{
  "schema": 1,
  "generator": "wardensec-selfplay 1",
  "label": "Synthetic and offline: the build-time adversary and benign corpus replayed through the full pipeline over a synthetic estate. Not a measurement of any real estate.",
  "corpus": {
    "attack": 91,
    "benign": 13
  },
  "techniques": {
    "V-001": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-002": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-003": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-004": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-006": {
      "variants": 4,
      "detected": 4,
      "recall": 1
    },
    "V-008": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-009": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-010": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-011": {
      "variants": 3,
      "detected": 3,
      "recall": 1
    },
    "V-011a": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-012": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-013": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-013a": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-014": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-014a": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-014b": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-015": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-015a": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-016": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-017": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-017a": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-018": {
      "variants": 4,
      "detected": 4,
      "recall": 1
    },
    "V-019": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-020": {
      "variants": 3,
      "detected": 3,
      "recall": 1
    },
    "V-021": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-022": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-023": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-024": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-025": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-026": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-027": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-028": {
      "variants": 3,
      "detected": 3,
      "recall": 1
    },
    "V-029": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-030": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-031": {
      "variants": 3,
      "detected": 3,
      "recall": 1
    },
    "V-032": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-033": {
      "variants": 3,
      "detected": 3,
      "recall": 1
    },
    "V-034": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-035": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-036": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-037": {
      "variants": 3,
      "detected": 3,
      "recall": 1
    },
    "V-038": {
      "variants": 4,
      "detected": 4,
      "recall": 1
    },
    "V-040": {
      "variants": 4,
      "detected": 4,
      "recall": 1
    },
    "V-041": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-043": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-044": {
      "variants": 1,
      "detected": 1,
      "recall": 1
    },
    "V-045": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-046": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-047": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-048": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-049": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-050": {
      "variants": 2,
      "detected": 2,
      "recall": 1
    },
    "V-100": {
      "variants": 3,
      "detected": 3,
      "recall": 1
    }
  },
  "variants": {
    "V-001.active-key-in-pod-env": ["V-001 Active IAM access key inline in workload configuration"],
    "V-002.stop-logging": ["V-002 CloudTrail logging stopped or trail deleted"],
    "V-003.role-by-non-deployer": ["V-003 IAM role created by a non-deployer principal"],
    "V-004.cross-user-mint": ["V-004 Access key minted on another user"],
    "V-006.alias-repointed": ["V-006 Key alias moved to a different key"],
    "V-006.key-disabled": ["V-006 Key disabled or scheduled for deletion while in use"],
    "V-006.key-policy-replaced": ["V-006 Key policy replaced"],
    "V-006.signing-grant": ["V-006 Grant created that lets its holder sign"],
    "V-008.rds-snapshot-shared-out": ["V-008 RDS snapshot shared with an out-of-org account"],
    "V-009.foreign-trust-no-external-id": ["V-009 Third-party role trust without sts:ExternalId"],
    "V-010.inline-star-star": [
      "V-010 Standing admin: Allow on any action and any resource without a restricting condition"
    ],
    "V-011.bucket-shared-with-outside-account": ["V-011 Bucket policy admits accounts outside your organization"],
    "V-011.queue-opened-to-everyone": ["V-011 Queue policy admits callers outside your organization"],
    "V-011.topic-shared-with-outside-account": ["V-011 Topic policy admits callers outside your organization"],
    "V-011a.rcp-detached": ["V-011a No root-attached resource control policy requires aws:PrincipalOrgID"],
    "V-012.access-entry-by-hand": ["V-012 Access entry created or widened outside the deployer identity"],
