Oliver Kieselbach 88dfd331dd fix(security): LocalAdminAnalyzer inventories disabled accounts and reads Administrators-group membership from the SAM (NetLocalGroupGetMembers on S-1-5-32-544); a dormant /active:no admin backdoor now surfaces as unexpected_admin_members (+40, Error), built-in Administrator enabled-state reported for evidence ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 01:00:29 +02:00

..

ANALYZE-APP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-010.json

feat: externalize rules to GitHub + API consolidation + preview mode

2026-02-28 13:12:09 +01:00

ANALYZE-APP-012.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-013.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-014.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-015.json

rules: hybrid user-affinity + never-settled-app detection, dsregcmd on_event snapshot, evidence interpolation fixes

2026-08-14 13:39:16 +02:00

ANALYZE-APP-016.json

fix(agent): recover ESP completion after a forced mid-ESP reboot

2026-08-19 17:00:59 +02:00

ANALYZE-APP-017.json

feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads

2026-08-27 19:40:17 +02:00

ANALYZE-CORR-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-DEV-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-008.json

feat(backend): P6 split - CMTrace skew tripwire + customer clock_skew rule

2026-08-20 22:30:10 +02:00

ANALYZE-DEV-009.json

feat(agent): live power-state watcher + battery analyze rules DEV-009/010

2026-08-21 15:24:41 +02:00

ANALYZE-DEV-010.json

feat(agent): live power-state watcher + battery analyze rules DEV-009/010

2026-08-21 15:24:41 +02:00

ANALYZE-DEV-012.json

feat(agent): system timeline watcher — clock steps + sleep episodes as ground truth

2026-08-21 19:41:56 +02:00

ANALYZE-ENRL-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-ENRL-002.json

rules+backend+mcp: rule-verify sweep fixes (dead factor, {{token}} evidence, stats cap, list stringify)

2026-08-14 16:50:29 +02:00

ANALYZE-ENRL-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ENRL-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ENRL-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-004.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-ESP-005.json

fix(agent): recover ESP completion after a forced mid-ESP reboot

2026-08-19 17:00:59 +02:00

ANALYZE-ESP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-002.json

fix(security): LocalAdminAnalyzer inventories disabled accounts and reads Administrators-group membership from the SAM (NetLocalGroupGetMembers on S-1-5-32-544); a dormant /active:no admin backdoor now surfaces as unexpected_admin_members (+40, Error), built-in Administrator enabled-state reported for evidence

2026-08-30 01:00:29 +02:00

ANALYZE-ID-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-004.json

ANALYZE-ID-004 v1.2.0: pre-logon VPN + Hello-as-symptom self-service guidance

2026-08-17 13:36:10 +02:00

ANALYZE-NET-001.json

feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads

2026-08-27 19:40:17 +02:00

ANALYZE-OFFICE-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00