SHENRON rule durability

Read this before the durability numbers

The rule hit counts on the 50 demo events are solid. Two independent reviews reproduced them.

The scenario scores come from SHENRON's campaign brittleness scorer, and the reviews found four defects in it. The biggest: it checked every event in a stage before mutation but only the single mutated event after, so a rule still firing on a sibling event counted as evaded. Fixing that alone takes all six scenarios to 0.00. It also counted stages no rule detected as evasion, only mutated the layer field, and drew seeds that changed between runs. With all four fixed in PR #71, all six scenarios score 0.00 in three runs, so the scenario ranking is withdrawn.

The mutation rounds and per-rule scores come from a different code path, and they reproduce exactly with and without PR #71. They are accurate but narrow: the only detection field any round changed was layer. They show which rules depend on that one label, not how rules hold up against real attacker variation.

0.00 isn't proof of durability either. The rules still match on labels the mutator never changes. PR #72 pilots rules that match on simulated observables instead.

Every rule, tested against the same 50 events

Each tile is one Sigma rule, grouped by folder. Select one to see its verdict and source.

Kept firing every round Stopped after mutation Never fired

Eight rounds of adaptive mutation

Each round, SHENRON scores mutation strategies by how many fields of the still-firing rules they target, favours ones it hasn't used, applies the winner to all 50 events and re-runs the rules. Mutations build on each other. Bars show the four rules that fired before mutation.

Where each attack scenario breakswithdrawn

Brittleness by kill-chain stage across six freshly generated campaigns, as the scorer originally reported it. Deeper rust means a higher score; dashed cells are stages the scenario doesn't include.

ATT&CK tags compared with the telemetry

Technique tags on rules versus technique tags on events, at the parent level (T1071.001 counts as T1071). A tag doesn't prove a rule detects the technique, so read this as overlap, not coverage.

The synthetic events

The 50 JSONL records the rule verdicts were scored against.