safeavio coverage --register

What we can see, and what we cannot yet.

We do not publish a live threat feed or attack statistics from customer data. We publish our own coverage: 127 attack families, each marked by what our code can actually do, with the rule, the gap and where it runs.

Browse the register Rules and ATT&CK Methodology

[01]Coverage, counted

127 families · 1 detected · 27 partial · 15 observable · 84 no sensor

DetectedPartialObservableNo sensor

Detected: 01/127
Partial: 27/127
Observable: 15/127
No sensor: 84/127

[02]By surface

Where the coverage is, and where it is not

Attack families by surface and coverage status
Surface	Detected	Partial	Observable	No sensor	Total
Endpoint and malware	0	18	5	15	38
Application, API and identity	1	1	9	18	29
Scam, browser and network	0	4	1	16	21
Cloud, container, supply chain and data	0	4	0	21	25
Web3, AI and specialised (incl. IoT/OT)	0	0	0	14	14
All surfaces	1	27	15	84	127

[03]The register

Every family, with its honest status

Filter by surface or status, or search a family name. Each note summarises the register row: the sensor that sees it, the threshold, and the blind spot.

127 of 127 families shown

#001
Malware
Endpoint and malware
Partial
On-demand engines only: ClamAV on Linux servers, Defender on the Windows agent, an APK hash lookup on Android. Results do not reach the correlation engine and there is no real-time desktop engine.
Production + repositoryMalware and ransomware protection
#002
Ransomware
Endpoint and malware
Partial
Desktop rule warns when 20 files change within 10 seconds in folders you approved. Repository only; the rule is tested with a synthetic flag, the real counter is not.
Repository onlyMalware and ransomware protection
#003
Fileless Malware
Endpoint and malware
Partial
The server collector flags inline base64 decoding and piped-to-shell command lines. Events are stored; no rule turns them into an incident. Linux only.
Runs in production
#004
Zero-Day Exploitation
Endpoint and malware
No sensor
No exploit-mitigation, crash or memory telemetry on any platform
Nothing runs
#005
Remote Code Execution (RCE)
Endpoint and malware
Partial
The server collector flags netcat/socat with -e, executables in temp folders and binaries deleted from disk. Stored only; no rule consumes them.
Runs in production
#006
Command Injection
Application, API and identity
Observable
The hub's own web-server access log can be read on request. Request line only, no bodies, never fed to correlation, customer applications not covered.
Runs in production
#007
Server-Side Template Injection (SSTI)
Application, API and identity
Observable
Same as command injection: the hub's own access log, read on request. No rule.
Runs in production
#008
SQL Injection
Application, API and identity
Observable
Same as command injection: the hub's own access log, read on request. No rule.
Runs in production
#009
NoSQL Injection
Application, API and identity
Observable
Same as command injection: the hub's own access log, read on request. No rule.
Runs in production
#010
LDAP/XPath Injection
Application, API and identity
Observable
Same as command injection: the hub's own access log, read on request. No rule.
Runs in production
#011
Cross-Site Scripting (XSS)
Application, API and identity
Observable
The hub's own access log, read on request. Stored and DOM-based XSS are not visible at all.
Runs in production
#012
Cross-Site Request Forgery (CSRF)
Application, API and identity
No sensor
No origin/token-failure telemetry
Nothing runs
#013
Server-Side Request Forgery (SSRF)
Application, API and identity
No sensor
No application egress or metadata-endpoint telemetry
Nothing runs
#014
XXE
Application, API and identity
No sensor
XML bodies and parser behaviour not observed
Nothing runs
#015
Path Traversal
Application, API and identity
Observable
