{ "schema": 1, "generator": "wardensec-selfplay 1", "label": "Synthetic and offline: the build-time adversary and benign corpus replayed through the full pipeline over a synthetic estate. Not a measurement of any real estate.", "corpus": { "attack": 91, "benign": 13 }, "benign_false_positives": 3, "techniques": [ { "technique": "V-001", "attck": [], "status": "detected", "rules": ["V-001"], "checks": ["V-001 Active IAM access key inline in workload configuration"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-002", "attck": [], "status": "detected", "rules": ["V-002"], "checks": ["V-002 CloudTrail logging stopped or trail deleted"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-003", "attck": ["T1136.003", "T1098"], "status": "detected", "rules": ["V-003"], "checks": ["V-003 IAM role created by a non-deployer principal"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-004", "attck": ["T1098.001"], "status": "detected", "rules": ["V-004"], "checks": ["V-004 Access key minted on another user"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-005", "attck": [], "status": "not_detected", "rules": ["V-005"], "checks": [], "cadence": "hourly", "variants": 0, "detected": 0, "band": null, "gaps": ["no self-play variant exercises this rule"] }, { "technique": "V-006", "attck": [], "status": "detected", "rules": ["V-006"], "checks": [ "V-006 Grant created that lets its holder sign", "V-006 Key alias moved to a different key", "V-006 Key disabled or scheduled for deletion while in use", "V-006 Key policy replaced" ], "cadence": "daily", "variants": 4, "detected": 4, "band": "100%", "gaps": [] }, { "technique": "V-007", "attck": [], "status": "not_detected", "rules": ["V-007"], "checks": [], "cadence": "daily", "variants": 0, "detected": 0, "band": null, "gaps": ["no self-play variant exercises this rule"] }, { "technique": "V-008", "attck": ["T1537"], "status": "detected", "rules": ["V-008"], "checks": ["V-008 RDS snapshot shared with an out-of-org account"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-009", "attck": [], "status": "detected", "rules": ["V-009"], "checks": ["V-009 Third-party role trust without sts:ExternalId"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-010", "attck": [], "status": "detected", "rules": ["V-010"], "checks": ["V-010 Standing admin: Allow on any action and any resource without a restricting condition"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-011", "attck": [], "status": "detected", "rules": ["V-011"], "checks": [ "V-011 Bucket policy admits accounts outside your organization", "V-011 Queue policy admits callers outside your organization", "V-011 Topic policy admits callers outside your organization" ], "cadence": "daily", "variants": 3, "detected": 3, "band": "100%", "gaps": [] }, { "technique": "V-011a", "attck": [], "status": "detected", "rules": ["V-011a"], "checks": ["V-011a No root-attached resource control policy requires aws:PrincipalOrgID"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-012", "attck": [], "status": "detected", "rules": ["V-012"], "checks": [ "V-012 Access entry created or widened outside the deployer identity", "V-012 Binding grants cluster-admin or a wildcard-equivalent role" ], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-013", "attck": [], "status": "detected", "rules": ["V-013"], "checks": ["V-013 Launch template launches instances that accept IMDSv1"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-013a", "attck": ["T1552.005"], "status": "detected", "rules": ["V-013a"], "checks": ["V-013a EC2 instance accepts IMDSv1 with a hop limit above 1"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-014", "attck": [], "status": "detected", "rules": ["V-014"], "checks": ["V-014 Publicly accessible database open to the internet on its port"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-014a", "attck": [], "status": "detected", "rules": ["V-014a"], "checks": ["V-014a EKS API endpoint public to any address"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-014b", "attck": [], "status": "detected", "rules": ["V-014b"], "checks": ["V-014b Admin port open to the internet on a public instance"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-015", "attck": [], "status": "detected", "rules": ["V-015"], "checks": ["V-015 Bucket public access block not fully enabled", "V-015 Bucket readable by anyone"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-015a", "attck": [], "status": "detected", "rules": ["V-015a"], "checks": ["V-015a Account public access block not fully enabled"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-016", "attck": [], "status": "detected", "rules": ["V-016"], "checks": ["V-016 Revoked credential or identity used successfully after its revocation"], "cadence": "hourly", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-017", "attck": [], "status": "detected", "rules": ["V-017"], "checks": ["V-017 One principal calling into five or