new_module.yml
new_module.yml
| Name | About | Labels | Assignees |
|---|---|---|---|
| New attack module | Propose a new attack technique for the module directory. | module |
This is the most valuable contribution to the project. The module directory is what keeps a framework like this alive.
Read CONTRIBUTING.md first. Modules are pure: they build a payload from a context and judge evidence from an event list — no filesystem, no network, no session state. That purity is what makes them safe to accept from strangers.
Open the issue before the pull request. The question below about observable evidence decides whether the technique can be measured at all, and it is cheaper to answer here than after the code is written.
The module id, in snake_case. It becomes the class id, the filename, and the name of the generated docs page.
One sentence describing what the technique does, written for the techniques table. Over twenty characters.
Where the technique sits in the chain. The phases are declared in the order a real intrusion moves through them, and the report renders them in that order.
The technique this maps to at https://atlas.mitre.org/. Every shipped module carries one, so a finding can be handed to a security team in a vocabulary they already use.
A writeup, advisory, CVE or disclosed incident showing this technique in the wild. mcpbait tests attacks that happen, not attacks that could be imagined. One good link is worth more than five speculative ones.
What makes a reasonable agent comply. This becomes the why field on the class and is published on the technique page, so write it for a reader who has not seen the payload.
mcpbait only reports what it can observe from the server side. What lands in the log when this technique succeeds -- a canary in an argument, a beacon fetch, a marker on disk? A technique with no observable proof can only ever reach BAITED.
How a host, a client or an agent author stops this. This becomes the defence field and closes the published technique page. A module that proves a problem without naming a fix is half a contribution.