The hub's own access log, read on request. No rule.
Runs in production
#016
Local/Remote File Inclusion
Application, API and identity
Observable
The hub's own access log, read on request. No rule.
Runs in production
#017
Unsafe File Upload
Application, API and identity
No sensor
Upload content is not inspected server-side
Nothing runs
#018
Insecure Deserialization
Application, API and identity
No sensor
No runtime/deserialisation telemetry
Nothing runs
#019
HTTP Request Smuggling
Application, API and identity
No sensor
Proxy/back-end framing disagreement is not logged
Nothing runs
#020
Host Header / Header Injection
Application, API and identity
No sensor
Host header is not in the parsed combined log format
Nothing runs
#021
Cache Poisoning / Cache Deception
Application, API and identity
No sensor
No cache/CDN telemetry
Nothing runs
#022
Broken Authentication
Application, API and identity
No sensor
Design flaws are not visible from login outcomes, and the console audit log is not fed to correlation. Only preventive controls exist.
Nothing runsIdentity protection
#023
Credential Stuffing
Application, API and identity
Partial
Covered only where it looks like brute force: 5 failures from one address in 5 minutes. Stuffing spread across many addresses is not grouped; console login failures do not reach correlation.
Runs in productionIdentity protection
#024
Password Spraying / Brute Force
Application, API and identity
Detected
Sensor, rule and test all exist: SSH failures from the server collector, 5 from one address in 5 minutes raises an incident. Per-address only; the collector can re-send old lines, which re-raises stale incidents.
Runs in productionIdentity protection
#025
MFA Fatigue / Push Bombing
Application, API and identity
No sensor
No MFA in the product, so no push telemetry
Nothing runs
#026
Session Hijacking
Application, API and identity
No sensor
No session-context anomaly detection; token revocation on logout is preventive only
Nothing runsIdentity protection
#027
OAuth/OIDC Abuse
Application, API and identity
No sensor
No OAuth/OIDC consent or token telemetry
Nothing runs
#028
API BOLA / IDOR
Application, API and identity
No sensor
No security event is raised when a cross-object or cross-tenant request is refused. Preventive authorization is tested.
Nothing runs
#029
API Mass Assignment
Application, API and identity
No sensor
No field-level write telemetry
Nothing runs
#030
API Resource Exhaustion
Application, API and identity
Observable
The hub's access log and host metrics can show it; no per-endpoint rule. A rate limit (60 requests a minute per address) is prevention, not detection.
Runs in production
#031
Business Logic Abuse
Application, API and identity
No sensor
No business-workflow telemetry
Nothing runs
#032
Race Condition / TOCTOU
Application, API and identity
No sensor
No concurrency telemetry
Nothing runs
#033
Phishing
Scam, browser and network
Partial
The desktop link check gives a verdict with reasons, but today it only recognises reserved test domains. Repository only; no browser or DNS interception.
Repository onlyPhishing protection
#034
Spear Phishing / Whaling
Scam, browser and network
No sensor
No email or message telemetry
Nothing runsPhishing protection
#035
Smishing
Scam, browser and network
No sensor
No SMS or link check found in the Android code the register reviewed.
Nothing runsScam protection
#036
Vishing
Scam, browser and network
No sensor
No call telemetry
Nothing runsScam protection Deepfake and impersonation
#037
QR / Quishing
Scam, browser and network
No sensor
No QR decoding found in the code the register reviewed.
Nothing runsQR code protection
#038
Business Email Compromise
Scam, browser and network
No sensor
No mailbox or payment-workflow telemetry
Nothing runsPhishing protection
#039
Deepfake Impersonation
Scam, browser and network
No sensor
No media analysis
