Detection robustness and agent-activity attribution - #2

Merged

MarkRWatts merged 28 commits into

mainfrom

feature/detection-robustness-extensions

Aug 21, 2026

Commits on Aug 21, 2026

Add CI workflow and sigma rules sync script

authored and
Mark Watts
committed
41fe563
Merge wt/tooling: CI workflow and SigmaHQ rule re-sync script

Mark Watts
authored and
Mark Watts
committed
33bc6f8
Close Sigma-spec gaps: N-of quantifier, base64 modifiers, cased, keyword scope, logsource filtering

authored and
Mark Watts
committed
107dec0
Merge wt/sigma-spec: N-of, base64/base64offset/cased modifiers, keyword scope, logsource filtering

Mark Watts
authored and
Mark Watts
committed
30f1b84
Add parent-context caching, ps sampling watchdog, and user field to ProcessMonitor

authored and
Mark Watts
committed
948e8da
Fix swapped trailing-trim in base64offset encodings

authored and
Mark Watts
committed
5095569
Merge wt/procmon-robustness: parent-context cache, sampling watchdog, User field

Mark Watts
authored and
Mark Watts
committed
9753838
Start monitoring at launch, add launch-at-login, surface degraded state

authored and
Mark Watts
committed
8028be3
Add PersistenceWatcher: a second sensor for LaunchAgents/Daemons/periodic

authored and
Mark Watts
committed
70866c8
Add tamper-evidence for rule/allowlist state via IntegrityGuard

authored and
Mark Watts
committed
846c895
Make IntegrityGuard opt-in and key its sidecar by full path

authored and
Mark Watts
committed
09d8d10
Add sequence/chain correlation across LOLBin process trees

authored and
Mark Watts
committed
2773c86
Add evidence export paths and actionable notifications

authored and
Mark Watts
committed
946d5b1
Document merged detection robustness enhancements

authored and
Mark Watts
committed
1353fa7
Fix README layout tree and tighten three phrasings

authored and
Mark Watts
committed
5738fd4
Never block launch on the integrity Keychain prompt

authored and
Mark Watts
committed
c9dc905
Prefer a stable signing identity over ad-hoc in the app build

authored and
Mark Watts
committed
b38fede
Add ancestry-based provenance attribution to detection events

authored and
Mark Watts
committed
c73b071
Merge wt/provenance: ancestry provenance attribution on detection events

Mark Watts
authored and
Mark Watts
committed
bd92a1e
Supersede the imported xattr Gatekeeper-bypass rule with a precise one

authored and
Mark Watts
committed
9e55f04
Merge wt/xattr-precision: quarantine-removal rule supersedes imported catch-all

Mark Watts
authored and
Mark Watts
committed
b8d5533
Scope allowlist entries to a provenance label

authored and
Mark Watts
committed
44ba7b0
Escalate agent-attributed sensitive activity, quiet routine agent alerts

authored and
Mark Watts
committed
198a694
Document merged detection robustness enhancements: provenance attribution, scoped allowlisting, agent activity policy, and xattr rule precision

authored and
Mark Watts
committed
0acd8dd
Make provenance chips visually prominent in their own violet

authored and
Mark Watts
committed
f316de1
Annotate exportHistory @MainActor for the CI toolchain

authored and
Mark Watts
committed
d241d2d
Annotate main-actor-touching View structs explicitly for older toolchains

authored and
Mark Watts
committed
c3b9c5d
Fix mangled AllowlistRow declaration from the annotation sweep

authored and
Mark Watts
committed
ceee34a

Navigation Menu

Detection robustness and agent-activity attribution - #2

Detection robustness and agent-activity attribution#2
MarkRWatts merged 28 commits into
mainfrom
feature/detection-robustness-extensions

Commits on Aug 21, 2026

Add CI workflow and sigma rules sync script

Merge wt/tooling: CI workflow and SigmaHQ rule re-sync script

Close Sigma-spec gaps: N-of quantifier, base64 modifiers, cased, keyword scope, logsource filtering

Merge wt/sigma-spec: N-of, base64/base64offset/cased modifiers, keyword scope, logsource filtering

Add parent-context caching, ps sampling watchdog, and user field to ProcessMonitor

Fix swapped trailing-trim in base64offset encodings

Merge wt/procmon-robustness: parent-context cache, sampling watchdog, User field

Start monitoring at launch, add launch-at-login, surface degraded state

Add PersistenceWatcher: a second sensor for LaunchAgents/Daemons/periodic

Add tamper-evidence for rule/allowlist state via IntegrityGuard

Make IntegrityGuard opt-in and key its sidecar by full path

Add sequence/chain correlation across LOLBin process trees

Add evidence export paths and actionable notifications

Document merged detection robustness enhancements

Fix README layout tree and tighten three phrasings

Never block launch on the integrity Keychain prompt

Prefer a stable signing identity over ad-hoc in the app build

Add ancestry-based provenance attribution to detection events

Merge wt/provenance: ancestry provenance attribution on detection events

Supersede the imported xattr Gatekeeper-bypass rule with a precise one

Merge wt/xattr-precision: quarantine-removal rule supersedes imported catch-all

Scope allowlist entries to a provenance label

Escalate agent-attributed sensitive activity, quiet routine agent alerts

Document merged detection robustness enhancements: provenance attribution, scoped allowlisting, agent activity policy, and xattr rule precision

Make provenance chips visually prominent in their own violet

Annotate exportHistory @MainActor for the CI toolchain

Annotate main-actor-touching View structs explicitly for older toolchains

Fix mangled AllowlistRow declaration from the annotation sweep