Detection capabilities
What detection does today, what has been measured, and what is not yet qualified, with every count and its denominator.
What detection does today
Recursift keeps signed rule packs in the console and sends a file scan or an event replay to the endpoints you name. Each endpoint returns completion, match state and coverage as separate fields. An endpoint that did not report reads as unknown, never as no match. Rules are written in the YARA rule language or in a supported subset of the Sigma rule format. The console also keeps the Atomic Red Team catalog as reference metadata.
The endpoint’s file-scan worker runs with bounded time, memory and output. Its only performance figures, from September 22, 2026, used a synthetic stand-in for the scanning engine, so real scanning cost has not been measured. In the default runtime the worker does not yet keep its local scan evidence.
Rule formats and compatibility
Measured on September 21, 2026, on one macOS 26.5.1 (build 25F80) arm64 host. The source records: “No other platform has been qualified by running anything.” Rule compatibility is qualified on macOS only; other platforms not qualified.
YARA rule language. Five constructs were compiled on both engines the agent carries: the scanning engine, version 1.20.0, and a compatibility engine, version 4.5.8.
| Construct | Compatibility engine 4.5.8 | Scanning engine 1.20.0 | Scanning engine, relaxed regular expressions |
|---|---|---|---|
| /abc{/ unescaped brace | Compiles | Error E014 | Compiles |
| /foo\gbar/ invalid escape | Compiles | Error E014 | Compiles |
| "ab" base64 (two characters) | Compiles | Error E024 | Fails |
| 1 of (Helper*) rule wildcard | Compiles | Error E001 | Fails |
| global global rule | Compiles | Error E001 | Fails |
Relaxed regular expressions are used only after a strict compile fails with a regular-expression error, and that use is recorded on the rule. They are never the default. Rules are not rewritten to hide a divergence. Only the scanning engine reports every scanned file, including clean ones, so only it can supply the file denominator that a no-match result requires. The compatibility engine is a second opinion at compile time.
Sigma rule format. The mapping profile is recursift-sigma-v1, measured against the Sigma 2.1.0 specification. The profile was printed with recursift-agent validation sigma-profile on September 27, 2026. Every unsupported construct is rejected when the rule loads, and the rejection names it.
| Construct | Supported | Rejected at load |
|---|---|---|
| Modifiers (4 of 31 supported) | all, contains, startswith, endswith | exists, cased, neq, windash, re, i, m, s, base64, base64offset, utf16le, utf16be, utf16, wide, lt, lte, gt, gte, minute, hour, day, week, month, year, cidr, expand, fieldref |
| Conditions (2 of 9 supported) | selection; selection and not filter | AND/OR chains, 1 of them, all of them, 1 of selection*, not 1 of filter*, keywords, parentheses |
| Matching | Case-insensitive by default | None |
| Log source | process_creation only from a process-event stream; process snapshots are process_inventory | A rule that needs process creation reports not_applicable against snapshots |
A rule that names a field from the 23-field process-creation contract that the collector does not carry evaluates to unknown. Imported Sigma matches are reported separately from Recursift’s reviewed heuristic matches.
| Shipped pack | Format | Version | Rules | Qualification evidence |
|---|---|---|---|---|
| recursift-literal-v1 | YARA rule language | 1.0.0 | 2 | Compiled on the scanning engine 1.20.0 |
| recursift-macos-v1 | YARA rule language | 1.1.0 | 2 | Compiled on the scanning engine 1.20.0 |
| recursift-process-v1 | Sigma | 1.0.0 | 2 | Profile recursift-sigma-v1 |
| recursift-macos-v1 | Sigma | 1.1.0 | 2 | Profile recursift-sigma-v1 |
The agent also carries 20 original heuristic rules. They are not imported or validated Sigma rules.