Nothing runsDeepfake and impersonation
#040
Remote Support Scam
Scam, browser and network
Partial
The phone reports 12 known remote-control apps; an active one adds 50 points to the posture score, installed-only adds 15. Fixed list; no automated test of the scoring.
Production + repositoryScam protection
#041
Malvertising / Drive-by Download
Scam, browser and network
Observable
The desktop file monitor hashes new files in Downloads, but no reputation check or rule looks at them. Repository only.
Repository onlyBrowser and web protection
#042
Malicious Browser Extension
Scam, browser and network
No sensor
No browser extension inventory
Nothing runsBrowser and web protection
#043
DNS Hijacking / Poisoning
Scam, browser and network
No sensor
No resolver-configuration or DNS telemetry in any running build
Nothing runsBrowser and web protection
#044
DNS Tunneling
Scam, browser and network
No sensor
No DNS volume/entropy telemetry
Nothing runsNetwork protection
#045
Man-in-the-Middle (MITM)
Scam, browser and network
No sensor
VPN/network type is not MITM evidence; no TLS/certificate telemetry
Nothing runsNetwork protection
#046
ARP Spoofing
Scam, browser and network
No sensor
No ARP telemetry.
Nothing runsNetwork protection
#047
Rogue / Evil-Twin Wi-Fi
Scam, browser and network
No sensor
No SSID/BSSID or access-point reputation
Nothing runsNetwork protection
#048
DDoS / DoS
Scam, browser and network
Partial
Statistical anomaly flags (z-score over a 100-sample window) on the hub's own CPU, memory, disk and network. Hub only; anomalies do not reach correlation; no detection test.
Runs in productionNetwork protection
#049
Botnet
Scam, browser and network
Partial
Since 2026-10-02 the port-scan rule reads the agent's own events: 10 distinct ports from one peer in 60 seconds raises a medium incident. Only the scanning part of a botnet; established connections only, so a SYN scan is not seen.
Runs in productionNetwork protection
#050
Credential Theft / Infostealer
Endpoint and malware
No sensor
No credential-store access telemetry. A breach lookup shows exposure, not theft.
Nothing runsIdentity protection
#051
Keylogging / Clipboard / Screen Capture
Endpoint and malware
Partial
On Android 4.2, apps with accessibility or overlay permission are marked risky on the Scan screen. Permission-based, phone only, not sent to the hub.
Repository onlyDevice health and posture
#052
Privilege Escalation
Endpoint and malware
Partial
A rule exists and is tested, but nothing in production produces its input, so it cannot fire. A hub-only SUID check runs on request.
Runs in production
#053
Persistence Mechanisms
Endpoint and malware
Partial
The server collector notices new login accounts; the hub's file-integrity check covers cron, systemd and SSH keys on request. Linux agent 3.20 also scans every 5 minutes for new or changed cron jobs, systemd units, rc.local, shell profiles, authorized_keys additions and setuid files against a hash baseline (rule BE-11); not real time, and not yet run on a real Linux host.
Runs in production
#054
DLL / Library Sideloading
Endpoint and malware
No sensor
No module-load telemetry in any running build
Nothing runs
#055
Process Injection
Endpoint and malware
No sensor
No cross-process memory telemetry
Nothing runs
#056
Credential Dumping
Endpoint and malware
Partial
Linux server agent 3.20 checks, periodically and not in real time, for credential-tool names, unusual /etc/shadow handles, private keys in temporary or web folders and unsafe permissions on .env and key files (rule BE-13). File reads are not audited. No Windows LSASS or macOS keychain telemetry. Not yet run on a real Linux host.
Runs in productionIdentity protection
#057
Pass-the-Hash / Pass-the-Ticket
Endpoint and malware
No sensor
No Kerberos/NTLM telemetry in any running build
Nothing runs
#058
Lateral Movement
Endpoint and malware
Partial