    "V-012.binding-to-cluster-admin": ["V-012 Binding grants cluster-admin or a wildcard-equivalent role"],
    "V-013.template-imdsv1-fleet": ["V-013 Launch template launches instances that accept IMDSv1"],
    "V-013a.imdsv1-hop-2": ["V-013a EC2 instance accepts IMDSv1 with a hop limit above 1"],
    "V-014.database-opened-to-internet": ["V-014 Publicly accessible database open to the internet on its port"],
    "V-014a.public-endpoint-any": ["V-014a EKS API endpoint public to any address"],
    "V-014b.ssh-open-to-world": ["V-014b Admin port open to the internet on a public instance"],
    "V-015.bucket-opened-to-everyone": [
      "V-015 Bucket public access block not fully enabled",
      "V-015 Bucket readable by anyone"
    ],
    "V-015a.account-pab-off": ["V-015a Account public access block not fully enabled"],
    "V-016.key-used-after-deletion": ["V-016 Revoked credential or identity used successfully after its revocation"],
    "V-017.region-sweep": ["V-017 One principal calling into five or more regions within a minute"],
    "V-017a.foreign-denied-burst": ["V-017a Denied calls from a principal outside the organization"],
    "V-018.instance-password-harvest": ["V-018 Instance passwords or launch data read in a burst"],
    "V-018.parameter-path-decrypt": ["V-018 Parameter path read with decryption by a principal that never did"],
    "V-018.refused-secret-reads": ["V-018 Secret reads refused in volume"],
    "V-018.secret-sweep": ["V-018 Secrets or parameters read in a sweep by a principal that never read them"],
    "V-019.instance-credentials-off-host": ["V-019 GuardDuty finding of high or critical severity to triage"],
    "V-020.client-sends-password-and-lists-users": [
      "V-020 App client lets the password be sent to the service",
      "V-020 App client tells a caller which users exist"
    ],
    "V-020.open-signup-unverified": [
      "V-020 User pool lets anyone sign up without verifying who they are",
      "V-020 User pool offers no second factor"
    ],
    "V-020.short-passwords": ["V-020 User pool accepts short passwords"],
    "V-021.vendor-addresses-pinned": ["V-021 Edge allowlist admits third-party addresses pinned one by one"],
    "V-022.root-console-no-mfa": ["V-022 Root credentials used in the last 24 h"],
    "V-023.own-registry-by-tag": ["V-023 Workload runs an image by tag, not by digest"],
    "V-023.pod-from-outside-registry": [
      "V-023 Workload runs an image by tag, not by digest",
      "V-023 Workload runs an image from a registry outside the allowed list"
    ],
    "V-024.recorder-stopped": ["V-024 Another security tool's alarm switched off or told to look away"],
    "V-025.iam-read-denied": ["V-025 Coverage gap: collector receipt not OK"],
    "V-026.model-access-and-logging-cut": [
      "V-026 Foundation-model access opened by a principal with no model history",
      "V-026 Model invocation logging or a guardrail removed"
    ],
    "V-027.versioning-suspended": ["V-027 Bucket versioning suspended by a non-deployer"],
    "V-028.admin-granted-to-one-person": ["V-028 Administrator access is assigned to an individual user"],
    "V-028.admin-in-management-account": [
      "V-028 Administrator access is assigned in the Identity Center management account"
    ],
    "V-028.twelve-hour-admin-session": [
      "V-028 Administrator permission set keeps sessions open for more than eight hours"
    ],
    "V-029.clusterrolebinding-by-hand": ["V-029 Kubernetes RBAC written outside the deployer identity"],
    "V-030.cronjob-by-hand": ["V-030 Scheduled job written outside the GitOps identity"],
    "V-030.webhook-and-daemonset-by-other-account": [
      "V-030 Admission webhook written outside the GitOps identity",
      "V-030 Workload written outside the GitOps identity"
    ],
    "V-031.host-pid-and-container-socket": [
      "V-031 Workload mounts a sensitive directory of the node",
      "V-031 Workload shares the node's process, IPC or network namespace"
    ],
    "V-031.privileged-debug-pod": ["V-031 Workload runs a privileged container"],
    "V-031.root-container": ["V-031 Workload runs a container as root"],
    "V-032.ssm-run-command": ["V-032 Command run on hosts through SSM by a non-deployer"],
    "V-033.fork-pr-builds-as-admin": [
      "V-033 Build project runs as an administrator role",
      "V-033 Build project starts from pull requests anyone can open"
    ],
    "V-033.personal-access-token-stored": ["V-033 Source-provider credential is a long-lived token"],
    "V-033.public-project-with-token": [
      "V-033 Build project holds secret-named variables in plaintext",
      "V-033 Build project is readable by anyone"
    ],
    "V-034.coding-agent-admin": ["V-034 AI coding agent identity with administrative or escalation access"],
    "V-034.mcp-function-url-open": ["V-034 AI or agent tooling reachable from the internet without authentication"],
    "V-035.environment-tag-only": ["V-035 Active access key whose user has no owner or consumer tag"],
    "V-035.untagged-user-with-key": ["V-035 Active access key whose user has no owner or consumer tag"],
    "V-036.attestation-accepts-any-image": ["V-036 Key policy requires attestation but accepts any enclave image"],
    "V-036.host-role-decrypts-without-attestation": [
      "V-036 Key opens to an enclave host's role without requiring attestation"
