v0.7.1 · updated 2026-09-05 · GitHub

MITRE, Sigma & Evasion

How detections are tagged, exported, and why simple encodings do not bypass them. For the 26 rows with confidence/description/example, see Categories.

MITRE ATT&CK mapping — verified IDs

IDs from pkg/analysis/detectionTechniques, verified against ATT&CK. The mapping is used for Sigma export; current JSON and HTML report records do not include a techniques array.

Category	Technique ID	Name
`sql_injection`	T1190	Exploit Public-Facing Application
`nosql_injection`	T1190	Exploit Public-Facing Application
`xss`	T1059.007	Command and Scripting Interpreter: JavaScript
	T1189	Drive-by Compromise
`ssti`	T1190	Exploit Public-Facing Application
`ssrf`	T1190	Exploit Public-Facing Application
`rce`	T1059	Command and Scripting Interpreter
	T1190	Exploit Public-Facing Application
`path_traversal`	T1083	File and Directory Discovery
`lfi_wrapper_abuse`	T1083	File and Directory Discovery
	T1190	Exploit Public-Facing Application
`graphql_introspection`	T1595.002	Active Scanning: Vulnerability Scanning
`log4j_jndi`	T1190	Exploit Public-Facing Application
	T1059	Command and Scripting Interpreter
`sensitive_file_probe`	T1083	File and Directory Discovery
	T1552.001	Unsecured Credentials: Credentials In Files
`admin_probe`	T1595.002	Active Scanning: Vulnerability Scanning
`wordpress_probe`	T1595.002	Active Scanning: Vulnerability Scanning
`cgi_probe`	T1595.002	Active Scanning: Vulnerability Scanning
`scanner`	T1595	Active Scanning
`xxe`	T1190	Exploit Public-Facing Application
`open_redirect`	T1566.002	Phishing: Spearphishing Link
`ldap_injection`	T1190	Exploit Public-Facing Application
`xpath_injection`	T1190	Exploit Public-Facing Application
`crlf_injection`	T1190	Exploit Public-Facing Application
	T1059	Command and Scripting Interpreter
`prototype_pollution`	T1190	Exploit Public-Facing Application
	T1059.007	Command and Scripting Interpreter: JavaScript
`ssi_injection`	T1190	Exploit Public-Facing Application
	T1059	Command and Scripting Interpreter
`ua_rotation`	T1595.001	Active Scanning: Scanning IP Blocks
`jwt_abuse`	T1550.001	Use Alternate Authentication Material: Application Access Token
	T1190	Exploit Public-Facing Application
`object_enumeration`	T1595.002	Active Scanning: Vulnerability Scanning
	T1190	Exploit Public-Facing Application
`beaconing`	T1071.001	Application Layer Protocol: Web Protocols
	T1573	Encrypted Channel

Source of truth: pkg/analysis/detect.go:64-91. If an ID looks wrong, open an issue — IDs are not approximated.

Sigma export — 23 of 26

Pattern categories export; 3 behavioral do not (they need state, not a single request).

Exported	Why
23 pattern categories	Single-request regex + `uri\|status\|client_ip` fields, deterministic `uuidV5` (`uuidNamespaceDNS + "caddy-analyzer:sigma:"+title`)
3 excluded: `ua_rotation`, `object_enumeration`, `beaconing`	Need ≥10 samples per IP/path, CV check, ring buffer — not expressible as single-event Sigma

caddy-analyze export-sigma rules.yml
caddy-analyze export-sigma - | sigma check --rules -  # validate
# import into Splunk/Elastic — tags carry ATT&CK IDs above

Evasion resistance

Why %2e%2e, double-encode and mixed case do not bypass detection.

Technique	How	Code
Dual-pass	Every URI checked as `decodeURI` (query-aware `PathUnescape+QueryUnescape` + manual `%` fallback) and raw	`DetectAll` + `rawPatterns` in `init()`
Literal fast path	Pure alternations matched via `strings.Contains` lowercased (~100× faster)	`extractPureLiterals / compileLowercase`
Gate	Longest required literal must be present (`strings.Contains`) before regex runs	`extractGate`
Markers / triage	Collect all ≥2-char literals; if none present, skip all patterns for that source	`buildMarkers / matchMarkers / isMarkerCovered`
Case-fold elimination	Compile regexes lowercased, lowercase source once — no `FoldCase` per match (~8% CPU saved)	`lowercaseFold`
LRU caps	IPs 100k, GeoIP 50k, histogram 1K buckets	`DefaultIPCap, geoCache`

Test that bypass is covered: rawPatterns includes %2e%2e%2f, %252e, %c0%ae, 0x7f000001 etc. See pkg/analysis/detect.go:778-801 and testdata/generate.py fixtures.