Raises an incident when one user logs in over SSH from 3 or more addresses within an hour. Password logins only; key-based logins are not collected. Linux agent 3.20 adds a hint for a first outbound SSH, SMB, RDP or WinRM connection from a server (BE-14) and an incident when one internal host logs in to 3 or more servers within 10 minutes (BE-15); hints, not proof; not yet run on a real Linux host.
Runs in production
#059
Data Exfiltration
Endpoint and malware
Partial
The server rule BE-5 has an opt-in input from Linux agent 3.20 (off by default per host): unusual outbound volume against the host's own level, interface totals only, not attributed to a destination or process. The desktop rule still has no input. Not yet run on a real Linux host.
Production + repository
#060
Insider Threat
Endpoint and malware
No sensor
No user-behaviour baseline or data-access telemetry
Nothing runs
#061
Cloud IAM Abuse
Cloud, container, supply chain and data
No sensor
No cloud audit-log ingestion
Nothing runs
#062
Cloud Metadata Abuse
Cloud, container, supply chain and data
No sensor
No workload egress telemetry
Nothing runs
#063
Exposed Cloud Storage
Cloud, container, supply chain and data
No sensor
No storage-policy telemetry
Nothing runs
#064
Container Escape
Cloud, container, supply chain and data
No sensor
No container runtime telemetry
Nothing runs
#065
Malicious Container Image
Cloud, container, supply chain and data
No sensor
No image scanning
Nothing runs
#066
Exposed Docker Socket
Cloud, container, supply chain and data
No sensor
No Docker socket monitoring
Nothing runs
#067
Kubernetes RBAC / API Abuse
Cloud, container, supply chain and data
No sensor
No Kubernetes audit telemetry
Nothing runs
#068
Kubernetes Secret Theft
Cloud, container, supply chain and data
No sensor
No Kubernetes secret-access telemetry
Nothing runs
#069
Supply-Chain Compromise
Cloud, container, supply chain and data
No sensor
No third-party vendor or dependency telemetry
Nothing runs
#070
Dependency Confusion
Cloud, container, supply chain and data
No sensor
No package-resolution telemetry
Nothing runs
#071
Typosquatting Package
Cloud, container, supply chain and data
No sensor
No package-install telemetry
Nothing runs
#072
CI/CD Pipeline Compromise
Cloud, container, supply chain and data
No sensor
No CI/CD audit telemetry
Nothing runs
#073
Software Update Attack
Cloud, container, supply chain and data
Partial
The server agent refuses an update whose signature, expiry, version, hash, size or platform fails. Tested, but those tests are not in CI; the legacy channel still accepts an MD5 check.
Runs in production
#074
Git / Repository Compromise
Cloud, container, supply chain and data
No sensor
No repository audit telemetry
Nothing runs
#075
Secrets Exposure
Cloud, container, supply chain and data
No sensor
No secret-scanning rule found in code.
Nothing runs
#076
Database Compromise
Cloud, container, supply chain and data
No sensor
No query-audit telemetry
Nothing runs
#077
Backup Destruction
Cloud, container, supply chain and data
No sensor
No backup-integrity monitoring; no restore drill (CURRENT_STATUS P10)
Nothing runsMalware and ransomware protection
#078
Log / Evidence Tampering
Cloud, container, supply chain and data
No sensor
No sequence-gap, heartbeat-gap or log-truncation detection
Nothing runs
#079
Defense Impairment
Cloud, container, supply chain and data
Partial
Android Device Admin disable attempts are reported and can trigger an automatic lock. The server-side config-tampering rule exists but nothing feeds it.
Production + repositoryDevice health and posture
#080
Wiper / Destructive Malware
Endpoint and malware
Observable
The desktop burst counter also counts deletions in approved folders, but no wiper-specific rule exists. Repository only.
Repository onlyMalware and ransomware protection
#081
Cryptojacking
Endpoint and malware
Partial