    ],
    "V-037.distribution-repointed": [
      "V-037 CDN distribution or edge function changed by something other than the deployer"
    ],
    "V-037.origin-open-to-write": ["V-037 CDN origin bucket accepts writes from outside the estate"],
    "V-037.origin-readable-by-any-distribution": ["V-037 CDN origin bucket lets any CloudFront distribution read it"],
    "V-038.cluster-from-backup": ["V-038 HSM cluster built or restored from a backup by a non-deployer"],
    "V-038.copy-backup-out": ["V-038 HSM backup copied to another region by a non-deployer"],
    "V-038.delete-backups": ["V-038 HSM backup deleted by a non-deployer"],
    "V-038.delete-cluster": ["V-038 HSM cluster deleted by a non-deployer"],
    "V-040.forgotten-token-parameter": [
      "V-040 Application token parameter has no expiry and has not changed in a year"
    ],
    "V-040.password-in-plain-parameter": ["V-040 Secret stored as a plain-text parameter"],
    "V-040.recovery-phrase-in-plain-parameter": ["V-040 Recovery secret stored as a plain-text parameter"],
    "V-040.unrotated-token-secret": ["V-040 Application token secret is never rotated and has not changed in a year"],
    "V-041.shadow-policy-version": [
      "V-041 Customer-managed policy keeps a non-default version broader than its default"
    ],
    "V-043.young-user-escalates": ["V-043 A principal used a privilege tier for the first time"],
    "V-044.bait-in-role-tag": ["V-044 Text planted to steer an AI reviewer, written by a principal of the estate"],
    "V-045.decoy-key-used": ["V-045 Ember access key used"],
    "V-045.decoy-secret-read": ["V-045 Ember secret read"],
    "V-046.kev-package-behind-load-balancer": ["V-046 Known vulnerability in an installed package"],
    "V-046.private-package-named-like-a-squatter": ["V-046 Package name is listed as malicious on the public registry"],
    "V-047.hash-confirmed-malicious-package": ["V-047 Proven malicious package is running"],
    "V-047.kev-package-internet-admin": ["V-047 Vulnerability exploited in the wild on software open to the internet"],
    "V-048.cluster-in-extended-support": ["V-048 Kubernetes version is in or near the end of standard support"],
    "V-048.engine-past-end-on-the-internet": [
      "V-048 Managed database or data service version is in or near the end of support"
    ],
    "V-049.cache-update-past-apply-by": ["V-049 Cache service has a security update waiting"],
    "V-049.patches-for-an-exploited-flaw": ["V-049 Instance is missing security patches"],
    "V-050.image-from-a-public-registry": ["V-050 Running images come from a registry no scanner reads"],
    "V-050.inspector-off-on-a-web-host": ["V-050 Amazon Inspector is off where software runs"],
    "V-100.cloudshell-role": ["V-100 Identity holds full CloudShell access"],
    "V-100.single-zone-database": ["V-100 Database instance runs in a single zone"],
    "V-100.unencrypted-database": ["V-100 Database instance is not encrypted at rest"]
  },
  "benign": {
    "cloud-ranges.node-from-auto-assigned-address": [],
    "deployer.private-bucket": [],
    "deployer.role-rollout": [],
    "egress-on-blocklist.operator-console": [],
    "egress-on-blocklist.workload-reads": [],
    "eks-token-review.operator-kubectl": [],
    "eks-token-review.pipeline-kubectl": [],
    "enclave-host.imdsv2-hop-2": [
      "V-013a high Weak-IMDS instance set grew",
      "V-013a low EC2 instance metadata hop limit above 1",
      "V-013a low Weak-IMDS instance set"
    ],
    "gitops-apply.release": [],
    "service-linked.autoscaling-first-use": [],
    "service-linked.config-recorder": [],
    "service-linked.security-hub-standard": [],
    "session-token.mfa-step": []
  },
  "benign_false_positives": 3,
  "control_day_open": [
    "V-002 GuardDuty detector absent in an enabled region",
    "V-011a Management account hosts EC2, EKS or RDS workloads",
    "V-011a Root-attached service control policies do not deny every guarded tamper action",
    "V-011a Scanner hub or spoke session in the management account",
    "V-041 IAM role trusts an identity provider that does not exist in its account"
  ],
  "vulns": {
    "cases": 21,
    "expectations": 29,
    "passed": 29,
    "recall": 1,
    "precision": 1,
    "results": {
      "affected-plain": "pass",
      "backdoor-on-vulnerable-host": "pass",
      "declared-official-tag": "pass",
      "distro-fix-applied": "pass",
      "fat-jar-on-ssm-host": "pass",
      "forged-surge": "pass",
      "hash-confirmed-malicious": "pass",
      "kernel-below-usn-fix": "pass",
      "kernel-kev-fixed-by-usn": "pass",
      "lapsed-inspector-coverage": "pass",
      "lying-tag": "pass",
      "mixed-digest-daemonset": "pass",
      "nginx-from-debian": "pass",
      "private-package-named-like-a-squatter": "pass",
      "python3-urllib3-backport": "pass",
      "quiet-head": "pass",
      "recon-probe-on-vulnerable-host": "pass",
      "scanner-hand-over": "pass",
      "scanner-hand-over-reported": "pass",
      "unparseable-version": "pass",
      "withdrawn-advisory": "pass"
    }
  },
  "ratchet": [
    {
      "technique": "V-039",
      "reason": "V-039 is removed: no collector reads a hot wallet, so the rule could never observe what it checks.",
      "reviewer": "warden#33 review"
    }
  ]
}