Collectors & Detection
Each endpoint observes itself through a bank of collectors and scores every change with a deterministic, MITRE ATT&CK–mapped detection engine before any AI is involved. This page lists the collectors and explains how detection works — so a known-bad signal always crosses threshold, even offline.
Collectors
Collectors are pull-based: each cycle every enabled collector polls and returns events, which raise risk through the policy engine and feed the entity model. Only the file collector is truly event-driven (a filesystem watcher); the rest are interval polls (default poll_secs: 30). Collectors that shell out to tooling that isn't present (container, k8s, image scan, cloud) self-gate to empty rather than erroring, so they are safe to enable everywhere. Toggle any of them in configuration under collectors.*.
| Collector | Observes | Platform |
|---|---|---|
processes | new/exited processes and parent/child spawn edges | all |
files | dropped files, file-integrity monitoring, ransomware mass-encryption (event-driven, hashed) | all |
network | new connections and listeners (loopback/RFC1918 scored low, abused/public higher) | all |
persistence | launchd/cron/systemd units, Run keys, scheduled tasks, WMI | all |
services | new/stopped services; a vanished service is treated as defense evasion | all |
logs | OS security logs (journald / unified log / Windows Event Log) | all |
audit | auditd syscall telemetry (tails audit.log, rotation-safe) | Linux |
etw | Sysmon / ETW operational channel, scored by Event ID (e.g. LSASS access) | Windows |
configuration | config / integrity drift across sensitive roots (/etc, ssh, sudoers, cron…) | all |
credentials licensed | secrets in ~/.aws, .env, key stores | all |
ai_agents licensed | AI-agent / MCP / LLM process activity | all |
| supply-chain licensed | dependency manifests | all |
containers | containers / pods / images (auto-discovers crictl / docker / nerdctl) | container hosts |
| k8s API | risky pods and cluster-admin RBAC bindings (AURA_K8S_CLUSTER_AGENT=1) | Kubernetes |
| image scan | image CVE scanning via Trivy (AURA_IMAGE_SCAN=1) | container hosts |
| cloud audit | EKS/AKS/GKE control-plane audit logs (AURA_CLOUD_AUDIT=gcp|aws|azure) | cloud |
| metrics | CPU/mem/disk/network sampling with EWMA baselines (cryptominer signal) | all, always on |
| custom | analyst-authored read-only probes pushed from the hub (tcp_port, http, process_count, disk_free, log_match_rate) | all |
metrics and custom collectors, plus the SLO / alert / correlation evaluators, power the SRE / reliability lens — they emit reliability signals rather than threat detections, and are covered in detail on the Reliability page.Detection engine
The primary engine is a versioned, ATT&CK-mapped, Sigma-style rule library (~40 bundled rules) using any/all/none substring conditions. Each rule carries a technique, tactic, severity and target entity kind. Rules are extensible by dropping ~/.antemure/detection-rules.json on a node. A rule match sets a risk floor before any LLM call, so a known-bad signal always crosses threshold — even on an offline or unlicensed node.
Coverage includes reverse shells and curl-pipe-to-shell, a deep Credential Access family (LSASS dumping, SAM/NTDS theft, DCSync, pass-the-hash), defense tampering, persistence, privilege escalation, lateral movement, exfiltration, ransomware, and ATT&CK for Containers/Kubernetes (container escape, docker-socket abuse, privileged pods, cluster-admin service accounts). Extensive negative tests keep benign look-alikes quiet.
Deterministic policy engine
A second, simpler engine applies string-condition rules (field=value, field~pattern, field in <set>) with actions Log, Flag(score) or Block. Built-ins flag execution from /tmp, known-bad hashes, unknown persistence and outbound to new destinations. It runs inside the observe step, raising each event's risk before reasoning.
Ransomware mass-encryption detection
The file collector watches the protected data roots (~/Documents, ~/Desktop, ~/Pictures by default, configurable via collectors.protect_roots / AURA_PROTECT_ROOTS) with canary files, BLAKE3 hashing and encrypted-extension / ransom-note heuristics over a short write window, emitting very-high-risk events (0.95–0.98) for mass-encryption behavior (ATT&CK T1486).
Fleet immunity
When any node raises an incident, the hub learns its indicators and pushes them to every other node's watchlist. A local match against that shared watchlist raises a proactive risk-0.8 event — so one endpoint's detection inoculates the fleet. Antemure's own footprint is excluded to avoid self-detection.
Scoring & ATT&CK
Risk is a 0–1 score combined from detection-rule floors and heuristic category scoring (world-writable exec, masquerade, new persistence, and so on), with co-occurring categories escalating an attack chain. Every rule and incident carries MITRE ATT&CK technique and tactic; incidents are classified by technique (e.g. T1003* → credential dumping, T1486/T1490 → ransomware, T1021 → lateral movement) and the techniques are persisted per incident for reporting.
Platform & licensing notes
- Licensed collectors (credential scan, supply-chain, AI-agent) require a valid license in production; everything else runs unlicensed.
- Linux-only: auditd syscall telemetry. Windows-only: Sysmon/ETW. Both no-op on other platforms.
- Gated by env: k8s API, image scan and cloud audit collectors activate only when their environment flag is set; otherwise they self-gate to empty.