Expand description
The output vocabulary: a Finding is one rule firing, tagged with a hygiene category, a severity, and one or more MITRE ATT&CK techniques.
Modules§
- mitre
- Common techniques, referenced by checks so the mapping lives in one place.
Structs§
- Attack
Result - Evidence
- A single piece of ground-truth evidence substantiating a finding (WS-PROOF): the actual server/client artifact — an LDAP attribute value, an MS-RRP registry key, a SAMR field, a wire status code — that a reviewer can verify by hand, independent of adhammer’s verdict. This is the difference between “you have X” (our word) and “the server returned Y, which is X” (proof).
- Finding
- Mitre
- MITRE ATT&CK technique reference, e.g. (“T1558.003”, “Kerberoasting”).