Known miner process names and pool ports are checked on request on servers; Android 4.2 has a miner/dropper permission pattern. Untested; nothing reaches correlation.
Production + repositoryDevice health and posture
#082
Mobile Banking Trojan
Endpoint and malware
Partial
Android 4.2 marks apps with SMS, overlay, accessibility and install-packages permissions as risky. Scan screen only; no runtime overlay detection.
Repository onlyDevice health and posture
#083
Malicious APK / Sideloading
Endpoint and malware
Partial
Android 4.2 hashes APK files in storage for a lookup, and the posture score counts the unknown-sources setting. The lookup needs a reputation key; no test.
Production + repositoryDevice health and posture
#084
Mobile Spyware / Stalkerware
Endpoint and malware
Observable
Android 4.2 records microphone, camera, location and contacts permissions per app, but no stalkerware rule uses them.
Repository onlyDevice health and posture
#085
iOS/WebKit/Zero-Click Exploit
Endpoint and malware
No sensor
There is no iOS product.
Nothing runs
#086
macOS Persistence / Credential Attack
Endpoint and malware
No sensor
macOS agent sends no XDR telemetry; desktop watches approved folders only (no LaunchAgents/keychain)
Nothing runs
#087
Linux Server Compromise
Endpoint and malware
Partial
The server collector and two fed rules (brute force, lateral movement) cover part of a server compromise. Only the hub agent is verified to send this telemetry.
Runs in productionDevice health and posture
#088
Kernel / Driver Exploit
Endpoint and malware
Partial
rkhunter and chkrootkit can be run on request on Linux servers. No kernel-module or driver telemetry.
Runs in productionDevice health and posture
#089
UEFI / Bootkit / Firmware Attack
Endpoint and malware
No sensor
No firmware/boot telemetry
Nothing runs
#090
USB / BadUSB
Endpoint and malware
No sensor
No device-arrival telemetry
Nothing runs
#091
IoT Device Compromise
Web3, AI and specialised (incl. IoT/OT)
No sensor
No working LAN device discovery; no IoT telemetry
Nothing runs
#092
Router / Home Gateway Compromise
Web3, AI and specialised (incl. IoT/OT)
No sensor
No router configuration or firmware telemetry
Nothing runs
#093
OT / ICS Attack
Web3, AI and specialised (incl. IoT/OT)
No sensor
No OT/ICS protocol telemetry
Nothing runs
#094
Malicious Document
Endpoint and malware
Observable
Generic on-demand scanners can see a malicious document file; no document-specific rule.
Runs in production
#095
Media Parser Exploit
Endpoint and malware
Observable
Generic on-demand scanners only; no parser or codec telemetry.
Runs in production
#096
Archive / Compression Attack
Endpoint and malware
Observable
Generic on-demand scanners only; the desktop scanner skips files over 25 MB and does not open archives.
Runs in production
#097
Domain Typosquatting / Homograph
Scam, browser and network
No sensor
No homograph or look-alike comparison
Nothing runsPhishing protection
#098
Domain / Subdomain Takeover
Scam, browser and network
No sensor
No DNS-record inventory
Nothing runs
#099
SIM Swap
Scam, browser and network
No sensor
No SIM-change telemetry
Nothing runsIdentity protection
#100
Payment / UPI Fraud
Scam, browser and network
No sensor
No payment or UPI telemetry
Nothing runsScam protection QR code protection
#101
Wallet / Seed Phrase Theft
Web3, AI and specialised (incl. IoT/OT)
No sensor
No wallet or clipboard telemetry
Nothing runs
#102
Malicious dApp / Approval Drainer
Web3, AI and specialised (incl. IoT/OT)
No sensor
No transaction-signing telemetry
Nothing runs
#103
Smart-Contract Exploit
Web3, AI and specialised (incl. IoT/OT)
No sensor
No contract analysis
Nothing runs
#104
Bridge / Oracle / DeFi Attack
Web3, AI and specialised (incl. IoT/OT)
No sensor
No bridge/oracle telemetry
Nothing runs
#105
Adversarial ML Evasion
Web3, AI and specialised (incl. IoT/OT)
No sensor
