Telltale
Detection Catalog
This catalog summarizes the bundled rule YAML and detection documentation so investigators can understand what Telltale is matching before they open raw session stores. It is a field reference, not a promise that every risky behavior is detected.
Rule quality contract
Bundled rules use one YAML-driven engine for security detections, policy violations, hunting, compliance observations, operational health, and baseline deviations. The detection content standard requires stable IDs, categories, severity, score, valid targets, matching logic, tags, explanations, and false-positive notes.
- Rule IDs are stable dot-separated identifiers and should not be reused after retirement.
- Categories describe observed behavior; detection_class, signal_type, and analytic_intent describe how analysts should use the event.
- ATLAS tags are offline documentation context only; scans do not fetch MITRE ATLAS.
- Positive fixtures must be synthetic, minimal, and assert redacted evidence rather than raw secrets.
- Negative fixtures are expected when normal developer activity could trigger a rule.
Bundled atomic rules
The catalog below lists the current bundled rules from config/rules/tool-call-regex.yaml. Target fields tell you where the regex or selection evaluates canonical observations.
Bundled Telltale rule catalog
secret.env.read
- Category
- secret_access
- Severity / score
- medium / 35
- Targets
- command, arguments, file_path, assistant_context, tool_result
Access to `.env`-style files; legitimate debugging can match.
secret.private_key.read
- Category
- secret_access
- Severity / score
- high / 55
- Targets
- command, arguments, file_path, tool_result
Private key paths or key material; certificate inventory can match.
credential.api_key.pattern
- Category
- credential_pattern
- Severity / score
- medium / 30
- Targets
- command, arguments, tool_result, assistant_context
Token-shaped strings for hunting; synthetic examples and docs can match.
execution.shell
- Category
- execution
- Severity / score
- low / 15
- Targets
- command, arguments
Shell or interpreter execution; common in normal development and strongest when chained.
execution.encoded_payload
- Category
- execution
- Severity / score
- high / 50
- Targets
- command, arguments
Encoded payload decoding; incident-response or build tasks can be benign.
network.download
- Category
- download
- Severity / score
- low / 20
- Targets
- command, arguments, url
Download by curl, wget, PowerShell, or fetch; expected setup often matches.
install.package_manager
- Category
- install
- Severity / score
- low / 20
- Targets
- command, arguments
Package-manager execution; review package source and surrounding actions.
exfil.outbound_upload
- Category
- exfiltration
- Severity / score
- high / 60
- Targets
- command, arguments, url
Upload or object-storage copy; authorized artifact uploads can match.
persistence.shell_profile
- Category
- persistence
- Severity / score
- high / 45
- Targets
- command, arguments, file_path
Shell profile, cron, service, or launch-agent changes; setup flows can be legitimate.
approval.bypass.context
- Category
- approval_bypass
- Severity / score
- high / 45
- Targets
- assistant_context, command, arguments, tool_result
Language about hiding, no-confirm, or bypassing approval; quoted policy text can match.
tool.injection.shape
- Category
- tool_injection
- Severity / score
- high / 55
- Targets
- assistant_context, tool_name, arguments
Tool-call-shaped content in model output; parser tests and copied logs can match.
mcp.tool_metadata.prompt_injection
- Category
- mcp_prompt_injection
- Severity / score
- high / 60
- Targets
- assistant_context, arguments, tool_result
MCP metadata or output with instruction-override language; security fixtures can match.
network.controlled_test_domain.darkroast
- Category
- exfiltration
- Severity / score
- high / 45
- Targets
- command, arguments, url, assistant_context, tool_result
Controlled Dark Roast Cyber test-domain references; fixtures and validation commands can match.
exfil.dns_encoding
- Category
- exfiltration
- Severity / score
- high / 55
- Targets
- command, arguments
Encoded data in DNS tooling; demos and troubleshooting require context.
exfil.encoded_http
- Category
- exfiltration
- Severity / score
- high / 50
- Targets
- command, arguments
Encoded data sent to HTTP endpoints; expected API payloads can match.
credential.cloud_harvest
- Category
- credential_harvesting
- Severity / score
- high / 50
- Targets
- command, arguments, file_path
Cloud, Kubernetes, Docker, or service-account credential paths; authorized CLI troubleshooting can match.
supply_chain.publish
- Category
- supply_chain
- Severity / score
- high / 45
- Targets
- command, arguments
Package publishing commands; correlate with release intent and credential access.
mcp.server_enumeration
- Category
- mcp_enumeration
- Severity / score
- medium / 40
- Targets
- command, arguments, assistant_context, tool_result
MCP server/tool probing; inventory and integration tests can match.
