feat(sigma): close remaining #63/#64 items — recon, RBCD pairing, coverage notes

[Gerrrt]

Summary

Closes the clean-to-author and doc-accuracy remainders from the weekly reports (#63, #64) — the items that need no operator baseline. Follows the two merged PRs (#65 on-prem AD Sigma gaps, #66 C2 network tactic).

The environment-dependent tuning items (SaaS rule shapes, rbcd/dcshadow placeholder allowlists) remain deliberately deferred for a deploy-time pass, since their allowlists depend on a specific deployment's baseline.

New detections (patterns the corpus already owns)

Rule	Gap it closes	ATT&CK
discovery/ldap_recon_explicit_creds_4648	Discovery was thin in #64 (one rule for the tactic). value_count on 4648 explicit-cred logons fanning out to many targets — the alternate-credential recon sweep. Mirrors the Kali PURPLE-TEAM "LDAP recon by one principal" 4648 row.	T1087.002 / T1046
persistence/machine_account_creation_burst_4741	value_count on 4741 computer accounts minted by one principal — MachineAccountQuota abuse, the RBCD/noPac precursor. This is the "4741 burst" pairing that rbcd_allowedtoact_5136's description already calls for (#63 §6); rbcd is now cross-linked to it, so the chain no longer hinges on the delegation-admin allowlist alone.	T1136.002

Coverage + freshness notes (no detection change)

• Backend-layer coverage is real. Documented — in both detections/README.md and the correlation_searches.conf header — that Golden Ticket (T1558.001), Silver Ticket (T1558.002), and NTLM relay (T1557.001) are covered in siem/splunk/correlation_searches.conf. They read as "0" in navigator/COVERAGE.md only because that roll-up is generated from the Sigma tree only. This is why coverage-gap: weekly ATT&CK coverage holes #64 keeps surfacing them — now the docs say to read the report as Sigma coverage, not total.
• MITRE moves flagged: T1557.001 renamed to "Name Resolution Poisoning and SMB Relay"; T1558 gained a .005 Ccache Files sub-technique (noted as a not-yet-instrumented candidate).

Verification

Regenerated the drift-gated artifacts from the Sigma source of truth — now 71 rules / 78 documents / 47 techniques. Full sigma.yml gate run locally, all green:

• ✅ Structural lint (0 errors, 0 issues)
• ✅ Compile every rule to Splunk
• ✅ SIEM deploy-form + Navigator + coverage drift gates (all --check up to date)

What's left after this (deferred, environment-dependent)

• entra_illicit_consent_grant / snowflake_data_unload — restructure to admin-consent scope / volume correlation, with allowlists as deploy-time substitutions.
• rbcd / dcshadow placeholder filters — document as required substitutions + a lint note.

These are the "#3" items from the plan — a follow-up where the allowlists are explicitly deploy-time and benefit from your baseline.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YSMagcHY1PzH4UDwoaWJS1

---

Generated by Claude Code

[Copilot]

Pull request overview

Adds two new Sigma correlation detections to close remaining recon and RBCD-chain gaps from #63/#64, and updates the generated SIEM/Navigator artifacts plus documentation to clarify backend-layer (non-Sigma) coverage.

Changes:

• Added ldap_recon_explicit_creds_4648 correlation to detect explicit-credential fan-out across many targets (recon/discovery).
• Added machine_account_creation_burst_4741 correlation to detect MachineAccountQuota-style bursts and cross-linked it from the existing RBCD 5136 rule description.
• Clarified documentation/headers that Golden Ticket, Silver Ticket, and NTLM relay are covered at the Splunk correlation layer (not counted in Sigma-only coverage rollups), and regenerated drift-gated artifacts.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
detections/sigma/privilege_escalation/rbcd_allowedtoact_5136.yml	Updates rule description to explicitly pair RBCD writes with the new 4741 burst correlation.
detections/sigma/persistence/machine_account_creation_burst_4741.yml	New base + value_count correlation to detect burst computer-account creation by a single principal.
detections/sigma/discovery/ldap_recon_explicit_creds_4648.yml	New base + value_count correlation to detect explicit-credential fan-out recon across many targets.
detections/siem/splunk/savedsearches.generated.conf	Regenerated Splunk saved searches to include the new correlation.
detections/siem/splunk/correlation_searches.conf	Adds coverage/freshness notes clarifying backend-layer coverage vs Sigma-only rollups.
detections/siem/sentinel/rules.generated.kql	Regenerated KQL output with the new rules (with correlation limitations noted).
detections/siem/elastic/rules.generated.lucene	Regenerated Lucene output with the new rules (with correlation limitations noted).
detections/README.md	Updates counts and rule tables; clarifies Sigma-only coverage vs backend-layer coverage.
detections/navigator/COVERAGE.md	Updates Sigma-only coverage rollup counts and technique listings.
detections/navigator/coverage-layer.json	Updates Navigator layer technique scores/comments for the new coverage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.