No ML detector exists to evade; no evasion benchmark
Nothing runsAI-adversary defense
#106
Model / Data Poisoning
Web3, AI and specialised (incl. IoT/OT)
No sensor
No training pipeline or data provenance checks
Nothing runsAI-adversary defense
#107
Prompt Injection
Web3, AI and specialised (incl. IoT/OT)
No sensor
No AI agent surface instrumented
Nothing runsAI-adversary defense
#108
Indirect Prompt Injection
Web3, AI and specialised (incl. IoT/OT)
No sensor
No AI agent surface instrumented
Nothing runsAI-adversary defense
#109
AI Tool / Agent Hijacking
Web3, AI and specialised (incl. IoT/OT)
No sensor
No tool-call telemetry
Nothing runsAI-adversary defense
#110
AI Secrets Exfiltration
Web3, AI and specialised (incl. IoT/OT)
No sensor
No secret-egress telemetry
Nothing runsAI-adversary defense
#111
Malicious AI Connector / MCP-like Tool
Web3, AI and specialised (incl. IoT/OT)
No sensor
No connector identity/scope telemetry
Nothing runsAI-adversary defense
#112
AI-Generated Polymorphic Malware
Endpoint and malware
No sensor
No behavioural engine; hashes do not generalise to variants
Nothing runs
#113
Self-Modifying / Metamorphic Malware
Endpoint and malware
No sensor
No runtime/memory telemetry
Nothing runs
#114
Autonomous Agentic Attack
Endpoint and malware
No sensor
No adaptive-attack detection; correlation has six static rules
Nothing runs
#115
Threat-Intelligence Poisoning
Endpoint and malware
No sensor
No threat-intelligence feed to poison or validate (VirusTotal lookup only)
Nothing runs
#116
Threat-Hunting Evasion
Endpoint and malware
No sensor
No baseline of normal admin behaviour
Nothing runs
#117
Living-off-the-Land Abuse
Endpoint and malware
Partial
The server collector flags a short list of shell patterns; a desktop rule for PowerShell started from Downloads exists but has no process source. Neither raises an incident in production.
Production + repository
#118
Web Shell
Endpoint and malware
Partial
Linux server agent 3.20 flags new PHP, JSP and ASPX files in web roots with eval, system or base64_decode patterns and web-server users running a shell (rule BE-12). Pattern based and periodic: obfuscated shells can evade it. Not yet run on a real Linux host.
Runs in production
#119
Memory-Only Shellcode
Endpoint and malware
Partial
The server collector flags processes whose binary no longer exists on disk. Stored only; no memory scanning.
Runs in production
#120
Token / API Key Replay
Application, API and identity
No sensor
No token-context binding or replay anomaly; revocation is preventive
Nothing runs
#121
Cross-Tenant Data Leakage
Application, API and identity
No sensor
No alert on cross-tenant access. Prevention is extensively tested.
Nothing runs
#122
Shadow IT / Unauthorized SaaS
Cloud, container, supply chain and data
No sensor
No SaaS/egress inventory
Nothing runs
#123
Data Poisoning of Business Systems
Cloud, container, supply chain and data
No sensor
No input-provenance telemetry
Nothing runs
#124
Adversarial File/Parser Evasion
Cloud, container, supply chain and data
No sensor
No parser-robustness telemetry; scanner has no parser
Nothing runs
#125
Security Product Supply-Chain Attack
Cloud, container, supply chain and data
Partial
Covers the server-agent update channel only: signed manifests checked against a pinned key. Desktop and Android updates are not covered by this path.
Runs in production
#126
False-Positive Induced Denial of Service
Cloud, container, supply chain and data
No sensor
No detection of false-positive floods. The desktop caps every action at WARN, which limits the harm.
Nothing runs
#127
Recovery / Restore Sabotage
Cloud, container, supply chain and data
Partial
The desktop quarantine refuses to restore a container whose header or encryption check fails, and raises a high-severity signal. Tested; repository only.
Repository onlyMalware and ransomware protection

