1496.001
Resource-based constrained delegation (RBCD)Detect RBCD abuse (5136 msDS-AllowedToActOnBehalfOfOtherIdentity write)T1098
Reverse tunnel for C2 pivoting (chisel / ligolo-ng)Detect reverse tunnels (long-lived outbound session + JA3)T1572
Scheduled-task persistence (schtasks /create)Detect scheduled-task persistence (4698 task created)T1053.005
SeImpersonate → SYSTEM (PrintSpoofer / GodPotato)Detect Potato privesc (service account → SYSTEM shell, 4688)T1134.001
Shadow Credentials (certipy shadow auto)Detect Shadow Credentials (5136 msDS-KeyCredentialLink write)T1556
Silver Ticket (forge a TGS from a service account hash)Detect Silver Ticket (Kerberos service logon with no 4769)T1558.002
SSH authorized_keys persistence (append attacker key)Detect SSH authorized_keys persistence (auditd watch on key files)T1098.004
SSH private-key theft (harvest keys for lateral movement)Detect SSH private-key theft (auditd read watch, cross-user sweep)T1552.004
Stop business services before impact (unlock files for encryption)Detect pre-encryption service kills (7036 stop burst)T1489
Sudo misconfiguration → root (allowed-binary escape)Detect sudo privilege escalation (root shell under a real loginuid)T1548.003
SUID binary abuse → root (setuid escape / planted SUID bit)Detect SUID abuse (setuid-bit change + root shell under a real loginuid)T1548.001
Systemd service/timer persistenceDetect systemd unit persistence (auditd watches on unit dirs)T1543.002
Unconstrained delegation — capture a DC TGTDetect unconstrained-deleg abuse (DC machine-account auth to a non-DC, 4624)T1558
WMI event-subscription persistence (permanent consumer)Detect WMI subscription persistence (Sysmon 20 consumer)T1546.003
WMI remote exec (impacket-wmiexec, no service dropped)Detect WMI exec (4688 WmiPrvSE child process)T1047

Cloud IAM (Entra · AWS · GCP) 13

AttackDetectionATT&CK
AiTM phishing (Evilginx reverse-proxy, steal the session)Detect AiTM phishing (Entra sign-in token replay across ASNs)T1566.002
AWS console takeover (Create/UpdateLoginProfile)Detect console takeover (CloudTrail Create/UpdateLoginProfile)T1098
AWS IAM access-key backdoor (CreateAccessKey on another user)Detect IAM access-key backdoor (CloudTrail CreateAccessKey)T1098.001
AWS IAM privilege escalation (AttachUserPolicy / PassRole → AssumeRole)Detect IAM privilege escalation (CloudTrail AttachUserPolicy / PassRole)T1098.003
AWS S3 bulk object exfil (mass GetObject / CopyObject)Detect S3 bulk exfil (CloudTrail data events + access logs)T1530
Destroy cloud backups & data (snapshot / bucket deletion)Detect cloud data destruction (CloudTrail delete burst)T1485
Entra privileged directory-role grant (tenant persistence)Detect privileged directory-role grant (Entra audit, Add member to role)T1098.003
GCP Cloud Audit log tamper (delete sink / strip auditConfigs)Detect audit-log tamper (GCP, DeleteSink / auditConfig strip)T1685.002
GCP IAM policy backdoor (setIamPolicy → rogue principal)Detect IAM policy backdoor (GCP audit, SetIamPolicy binding ADD)T1098
GCP service-account key creation (long-lived backdoor)Detect SA key creation (GCP audit, CreateServiceAccountKey)T1098.001
Illicit consent grant (malicious OAuth app)Detect illicit consent grant (Entra audit, Consent to application)T1528
Service-principal credential backdoor (add app secret)Detect SP credential backdoor (Entra audit, Add credentials)T1098.001
Valid cloud accounts (credential stuffing → tenant sign-in)Detect valid-account abuse (Entra sign-in, stuffing hit from a new ASN)T1078.004