more regions within a minute"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-017a", "attck": [], "status": "detected", "rules": ["V-017a"], "checks": ["V-017a Denied calls from a principal outside the organization"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-018", "attck": [], "status": "detected", "rules": ["V-018"], "checks": [ "V-018 Instance passwords or launch data read in a burst", "V-018 Parameter path read with decryption by a principal that never did", "V-018 Secret reads refused in volume", "V-018 Secrets or parameters read in a sweep by a principal that never read them" ], "cadence": "hourly", "variants": 4, "detected": 4, "band": "100%", "gaps": [] }, { "technique": "V-019", "attck": [], "status": "detected", "rules": ["V-019"], "checks": ["V-019 GuardDuty finding of high or critical severity to triage"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-019a", "attck": [], "status": "out_of_scope", "rules": ["V-019a"], "checks": [], "cadence": null, "variants": 0, "detected": 0, "band": null, "gaps": [ "grades another sensor's findings beside Warden's (GuardDuty parity); there is no adversary act to replay, only a third-party verdict" ] }, { "technique": "V-020", "attck": ["T1078.004", "T1136.003"], "status": "detected", "rules": ["V-020"], "checks": [ "V-020 App client lets the password be sent to the service", "V-020 App client tells a caller which users exist", "V-020 User pool accepts short passwords", "V-020 User pool lets anyone sign up without verifying who they are", "V-020 User pool offers no second factor" ], "cadence": "daily", "variants": 3, "detected": 3, "band": "100%", "gaps": [] }, { "technique": "V-020a", "attck": ["T1078.004", "T1136.003"], "status": "not_detected", "rules": ["V-020a"], "checks": [], "cadence": "hourly", "variants": 0, "detected": 0, "band": null, "gaps": ["no self-play variant exercises this rule"] }, { "technique": "V-021", "attck": [], "status": "detected", "rules": ["V-021"], "checks": ["V-021 Edge allowlist admits third-party addresses pinned one by one"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-022", "attck": [], "status": "detected", "rules": ["V-022"], "checks": ["V-022 Root credentials used in the last 24 h"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-023", "attck": [], "status": "detected", "rules": ["V-023"], "checks": [ "V-023 Workload runs an image by tag, not by digest", "V-023 Workload runs an image from a registry outside the allowed list" ], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-024", "attck": [], "status": "detected", "rules": ["V-024"], "checks": ["V-024 Another security tool's alarm switched off or told to look away"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-025", "attck": [], "status": "detected", "rules": ["V-025"], "checks": ["V-025 Coverage gap: collector receipt not OK"], "cadence": "hourly", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-026", "attck": [], "status": "detected", "rules": ["V-026"], "checks": [ "V-026 Foundation-model access opened by a principal with no model history", "V-026 Model invocation logging or a guardrail removed" ], "cadence": "hourly", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-027", "attck": [], "status": "detected", "rules": ["V-027"], "checks": ["V-027 Bucket versioning suspended by a non-deployer"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-028", "attck": [], "status": "detected", "rules": ["V-028"], "checks": [ "V-028 Administrator access is assigned in the Identity Center management account", "V-028 Administrator access is assigned to an individual user", "V-028 Administrator permission set keeps sessions open for more than eight hours" ], "cadence": "daily", "variants": 3, "detected": 3, "band": "100%", "gaps": [] }, { "technique": "V-029", "attck": [], "status": "detected", "rules": ["V-029"], "checks": ["V-029 Kubernetes RBAC written outside the deployer identity"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-030", "attck": [], "status": "detected", "rules": ["V-030"], "checks": [ "V-030 Admission webhook written outside the GitOps identity", "V-030 Scheduled job written outside the GitOps identity", "V-030 Workload written outside the GitOps identity" ], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-031", "attck": [], "status": "detected", "rules": ["V-031"], "checks": [ "V-031 Workload mounts a sensitive directory of the node", "V-031 Workload runs a container as root", "V-031 Workload runs a privileged container", "V-031 Workload shares the node's process, IPC or network namespace" ], "cadence": "daily", "variants": 3, "detected": 3, "band": "100%", "gaps": [] }, { "technique": "V-032", "attck": [], "status": "detected", "rules": ["V-032"], "checks": ["V-032 Command run on hosts through SSM by a non-deployer"], "cadence": "hourly", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-033", "attck": [], "status": "detected", "rules": ["V-033"], "checks": [ "V-033 Build