[04]Rules and ATT&CK

The detection rules that exist, and whether anything feeds them

Each hub rule carries a registry id, a level (0–15) and ATT&CK techniques, stamped on every incident it raises. An ATT&CK mapping labels a rule; it is never counted as detection on its own.

Detection rules with ATT&CK techniques, thresholds, input state and location
Rule	Level	ATT&CK	Threshold	Input	Runs	Families
SSH brute force BIDUA-HUB-0001 · BE-1 · tested	10	T1110.001, T1110.003	5 failed logins from one address in 300 s	Fed	Hub, production	#24 #23 #87
Port scan (v2) BIDUA-HUB-0002 · BE-2 · tested v1 read a field the agent never sent and could not fire. v2 (2026-10-02) reads the agent's own port-scan events; the register records v2 as not yet deployed when it was written.	7	T1046	10 distinct ports from one peer in 60 s	Fed	Hub, production	#49
Privilege escalation BIDUA-HUB-0003 · BE-3 · tested	13	T1068, T1548	Any single privilege-escalation event	Inert	Hub, production	#52
Lateral movement BIDUA-HUB-0004 · BE-4 · tested	10	T1021.004, T1078	3+ source addresses for one user's SSH logins in 1 h	Fed	Hub, production	#58 #87
Data exfiltration (unusual outbound volume) BIDUA-HUB-0005 · BE-5 · tested Off by default on each host (organisation policy exfil_watch). Interface byte totals: not attributed to a destination or process. Needs a real Linux host to verify.	13	T1041, T1048, T1567	Any single data-exfiltration event; the Linux agent 3.20 sends one when 10 minutes of outbound traffic is 8x the host's own level and at least 500 MB	Fed	Hub, production	#59
Config tampering BIDUA-HUB-0006 · BE-6 · tested	10	T1562.001	3+ config changes in 300 s per tenant	Inert	Hub, production	#79
Persistence change BIDUA-HUB-0011 · BE-11 · tested Linux agent 3.20. Scanned every 5 minutes, not real time; the first scan only records the baseline. Package-manager changes are ignored. Needs a real Linux host to verify.	10	T1053.003, T1543.002, T1037.004, T1546.004, T1098.004, T1548.001	Any single persistence-change event: a new or changed cron job, systemd unit or timer, rc.local, shell profile, authorized_keys entry or setuid binary against the agent's hash baseline	Fed	Hub, production	#53
Reverse shell or web shell indicator BIDUA-HUB-0012 · BE-12 · tested Linux agent 3.20. Pattern based on a 30 s process list and a 5 minute file scan: an indicator, never a certainty. Needs a real Linux host to verify.	12	T1059.004, T1505.003	Any single shell-indicator event: a reverse-shell command pattern, a web-server user running a shell, or web-shell code in a new web file	Fed	Hub, production	#118 #5
Credential dumping or sensitive-file exposure BIDUA-HUB-0013 · BE-13 · tested Linux agent 3.20. Periodic checks, not real time; file reads are not audited. Needs a real Linux host to verify.	10	T1003.008, T1552.001, T1552.004	Any single credential-access event: a credential-tool name, an unusual /etc/shadow handle, a private key in a temporary or web directory, unsafe permissions or an access burst on .env and key files	Fed	Hub, production	#56
New outbound remote-service connection BIDUA-HUB-0014 · BE-14 · tested Linux agent 3.20. A hint to review, not proof. Needs a real Linux host to verify.	8	T1021.004, T1021.001, T1021.002, T1021.006	Any single lateral-movement-hint event: a first outbound SSH, SMB, RDP or WinRM connection after a 6 hour observation period	Fed	Hub, production	#58
One internal host logging in to many servers BIDUA-HUB-0015 · BE-15 · tested	10	T1021.004, T1078	3+ servers accepting logins from one private source address in 600 s	Fed	Hub, production	#58
PowerShell launched from Downloads BIDUA-PROC-0001 · DT-1 · tested	10	T1059.001, T1204.002	Parent path contains Downloads and process is powershell.exe	Inert	Desktop, repository	#117
Known-bad destination domain BIDUA-NET-0001 · DT-2 · no test	10	T1071	Destination equals a reserved test domain	Inert	Desktop, repository	—
Suspicious test file BIDUA-FILE-0001 · DT-3 · tested	7	none (test convention)	File path contains a test-file convention	Test file	Desktop, repository	#1
Rapid file changes (ransomware burst) BIDUA-RANSOM-0001 · DT-4 · tested Fed by the desktop file-change counter, but the desktop app is not shipped.	10	T1486	Exactly 20 changes in 10 000 ms in approved folders	Fed	Desktop, repository	#2

categories.unproduced10

Defined and ATT&CK-mapped, but nothing produces them yet. Each would need a sensor before any rule could use it.

impossible_travelioc_matchlog_gapbaseline_deviationlogin_success_new_ipmalware_detectedfile_modificationservice_anomalynetwork_anomalymobile_discovery

response.authorityalert only

The hub correlation engine stores events and incidents; it takes no response action. Blocking an address is a manual administrator action.

The desktop policy gate caps every automatic action at WARN. On Android, the hub can queue a device lock on a high posture score or a tamper report, which the owner can turn off.

