fix(monitor): treat PERSIST-002 and MULTI-001 as high-FP single-rule verdicts#33
Merged
Merged
Conversation
…verdicts Auditing the residual single-rule MALICIOUS tier (issue #30) surfaced two more rules that over-flag legitimate content when they alone drive a conviction, confirmed by running them against benign inputs: - MALWAR-PERSIST-002 matches self-referential SKILL.md/CLAUDE.md/.claude file ops including reads ('cat SKILL.md | grep') and legit skill-authoring tools that write a CLAUDE.md. - MALWAR-MULTI-001 matches benign prose about quiet/deferred execution ('applies the patch without showing the full diff'). Both join HIGH_FP_RULES, so a single-rule MALICIOUS verdict on them is verified-or-downgraded rather than auto-convicted. MALWAR-PERSIST-001 (cron/systemd/.bashrc) did NOT over-flag in testing and stays a confident single-signal rule. Recall preserved: the rules still fire on the malicious fixtures; corroborated (2+ rule) verdicts are unaffected. Shrinks the unverified single-rule MALICIOUS tier from 82 to 39 on the current snapshot. Full unit suite (1440) passes. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What / why
Works the top item of #30: auditing the 82 MALICIOUS verdicts that still rested
on a single unverified rule. Running those rules against benign inputs (the same
method that caught CMD-001/ENV-001) surfaced two more that over-flag:
SKILL.md/CLAUDE.md/.claude/— including reads (cat SKILL.md | grep)and legitimate skill-authoring tools that write a
CLAUDE.md.("applies the patch without showing the full diff").
Both join
HIGH_FP_RULES, so a single-rule MALICIOUS verdict on them isverified-or-downgraded, not auto-convicted.
MALWAR-PERSIST-001 (cron / systemd /
.bashrc) did not over-flag intesting and deliberately stays a confident single-signal rule.
Impact
(2+ rule) verdicts unaffected.
current snapshot (43 PERSIST-002/MULTI-001 cases now verify-or-downgrade).
and PERSIST-001 is not.
Note
Numbers update on the next full re-scan (genuinely-malicious cases get
LLM-confirmed back; false positives downgrade). Does not by itself close #30 —
the remaining 39 sit on tighter rules that didn't over-flag, plus the other
checklist items (detector novelty logic, human-approval gate, dry-run mode).
🤖 Generated with Claude Code
Generated by Claude Code