Okta 3

AttackDetectionATT&CK
Okta API token (long-lived tenant persistence)Detect tenant credential persistence — API token + OAuth service app (Okta System Log)T1098
Okta MFA reset → enroll attacker factor (account takeover)Detect MFA factor reset / deactivate (Okta System Log)T1556.006
Rogue IdP → federation backdoor (sign in as anyone)Detect IdP create / activate (Okta System Log)T1556

Google Workspace 3

AttackDetectionATT&CK
Google Workspace external mail forwarding (BEC exfil)Detect external mail forwarding (Google Workspace audit)T1114.003
Google Workspace malicious OAuth grant (consent phish)Detect illicit OAuth grant (Google Workspace token audit)T1528
Google Workspace super-admin grant (tenant persistence)Detect admin-role grant (Google Workspace admin audit)T1098.003

Kubernetes 3

AttackDetectionATT&CK
Bind to cluster-admin (RBAC privesc / persistence)Detect cluster-admin binding (K8s audit)T1098
kubectl exec into a running podDetect pod exec / attach (K8s audit)T1609
Privileged pod → node escape (nsenter into PID 1)Detect privileged / host-namespace pod (K8s audit)T1610T1611

GitHub Actions 3

AttackDetectionATT&CK
Deploy key / fine-grained PAT backdoor (durable repo access)Detect deploy-key / PAT credential backdoor (GitHub audit log)T1098
Disable/override branch protection (merge unreviewed code)Detect branch-protection tamper (GitHub audit log)T1685
Rogue self-hosted runner (capture jobs + secrets)Detect self-hosted runner registration (GitHub audit log)T1543

GitLab CI/CD 3

AttackDetectionATT&CK
Attach a rogue GitLab Runner (capture CI jobs + secrets)Detect rogue runner association (GitLab audit events)T1543
Project/deploy token backdoor (durable GitLab access)Detect access/deploy token backdoor (GitLab audit events)T1098
Remove protected-branch rules (merge unreviewed code)Detect protected-branch tamper (GitLab audit events)T1685

Jenkins 3

AttackDetectionATT&CK
Jenkins job/pipeline backdoor (run code on controller + agents)Detect job create/reconfigure (Jenkins audit log)T1072
Jenkins Script Console RCE (controller code exec + cred dump)Detect Script Console use (Jenkins audit log)T1059
Jenkins user API token (durable non-interactive access)Detect API token creation (Jenkins audit log)T1098

Harbor registry 3

AttackDetectionATT&CK
Backdoored image over a trusted tag (poison the registry)Detect image push over a trusted tag (Harbor audit log)T1525
Delete the trusted artifact (force re-pull + anti-forensics)Detect artifact deletion (Harbor audit log)T1070
Harbor robot account (durable registry credential)Detect robot-account creation (Harbor audit log)T1098

HashiCorp Vault 3

AttackDetectionATT&CK
Bulk KV secret read (exfil the vault)Detect bulk secret read (Vault audit log)T1555
Disable the Vault audit device (blind the SIEM)Detect audit-device disable (Vault audit log)T1685
Rogue AppRole (durable machine auth to Vault)Detect rogue AppRole / auth backdoor (Vault audit log)T1098

Terraform Cloud 3

AttackDetectionATT&CK
Rogue Terraform Cloud agent (capture runs + cloud creds)Detect rogue agent pool (Terraform Cloud audit trail)T1543
Terraform Cloud org/team token backdoor (durable API access)Detect org/team token creation (Terraform Cloud audit trail)T1098
Terraform Cloud variable injection (run code / exfil at apply)Detect workspace variable injection (Terraform Cloud audit trail)T1072

Snowflake 3

AttackDetectionATT&CK
Snowflake backdoor user + ACCOUNTADMIN grantDetect user creation / ACCOUNTADMIN grant (Snowflake QUERY_HISTORY)T1136.003
Snowflake data exfil via COPY INTO external stageDetect COPY INTO external unload (Snowflake QUERY_HISTORY)T1567.002
Snowflake network-policy tamper (open the IP allowlist)Detect network-policy change (Snowflake QUERY_HISTORY)T1686.001