[05]Findings

What the last review found

F-01Only SSH password guessing (brute force) meets our "detected" bar today: a sensor feeds a rule, and a test proves the rule fires. Even there, the collector can re-send old log lines, so a stale failure can re-raise an incident.
F-02Of the six server-side correlation rules, three can receive input in production: brute force, lateral movement and — since the 2026-10-02 fix — port scan. Privilege escalation, data exfiltration and config tampering are written and tested, but nothing produces their input.
F-03Ten event categories (for example impossible travel, IOC match, log gap and malware detected) are defined and mapped to ATT&CK, but nothing produces them. A mapping on its own is not detection.
F-04The desktop app has four detection rules and three correlation rules. Only the ransomware-burst rule and a test-file rule can receive real input; the others wait for a native sensor that is not built. Every action is capped at WARN.
F-05The Windows event-tracing adapter maps 21 event types but has no live session anywhere, so none of it counts.
F-06On Android, the posture score runs in production, but three of its signals cannot fire from a real phone yet: Play Integrity always reports unknown, there is no on-device malware-app producer, and Play Protect state is not collected.
F-07Web and API attacks (injection, XSS, SSRF and similar) have no web-application firewall or request-body sensor; the only observation is the hub's own web-server log, read on request.

[06]Methodology

How the register is built, and how a status moves up

GATE 1 · RULE
A rule aimed at the family
Code that looks for this attack, with a stated threshold — not a label or an ATT&CK mapping.
+
GATE 2 · SENSOR
A real sensor feeds it
Something in the product produces the rule's input outside tests. A rule nothing feeds is "inert" and counts as partial.
+
GATE 3 · TEST
A test makes it fire
An automated test exercises the trigger condition. Manual scripts excluded from CI do not count.
=
RESULT
Detected
Miss any gate: partial, observable or no sensor.

STEP 1
Taxonomy
The 127 family ids and names are taken exactly from our threat-defense strategy document, section 39.
STEP 2
Surface
Each family is assigned to one of five surfaces: endpoint, application/identity, scam/browser/network, cloud/supply chain, and future specialised modules.
STEP 3
Inventory
Every sensor and rule in the code was read: the hub correlation engine, the server agents, the hub-side modules, the Android app and the desktop app.
STEP 4
Tests
Every test tree was searched for each rule, and the test that actually exercises the trigger was recorded.
STEP 5
Producers
For each rule, who produces its input was checked. A rule with no producer is reported as inert.
STEP 6
Recount
The tables were generated from one data file, then the statuses were recounted independently from the finished document. Both counts agree.

Caveats the register states about itself

!Production behaviour of agents on servers that were offline, and and the exact content of the Android APK shipped on 2 October 2026 (version 4.1), were not verified.
!Thresholds are the code defaults; environment overrides on the server were not inspected.
!Detection telemetry was verified end to end on the hub agent and a small number of other servers; the Windows agent has been verified on one Windows Server.
!The backend test suites are configured for CI but CI has not been observed running; the server-agent tests are not in CI.
!The register must be regenerated whenever a rule, sensor or test is added. A status moves up only with a cited rule, a cited producer and a cited test.

Why publish this?

A count you can check is worth more than a claim you cannot. A status moves up only when a rule, a real input and a test all exist. See each capability's share →

What this page is not

It is not a live threat feed, and it contains no statistics from customer data. Attack descriptions on our pages describe general patterns, not specific incidents.

Security research

Guides and research

Practical defensive guides for people and for server operators. Original threat research will be published here when we have findings worth sharing.

Scams · 7 min

Payment and UPI scams: a field checklist

Collect requests, refund tricks and "pay to receive" — how payment scams work and the few rules that defeat almost all of them.

Scams · 6 min

Why a "support agent" wants you to install an app

Screen-sharing and remote-control apps are legitimate tools. In a scammer's hands they hand over your phone. How the scam runs and how to get out of it.

Phishing · 6 min

Reading a link before you tap it

Phishing lives on domains that are almost right. A two-minute skill: how to find who actually owns a link.

All guides

What we can see, and what we cannot yet.

127 families · 1 detected · 27 partial · 15 observable · 84 no sensor

Where the coverage is, and where it is not

Every family, with its honest status

The detection rules that exist, and whether anything feeds them

What the last review found

How the register is built, and how a status moves up

A rule aimed at the family

A real sensor feeds it

A test makes it fire

Taxonomy

Surface

Inventory

Tests

Producers

Recount

Guides and research