Collectors and platforms
Qualified means the collector was run on a named host and its coverage was measured. Built, not qualified means source exists but no qualification run has passed. Not built means no source exists. Each status comes from the agent’s own documentation; none is inferred.
| macOS collector | Status | Evidence |
|---|---|---|
| File-change events during a registered test window | Qualified, file behavior only | Measured on the agent’s macOS test host. Carries no process ID or parent, so a file change is not attributed to a process. |
| Process snapshots | Built, not qualified | Never qualified for process creation. Processes that start and exit between polls are missed. |
| Process start, fork and exit from the operating system’s security event interface | Built, not qualified | Needs an operating-system entitlement that has not been granted, plus Full Disk Access and root. Reports collector_unavailable_privilege. |
| Process events from the legacy audit subsystem | Built, not qualified | Blocked on the measured host: the audit configuration does not exist. |
| File operations from the security event interface | Built, not qualified | Isolated source. Not wired into the runtime or the evidence archive. |
| Network flows, first observation per flow | Built, not qualified | Source build only. Not signed, installed or activated. |
| DNS queries | Not built | No local source observes DNS lookups. |
| Windows collector | Status | Evidence |
|---|---|---|
| Event tracing session host | Built, not qualified | Forced loss, idle CPU and idle memory measured on Windows 11 Pro 10.0.26200.9457 ARM64 on September 24, 2026. The session emits no process events. x64 is unqualified. |
| Process creation events | Not built | The agent has no Windows process producer. |
| File and network events | Not built | The agent records these native adapters as not implemented. |
| Logging readiness assessment, 11 checks | Built, not qualified | Configuration assessment, not event collection. Not validated on a native Windows endpoint. |
| Ubuntu collector | Status | Evidence |
|---|---|---|
| Process start and exit from kernel tracing | Built, not qualified | One arm64 VM run on September 23, 2026 (Ubuntu 24.04.5 LTS, kernel 6.8.0). The corrected rerun has not run. Not wired into the agent runtime. |
| File operations from kernel tracing | Built, not qualified | Not wired into the runtime or the evidence archive. |
| Network connections from kernel tracing | Built, not qualified | Connection lifecycle only. DNS and resolver health report unavailable. |
| DNS queries | Not built | The DNS source is not linked or built. |
Atomic catalog
The console’s catalog holds 1,878 Atomic Red Team tests across 344 techniques. They come from upstream catalog commit 388942adbd9641f4dfdcf079d7efe9a75ec0ac43 and were imported on September 21, 2026. The catalog file was measured at webapp commit d9e81975448c22356b7d698d8d2a7e1adbcb388d, file SHA-256 251692153105c89f963bde42b47ff85440423542a1eb34e85cabfb526ed41573. All 1,878 tests are imported as metadata only; each has risk class unreviewed. Command text is not stored.
- Imported: the test lists that operating system. A test that lists more than one is counted under each, so the operating-system rows sum to 1,961, not 1,878.
- Qualified: run end to end on a qualified platform with independently measured detection. The count is 0 of 1,878.
- Available: on the agent’s reviewed no-download execution allowlist for that operating system (policy no-downloads-v1). Each entry is reviewed, not qualified: it still needs native platform validation.
- Unavailable: imported, and not on the allowlist for that operating system.
| Platform | Imported | Qualified | Available | Unavailable |
|---|---|---|---|---|
| Windows | 1,260 of 1,878 | 0 of 1,260 | 6 of 1,260 | 1,254 of 1,260 |
| Linux | 434 of 1,878 | 0 of 434 | 2 of 434 | 432 of 434 |
| macOS | 267 of 1,878 | 0 of 267 | 4 of 267 | 263 of 267 |
| No endpoint operating system (cloud, identity, SaaS, containers) | 81 of 1,878 | 0 of 81 | 0 of 81 | 81 of 81 |
The allowlist has 11 entries. Ten are distinct imported tests; two of them list both Linux and macOS. The eleventh is a Recursift staging-file canary for Linux and macOS that is not in the imported catalog, so it is not counted in the table.
