fix(corpus): retarget AS-REP detection + add GCP parity pairs

[Gerrrt]

Acts on the weekly corpus-review findings in #50.

Finding #1 — AS-REP detection retargeted to the real roast artifact

entries/blue/asrep-probing-4771.md fired only on 4771 / 0x18, which is the wrong-password pre-auth failure — the password-spray / Kerbrute-enum signal, not the roast. A successful AS-REP roast against a no-preauth account emits a successful 4768 with pre-authentication type 0 (ticket under the account key, RC4 0x17), which never generates a 4771 0x18, so the load-bearing artifact was invisible to the detection.

• Primary clause is now EventCode=4768 Pre_Authentication_Type=0 Account_Name!="*$" Ticket_Encryption_Type=0x17 — the roastable AS-REP its red mate actually emits and that hashcat -m 18200 cracks.
• The 4771 0x18 one-source-many-accounts burst is kept as a secondary Kerbrute enumeration/spray tell.
• event_ids → [4768, 4771]; ATT&CK tag unchanged (T1558.004).

Finding #2 — GCP parity (1 pair → 3)

GCP had only gcp-sa-key ↔ gcp-sa-key-audit. Added two pairs mirroring the AWS/Okta/Snowflake shape:

Red	Blue	Tactic · Technique
gcp-iam-policy-backdoor (setIamPolicy → rogue principal)	gcp-iam-policy-audit (SetIamPolicy ADD binding delta)	Persistence · T1098
gcp-audit-log-disable (DeleteSink / strip auditConfigs)	gcp-audit-log-tamper-audit (self-witnessing Admin Activity events + Data Access gap)	Defense Evasion · T1562.008

Finding #3 — Discovery edge (optional in the review)

Added an unpaired recon entry gcp-enum-recon (pair: null) — projects / Asset Inventory / IAM blast-radius mapping, tagged T1580 / T1526 / T1069.003 — mirroring the intentionally-unpaired on-prem smb-enum-nxc. Read-only, low-signal, so it ships unpaired rather than forcing a low-value detection.

Validation

• ./gen-views.sh --check — clean (standalone: no flat-view targets).
• Pairing graph — every non-null pair bidirectional; the two new pairs resolve.
• Slot coverage — new entries use only <angle-bracket> cloud placeholders, no {{slots}}.
• No duplicate IDs. Red 87→89, blue 85→87.
• CHANGELOG.md [Unreleased] updated (Added / Changed).

Closes #50

🤖 Generated with Claude Code

https://claude.ai/code/session_013hEgodLmdYjrEGBLo5wdiQ

---

Generated by Claude Code

[Copilot]

Pull request overview

Updates the companion red↔blue corpus based on the weekly review by (1) correcting AS-REP roasting detection to key on the real Windows artifact and (2) expanding GCP coverage with additional paired persistence / defense-evasion entries plus an intentionally-unpaired recon entry.

Changes:

• Retarget asrep-probing-4771 to primarily detect successful 4768 no-preauth AS-REP activity, keeping 4771 0x18 as a secondary Kerbrute/spray signal.
• Add two new GCP parity pairs: IAM policy backdoor ↔ audit detection, and audit-log tamper ↔ audit detection; plus a standalone GCP recon entry.
• Update [Unreleased] in CHANGELOG.md to reflect the additions/changes.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
entries/blue/asrep-probing-4771.md	Retargets AS-REP detection to 4768 no-preauth; retains 4771 burst as secondary.
entries/red/gcp-iam-policy-backdoor.md	New red entry describing persistence via setIamPolicy binding changes.
entries/blue/gcp-iam-policy-audit.md	New blue entry detecting GCP IAM binding deltas (SetIamPolicy ADD).
entries/red/gcp-audit-log-disable.md	New red entry describing audit/log tampering via sinks / auditConfigs.
entries/blue/gcp-audit-log-tamper-audit.md	New blue entry for detecting sink/audit policy tampering activity.
entries/red/gcp-enum-recon.md	New intentionally-unpaired GCP recon/discovery entry.
CHANGELOG.md	Documents the new GCP entries and the AS-REP detection retargeting.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Gerrrt]

Addressed all four review comments in b3de4d5:

• AS-REP etype (3 comments): dropped Ticket_Encryption_Type=0x17 from the primary 4768 clause — the AS-REP cipher is negotiated (RC4 where enabled, AES in RC4-disabled domains), so pinning 0x17 would miss AES-only roasts. The invariant is pre-auth type 0 on a user account; the query keys on that alone now. Prose and CHANGELOG softened to "RC4 or AES."
• GCP audit-tamper filter: restricted the SetIamPolicy branch to auditConfigDeltas.action="REMOVE" so it detects audit-config tampering specifically, instead of matching every IAM grant (which was noisy and overlapped gcp-iam-policy-audit).

---

Generated by Claude Code