project holds secret-named variables in plaintext", "V-033 Build project is readable by anyone", "V-033 Build project runs as an administrator role", "V-033 Build project starts from pull requests anyone can open", "V-033 Source-provider credential is a long-lived token" ], "cadence": "daily", "variants": 3, "detected": 3, "band": "100%", "gaps": [] }, { "technique": "V-034", "attck": [], "status": "detected", "rules": ["V-034"], "checks": [ "V-034 AI coding agent identity with administrative or escalation access", "V-034 AI or agent tooling reachable from the internet without authentication" ], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-035", "attck": [], "status": "detected", "rules": ["V-035"], "checks": ["V-035 Active access key whose user has no owner or consumer tag"], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-036", "attck": [], "status": "detected", "rules": ["V-036"], "checks": [ "V-036 Key opens to an enclave host's role without requiring attestation", "V-036 Key policy requires attestation but accepts any enclave image" ], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-037", "attck": [], "status": "detected", "rules": ["V-037"], "checks": [ "V-037 CDN distribution or edge function changed by something other than the deployer", "V-037 CDN origin bucket accepts writes from outside the estate", "V-037 CDN origin bucket lets any CloudFront distribution read it" ], "cadence": "daily", "variants": 3, "detected": 3, "band": "100%", "gaps": [] }, { "technique": "V-038", "attck": [], "status": "detected", "rules": ["V-038"], "checks": [ "V-038 HSM backup copied to another region by a non-deployer", "V-038 HSM backup deleted by a non-deployer", "V-038 HSM cluster built or restored from a backup by a non-deployer", "V-038 HSM cluster deleted by a non-deployer" ], "cadence": "hourly", "variants": 4, "detected": 4, "band": "100%", "gaps": [] }, { "technique": "V-040", "attck": [], "status": "detected", "rules": ["V-040"], "checks": [ "V-040 Application token parameter has no expiry and has not changed in a year", "V-040 Application token secret is never rotated and has not changed in a year", "V-040 Recovery secret stored as a plain-text parameter", "V-040 Secret stored as a plain-text parameter" ], "cadence": "daily", "variants": 4, "detected": 4, "band": "100%", "gaps": [] }, { "technique": "V-041", "attck": [], "status": "detected", "rules": ["V-041"], "checks": ["V-041 Customer-managed policy keeps a non-default version broader than its default"], "cadence": "daily", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-043", "attck": ["T1078"], "status": "detected", "rules": ["V-043"], "checks": ["V-043 A principal used a privilege tier for the first time"], "cadence": "hourly", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-044", "attck": [], "status": "detected", "rules": ["V-044"], "checks": ["V-044 Text planted to steer an AI reviewer, written by a principal of the estate"], "cadence": "hourly", "variants": 1, "detected": 1, "band": "100%", "gaps": [] }, { "technique": "V-045", "attck": ["T1552", "T1078.004"], "status": "detected", "rules": ["V-045"], "checks": ["V-045 Ember access key used", "V-045 Ember secret read"], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-046", "attck": ["T1190", "T1210"], "status": "detected", "rules": ["V-046"], "checks": [ "V-046 Known vulnerability in an installed package", "V-046 Package name is listed as malicious on the public registry" ], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-047", "attck": ["T1190", "T1195.002", "T1068"], "status": "detected", "rules": ["V-047"], "checks": [ "V-047 Proven malicious package is running", "V-047 Vulnerability exploited in the wild on software open to the internet" ], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-048", "attck": ["T1190", "T1195"], "status": "detected", "rules": ["V-048"], "checks": [ "V-048 Kubernetes version is in or near the end of standard support", "V-048 Managed database or data service version is in or near the end of support" ], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-049", "attck": ["T1190", "T1068"], "status": "detected", "rules": ["V-049"], "checks": ["V-049 Cache service has a security update waiting", "V-049 Instance is missing security patches"], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-050", "attck": ["T1562.001", "T1190"], "status": "detected", "rules": ["V-050"], "checks": [ "V-050 Amazon Inspector is off where software runs", "V-050 Running images come from a registry no scanner reads" ], "cadence": "daily", "variants": 2, "detected": 2, "band": "100%", "gaps": [] }, { "technique": "V-100", "attck": [], "status": "detected", "rules": ["V-100"], "checks": [ "V-100 Database instance is not encrypted at rest", "V-100 Database instance runs in a single zone", "V-100 Identity holds full CloudShell access" ], "cadence": "daily", "variants": 3, "detected": 3, "band": "100%", "gaps": [] } ] }