Which detector applies to which test class
For every test the catalog records technique, tactics, platforms and executor. It records no file artifact. Catalog metadata alone therefore cannot show which tests leave something a file-content rule could match.
| Test class | Tests | Relevant detector | Detection today |
|---|---|---|---|
| Command executors: powershell 734, command_prompt 563, sh 435, bash 130 | 1,862 of 1,878 | Sigma rules over process-creation events | No qualified process-creation collector on any platform. Against snapshots, these rules report not_applicable. |
| Tests that write or drop a file | Not recorded in the catalog | File-content scan with YARA-language rules; Sigma file-event rules | Scan efficacy is not qualified. No file-event Sigma mapping is published, so the reviewed staging-file canary reads detection inconclusive, reason mapping_unavailable. |
| Manual executor | 16 of 1,878 | None | Not executable. No detector applies. |
| No endpoint operating system | 81 of 1,878 | None on the endpoint | No endpoint-side detector applies. |
| Reviewed discovery tests (T1082, T1057, T1124) | 10 of 11 allowlist entries | Process-creation evidence only. No artifact-based detector: the reviewed commands write no file and need no cleanup. | Detection reads mapping_unavailable. |
Release revisions measured
| Repository | Commit | Date | Measured |
|---|---|---|---|
| agent | cff2728 | 2026-09-27 | Main head. Detection sources unchanged since the engine notes (5e365e6, 2026-09-21), rule packs (70d03f3, 2026-09-21), Sigma profile (fc51e33, 2026-09-22) and reviewed allowlist (23dc294, 2026-09-21). Scanning engine 1.20.0; compatibility engine 4.5.8; profile recursift-sigma-v1. |
| webapp | cfb115f | 2026-09-27 | Main head. Atomic catalog file unchanged since d9e8197 (2026-09-21): 1,878 tests, upstream commit 388942a. |
| api | 6d23a5e | 2026-09-27 | Main head. The detection:read and detection:scan scopes are enforced before console forwarding (e574136, 2026-09-26). |
| Host | Date | What ran |
|---|---|---|
| macOS 26.5.1 (25F80), arm64 | 2026-09-21 | Rule compatibility matrix |
| macOS 26.5 (25F71), arm64 | 2026-09-12 | Collector table and column verification; 70 read-only packs executed once |
| Windows 11 Pro 10.0.26200.9457, ARM64 | 2026-09-24 | Event tracing session loss, CPU and memory |
| Ubuntu 24.04.5 LTS VM, arm64, kernel 6.8.0 | 2026-09-23 | Process tracing first delivery; the corrected rerun has not run |
Known gaps and owners
Each gap links to the issue that owns it. The gaps after the links have no issue of their own yet, and each names where its owner is recorded. Issue links open for accounts with access to the Recursift repositories.
- agent#171: finish registered execution and real file scanning, including scan evidence wiring and measured engine cost
- agent#9: qualify the first native process lifecycle source and replace the mapping-unavailable bridge
- agent#174: independent endpoint and native sensor regression
- agent#175: qualify Windows, Ubuntu, macOS and posture coverage
- agent#62: keep sensor events through restart within a quota
- agent#72: Ubuntu process start and exit
- agent#74: Ubuntu connections and DNS
- agent#85: macOS entitlement, signing, distribution and install prerequisites
- agent#87: macOS network flow and DNS evidence
- api#3: secrets in raw evidence and model outputs, and peer or model evidence against the action gate (acceptance 3 and 4)
- webapp#4: Atomic Red Team validation with local detection, the parent scope for this page
- No macOS file-event Sigma mapping. The sources assign it to the closed engine delivery, agent#1, which shipped without it. The measurement path that needs it is agent#171.
- Records from native sources carry no Sigma log-source category, so a rule against them returns not_applicable rather than a coverage gap. The agent notes assign this to whichever change introduces event schema versioning; no issue is named yet.
- Child-process policy is published and bound, but not enforced at launch. External prevention has not been demonstrated.
Last measured
September 27, 2026, against the commits listed above. This page will be measured again when agent#171 lands. Until then, the numbers here are the current state.