Cloudflare edge 3

AttackDetectionATT&CK
Cloudflare API token backdoor (durable account access)Detect API token creation (Cloudflare audit log)T1098
Cloudflare WAF/firewall rule disable (open the edge)Detect WAF/firewall rule disable (Cloudflare audit log)T1686.001
Cloudflare Worker deploy (serverless edge code exec)Detect Worker deploy (Cloudflare audit log)T1648

npm registry 3

AttackDetectionATT&CK
npm malicious package publish (supply-chain implant)Detect package publish (npm audit log)T1195.002
npm publish-2FA disable (open the publish path)Detect publish-2FA disable (npm audit log)T1685
npm rogue maintainer add (durable publish rights)Detect maintainer add (npm audit log)T1098

PyPI registry 3

AttackDetectionATT&CK
PyPI malicious release upload (supply-chain implant)Detect token release upload (PyPI journal)T1195.002
PyPI rogue collaborator add (durable publish rights)Detect collaborator add (PyPI journal)T1098
PyPI rogue trusted publisher (credential-less publish backdoor)Detect trusted publisher add (PyPI journal)T1098

Slack 3

AttackDetectionATT&CK
Slack 2FA enforcement disable (weaken workspace auth)Detect 2FA enforcement disable (Slack audit log)T1685
Slack Connect external share (channel exfil)Detect external shared channel (Slack audit log)T1567
Slack malicious app install (durable data access)Detect app install (Slack audit log)T1098

What the blue side actually detects

The other half of the loop: the Sigma rules dotfiles-Defense ships, rolled up across the ATT&CK matrix. Every rule is drift-gated in CI and generates its own ATT&CK Navigator layer plus a COVERAGE.md report — this is that same roll-up, live.

95Sigma detection rules
70ATT&CK techniques
6ATT&CK tactics
24logsources

By ATT&CK tactic

Execution TA000210/8t
Persistence TA000334/13t
Discovery TA00076/13t
Collection TA00094/5t
Exfiltration TA00102/2t
Impact TA00409/5t

Each bar is rules per tactic; the trailing /Nt is the distinct techniques covered. A rule spanning two tactics counts in both.

By logsource

cloudaws, azure, gcp11
cloudflarecloudflare3
collectionwindows2
credential_accesswindows10
defense_impairmentwindows1
discoverywindows6
githubgithub3
gitlabgitlab3
google_workspacegoogle_workspace3
impactwindows8
jenkinsjenkins3
kuberneteskubernetes3
lateral_movementwindows5
linuxlinux1
npmnpm3
oktaokta3
persistencewindows4
privilege_escalationwindows5
pypipypi3
registryharbor3
slackslack3
snowflakesnowflake3
terraformterraform3
vaultvault3

Techniques detected 70

T1003.001T1003.003T1003.006T1005T10072T10162T10182T1021T10333T1046T1047T10493T1053.005T10572T1059T1069.001T1069.002T1070T10722T1074.001T10822T1087.0013T1087.0022T109816T1098.0013T1098.0033T1110.003T1114.003T1134.0012T11353T1136.001T1136.0022T1136.003T11872T1195.0022T1207T1484.002T14852T14863T14892T1490T1525T15282T1530T1531T15433T1546.003T1550.002T1550.003T1552.006T15552T15562T1556.006T1558T1558.003T1558.0042T1558.005T1560.001T1563.002T1567T1567.002T1569.002T1609T1610T1611T1648T1649T16855T1685.002T1686.0012

The corpus is generated from the htpx entries/ byscripts/collect-corpus.mjs, and the coverage roll-up is generated from thedotfiles-Defense Sigma rules by scripts/collect-coverage.mjs (mirroring that repo's drift-gated gen-coverage.sh). Neither is hand-typed.