📖 Recipes Reference

📚 Complete Field Reference

Complete reference guide for all recipe configuration fields, file actions, macros, and advanced filtering options.

Using reading_of_ssh_keys.yaml as an example:

  # Reading of SSH keys detected.
- kind: reading_of_ssh_keys
  name: reading_of_ssh_keys
  enabled: true
  version: 1.0
  description: Reading of SSH keys detected
  #
  documentation: https://garnet.gitbook.io/jibril/detections/file-access/reading_of_ssh_keys
  breed: file_access
  mechanism: file_access
  tactic: credential_access
  technique: unsecured_credentials
  importance: medium
  #
  file_actions:
    - read
  file_actions_how: any
  #
  times:
    - kind: times_per_exe
      max: 2
    - kind: times_per_parent_exe
      max: 4
    - kind: times_per_full_ancestry
      max: 4
  #
  arbitrary:
    - how: AND
      which: pertinent
      items:
        - what: cmd
          pattern: "(containerd|sshd|ssh|scannercli|runc|update-ssh-keys|coreos-metadata|worker-[1-5])"
          which: irrelevant
        - what: args
          pattern: "/(python|dist-packages)/"
          which: irrelevant
  bases:
    - regex: "(authorized_keys|identity.pub|id_rsa.pub|id_rsa|ssh_config|id_dsa.pub|id_dsa|sshd_config|ssh_host_dsa_key.pub|ssh_host_dsa_key|ssh_host_rsa_key.pub|ssh_host_rsa_key|ssh_host_key.pub|ssh_host_key)$"

📋 Required Fields

• kind - Unique identifier for the recipe type
• name - Name of the specific recipe instance
• version - Recipe version (numeric)
• description - Brief description

• mechanism - Detection mechanism type
• breed - Detection category
• tactic - MITRE ATTACK tactic
• technique - MITRE ATTACK technique
• importance - Severity level (low/medium/high/critical)

Optional fields:

• subtechnique - MITRE ATTACK sub-technique

📁 File Action Values

Individual Actions

• fasync: File asynchronous operations
• flock: File locking operations
• fsync: File synchronization
• llseek: Low-level seek operations
• mmap: Memory mapping operations
• open: File open operations
• read: File read operations
• write: File write operations
• rename: File rename operations
• truncate: File truncation operations
• unlink: File deletion operations
• create: File creation operations
• close: File close operations
• link: Hard link operations
• execve: Executable file operations

Action Matching

• how - Specifies how actions should match
  • any - Any action matches
  • all - All actions must match

🔧 File Action Macros

Macros provide convenient shortcuts for common file action patterns. Instead of listing each individual action, use these macros in your recipes.

📦 any

Matches all file actions - useful for comprehensive monitoring.

Includes:

• fasync
• flock
• fsync
• llseek
• mmap
• open
• read
• write
• rename
• truncate
• unlink
• create
• close
• link
• execve

📂 open_related

File opening and closing operations.

Includes:

• open
• close

📖 read_related

File reading operations including seek and memory mapping.

Includes:

• llseek
• mmap
• read

✏️ modify_related

File modification operations.

Includes:

• fsync
• write
• rename
• truncate
• unlink
• create
• link

🔍 access_related

General file access (reads and writes).

Includes:

• fsync
• llseek
• mmap
• open
• read
• write
• rename
• truncate
• unlink
• create
• close
• link

🔍 access_no_mmap_related

File access without memory mapping operations.

Includes:

• fsync
• llseek
• open
• read
• write
• rename
• truncate
• unlink
• create
• close
• link

🔧 tamper_related

File tampering - rename, delete, and link operations.

Includes:

• rename
• truncate
• unlink
• link

Times Kind Values

Limit Type	Scope Description
times_per_proc	Per process
times_per_exe	Per executable
times_per_parent_proc	Per parent process
times_per_parent_exe	Per parent executable
times_per_full_ancestry	Per full process tree
times_per_hostname	Per hostname
times_per_host	Global limit

🏷️ Alchemy Classification

⚗️ Mechanism

What core aspect does this recipe operate on?

• file_access
• execution
• network_peers

🧬 Breed

What is the specific target or context?

• file_access
• execution
• remote_domains
• remote_cidrs
• env_vars

🔥 Importance

How severe or impactful is the matched recipe?

• low
• medium
• high
• critical