fix(corpus): address corpus-review #54 — detection quality + S3 exfil pair

[Gerrrt]

Acts on the report-first corpus review in #54. All five findings are addressed; the silver-ticket item was recorded as a non-finding (no change needed), consistent with the report.

Changed — detection quality

• docs: mark standalone extraction resolved; fix install.sh wording #1 web-service-c2-beacon (high confidence). Inverted from a hardcoded 4-domain allowlist to a process-centric gate: non-browser / user-writable-path process making periodic 443 SaaS beacons rare-for-the-host. Any T1102.002 channel over a different trusted SaaS (Discord, Dropbox, Pastebin, …) no longer evades silently. The four domains are demoted to a labelled seed IOC list, matching the red entry's "the tell is the process."
• docs(readme): add polished landing-page hero header #2 adcs-esc1-4886 (config-dependent). Retargeted to 4887 (certificate issued) + CA request-attribute auditing as primary; added a caveat that the 4886 upn= parse is best-effort and can silently read zero as "no ESC1"; separated the 5136 userCertificate line as shadow-cred/relay telemetry rather than an ESC1-SAN backstop. event_ids now [4886, 4887, 5136].
• feat(entries): add 6 red↔blue pairs across new tactics #4 mass-encrypt-4663 (low severity). Implemented and preferred the Sysmon-11 FileCreate variant the prose already advertised — file-data SACLs are off by default, so the 4663-only query was blind out-of-the-box. event_ids now [4663, 11].
• fix(ci): authenticate the sync-fanout Resolve step's htpx reads #5 mtls-c2-ja3 (polish). Noted JA3's uTLS weakness and to prefer JA4/JA4S (FoxIO, 2023+, emitted by current Zeek) where available.

Added — coverage

• feat(ci): automated releases + fan-out to dotfiles-Kali #3 new T1530 pair (medium/scope). aws-s3-mass-exfil (bulk ListBucket → GetObject/sync, or server-side CopyObject into an attacker bucket) ↔ aws-s3-exfil-cloudtrail (per-principal object-read volume via CloudTrail S3 data events, with a caveat that data events must be enabled and an S3-server-access-log / BytesDownloaded fallback). Fills the corpus's thinnest tactic (Collection, TA0009) — S3 is the canonical cloud-exfil target and was previously uncovered.

Validation

Ran the CI gates locally — all green:

• ./gen-views.sh --check — drift gate passes (standalone, no flat-view targets)
• pairing graph — the new pair is bidirectional; no broken pairs
• slot coverage — no unhandled {{slots}} (the cloud entries carry none)

CHANGELOG.md updated under [Unreleased] (Added + Changed) per the repo's Conventional-Commits + Keep-a-Changelog contract.

Closes #54.

🤖 Generated with Claude Code

---

Generated by Claude Code

[Copilot]

Pull request overview

Addresses the corpus-review findings in #54 by improving detection fidelity for several existing blue entries and adding new cloud-collection coverage for AWS S3 mass exfiltration (T1530), with a corresponding changelog update.

Changes:

• Reworked web-service-c2-beacon to be process-centric (not domain-IOC gated) and added triage seed IOCs.
• Retargeted adcs-esc1-4886 toward 4887 + auditing caveats; added Sysmon 11 primary path for mass-encrypt-4663; refreshed mtls-c2-ja3 guidance toward JA4/JA4S.
• Added a new red↔blue pair for AWS S3 bulk exfiltration (aws-s3-mass-exfil ↔ aws-s3-exfil-cloudtrail).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
entries/red/aws-s3-mass-exfil.md	New red entry describing bulk S3 object collection/exfil patterns (T1530).
entries/blue/aws-s3-exfil-cloudtrail.md	New blue detection entry for S3 bulk reads/copies using CloudTrail data events and access-log fallbacks.
entries/blue/web-service-c2-beacon.md	Updated SPL and prose to pivot on suspicious processes rather than SaaS domain allowlists.
entries/blue/adcs-esc1-4886.md	Updated to include 4887 and clearer auditing caveats; revised SPL accordingly.
entries/blue/mass-encrypt-4663.md	Added Sysmon Event ID 11 primary detection path; expanded event_ids.
entries/blue/mtls-c2-ja3.md	Updated guidance to prefer JA4/JA4S over JA3 where available.
CHANGELOG.md	Documented the Added/Changed items under [Unreleased].

Comments suppressed due to low confidence (1)

entries/blue/web-service-c2-beacon.md:32

• Splunk’s sort command doesn’t accept commas between fields; | sort - user_writable, - conns will error. Provide fields as space-separated sort keys.

| sort - user_writable, - conns

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Gerrrt]

Thanks — all four points were valid and are fixed in 60f8a97:

• web-service-c2-beacon — swapped Image IN (...) for an explicit wildcard OR list (portable exclusion of browsers/Teams/updaters, matching the entry's prior style) and cleaned the sort to -user_writable -conns (no comma/space).
• adcs-esc1-4886 — the stats ... by RequestID, host was dropping _time; added latest(_time) as _time so the final table carries a timestamp.
• aws-s3-exfil-cloudtrail — corrected the CopyObject note. You're right that CloudTrail data events for CopyObject are recorded against the destination bucket, so a copy into an attacker-owned bucket outside the account is a CloudTrail blind spot. The caveat now says so and points defenders at the source bucket's S3 server access logs plus the GetObject-volume signal instead — which is actually the more honest posture for that exfil path.

The suppressed sort-comma note is covered by the same web-service-c2-beacon change.

---

Generated by Claude Code