Chain modifiers
Chain modifiers add risk for co-occurring categories or exact rule IDs in a session window. Names containing “then” do not enforce temporal order. Confirm sequence and impact from preserved evidence.
Bundled Telltale chain modifiers
chain.secret_then_network
- Trigger
- secret_access + download
- Score add
- +35
Secret access near network activity materially increases exfiltration risk.
chain.download_then_execute
- Trigger
- download + execution
- Score add
- +35
Download plus execution warrants review; the modifier does not establish order.
chain.shell_encoded_payload
- Trigger
- execution.shell + execution.encoded_payload
- Score add
- +10
Shell execution plus encoded payload evidence increases deterministic risk.
chain.install_then_persistence
- Trigger
- install + persistence
- Score add
- +30
Package installation plus profile or service persistence warrants analyst review.
chain.mcp_injection_then_egress
- Trigger
- mcp_prompt_injection + exfiltration
- Score add
- +35
MCP prompt injection near outbound egress is the first high-signal alert use case.
chain.credential_then_publish
- Trigger
- credential_harvesting + supply_chain
- Score add
- +40
Credential harvesting plus publishing warrants supply-chain review; confirm intent and order separately.
chain.harvest_then_exfil
- Trigger
- credential_harvesting + exfiltration
- Score add
- +35
Credential harvesting plus exfiltration indicators warrants review; verify actual transfer separately.
chain.mcp_enumeration_then_injection
- Trigger
- mcp_enumeration + mcp_prompt_injection
- Score add
- +30
Enumeration plus injection indicators warrants review; neither intent nor order is established.
Risk scoring thresholds
Risk starts at zero. Positive rule, modifier, and enabled baseline contributions form an exact ledger; severity thresholds produce deterministic response guidance. No embedded triage overrides the result.
Artifact Paths
0-19
informationalMatched detections and process chains can be informational; activity is separate.
20-49
lowLog detection with matched rule details.
50-69
mediumLog detection and include expanded context fields.
70-89
highDeterministic response guidance for security review.
90+
criticalDeterministic guidance for immediate investigation.
First high-signal use cases
The Telltale use-case documentation defines concrete fixture-driven behaviors that should produce useful alerts without using real credentials or attacker infrastructure.
- UC-001: fake MCP prompt injection to a controlled Dark Roast Cyber test domain; expected rules include mcp.tool_metadata.prompt_injection and network.controlled_test_domain.darkroast, with chain.mcp_injection_then_egress when egress is present.
- UC-002: credential harvesting before package publish; expected rules include credential.cloud_harvest, supply_chain.publish, and chain.credential_then_publish.
- UC-003: DNS exfiltration with encoded payload; expected rules include execution.encoded_payload, exfil.dns_encoding, and chain.shell_encoded_payload.
Validate and preview rules
Use validation and fixture tests before writing scan output. This keeps detection changes deterministic and catches invalid regexes or unsupported targets.
cargo run --bin telltale -- rules validate --no-local-configcargo run --bin telltale -- scan --once --dry-run --no-local-config --root tests/fixtures/session_storesRun from the Telltale repository. Fixture scans should not write real monitoring output unless --allow-fixtures and an explicit dev sink are intentionally used.
How to use this page during an investigation
- Start with event fields: rule_ids, categories, risk_score, severity, client, session_id, tool_name, and response.*.
- Read the rule explanation and false-positive caveat before opening local raw session stores.
- Treat chain modifiers as stronger evidence than single low-signal activity such as ordinary shell use or package installation.
- Use the source-validation page before interpreting a missing field. Copilot user context is unsupported. Call ID, workspace, and error state are conditional or absent by source, not universally discarded.