v1.0.22

Chores

• Chore(core): core.lock → dcdeda541fdc (v3.9.0) (fbe89d8)

v1.0.21

Chores

• Chore(core): core.lock → da1541206be1 (v3.8.0) (cd4f1ae)

v1.0.20

Chores

• Chore(core): core.lock → e9cf907f5849 (v3.7.0) (dc892a8)

v1.0.19

Chores

• Chore(core): core.lock → 3ace724a75c6 (v3.6.1) (44acdbc)

v1.0.18

Features

• Feat(sigma): close on-prem AD detection gaps (issues #63, #64) (6fe61b0)
• Feat(network): add Command-and-Control detections (issue #64) (fcceb03)
• Feat(sigma): close remaining #63/#64 items — recon, RBCD pairing, coverage notes (f2bdcd0)
• Feat(sigma): tune the environment-dependent rules from #63 §4/§6 (d24eb8a)
• Feat(network): feed-driven JA3 known-implant fast path for TLS C2 (8d259f8)
• Feat(lab): detection-efficacy validation — network plane (Phase 0) (5399d67)
• Feat(lab): network validation Phase 1 — Suricata plane + DGA + pycache cleanup (3ab0d83)
• Feat(lab): extend network validation to reverse-tunnel + coercion (61b11d3)
• Feat(lab): detection-efficacy validation — host/Sigma plane (Phase 2) (1c2a128)
• Feat(lab): sweep the Windows/Sysmon Sigma corpus through the efficacy gate (e342869)
• Feat(lab): validate 21 cloud/SaaS Sigma rules; document the engine limit for the rest (4d5742e)
• Feat(lab): validate the 26 nested-field cloud Sigma rules with a pysigma evaluator (21b7b1d)
• Feat(lab): validate all 4 DCERPC coercion vectors (synthesize the deferred fixture) (67bee0c)

Bug Fixes

• Fix(network): address PR review — DGA reply handler + TLS CA-trust note (aefcdfe)
• Fix(sigma): make deploy-required.sh portable (PR review) (9237fce)
• Fix(network): make update-ja3-feed.sh BSD/macOS-portable (PR review) (1b51cf6)
• Fix(lab): surface engine errors + literal match in validation harness (PR review) (e6dbadc)
• Fix(lab): DGA detection missed NXDOMAIN; fix suricata CI image + filter guard (2538851)
• Fix(lab): defer coercion validation (Suricata won't parse a synthetic DCERPC bind) (c02f92a)
• Fix(lab): guard malformed sigma-manifest rows + fix header pipeline name (PR review) (50c46cb)
• Fix(lab): address review — exit-code contract, numeric/null match, pinned dep (4c69872)
• Fix(detections): split potato SeImpersonate into a per-channel pair so it fires (7fc8f7f)
• Fix(detections): use generic process_creation logsource on the potato 4688 rule (4a89c95)

Documentation

• Docs(sigma): fix ldap-recon 4648 title/description accuracy (PR review) (55fbb3a)
• Docs(lab): use full/valid paths in the potato finding + plan pointer (PR review) (eababcc)

CI / Build

• Ci(deps): update github-actions (be89d50)

Chores

• Chore(core): core.lock → a8118719b301 (v3.6.0) (a0c8192)

v1.0.17

Chores

• Chore(core): core.lock → 8089460cb01b (v3.5.2) (d9915f1)

v1.0.16

Chores

• Chore(core): core.lock → 2ea75bce396c (v3.5.1) (581bbf6)

v1.0.15

Chores

• Chore(core): core.lock → 4f75ce551f52 (v3.5.0) (f72b7f3)

v1.0.14

Chores

• Chore(core): core.lock → 8533c5e3c728 (v3.4.0) (86f79b6)

v1.0.13

Features

• Feat(routines): add /coverage-gap — quantitative ATT&CK coverage holes (dbb0c2e)

Bug Fixes

• Fix(defense): guard siemdown/siemlogs + subshell-scoped mktemp cleanup (a6119b1)
• Fix(defense): use portable ISO-8601 date stamps in mkcase/note (e0bc93c)
• Fix(defense): route errors to stderr, guard cd/link, portable read (c7bf747)
• Fix(defense): guard mkcase cd before exporting $CASE (both paths) (6675f1e)

Chores

• Chore(core): core.lock → 03ac33871af2 (v3.3.0) (5be5669)