Telltale
Detection Catalog
This catalog summarizes the bundled rule YAML and detection documentation so investigators can understand what Telltale is matching before they open raw session stores. It is a field reference, not a promise that every risky behavior is detected.
Rule quality contract
Bundled rules use one YAML-driven engine for security detections, policy violations, hunting, compliance observations, operational health, and baseline deviations. The detection content standard requires stable IDs, categories, severity, score, valid targets, matching logic, tags, explanations, and false-positive notes.
- Rule IDs are stable dot-separated identifiers and should not be reused after retirement.
- Categories describe observed behavior; detection_class, signal_type, and analytic_intent describe how analysts should use the event.
- ATLAS tags are offline documentation context only; scans do not fetch MITRE ATLAS.
- Positive fixtures must be synthetic, minimal, and assert redacted evidence rather than raw secrets.
- Negative fixtures are expected when normal developer activity could trigger a rule.
Bundled atomic rules
The catalog below lists the current bundled rules from config/rules/tool-call-regex.yaml. Target fields tell you where the regex or selection evaluates normalized agent activity.
Bundled Telltale rule catalog
secret.env.read
- Category
- secret_access
- Severity / score
- medium / 35
- Targets
- command, arguments, file_path, assistant_context, tool_result
Access to `.env`-style files; legitimate debugging can match.
secret.private_key.read
- Category
- secret_access
- Severity / score
- high / 55
- Targets
- command, arguments, file_path, tool_result
Private key paths or key material; certificate inventory can match.
credential.api_key.pattern
- Category
- credential_pattern
- Severity / score
- medium / 30
- Targets
- command, arguments, tool_result, assistant_context
Token-shaped strings for hunting; synthetic examples and docs can match.
execution.shell
- Category
- execution
- Severity / score
- low / 15
- Targets
- tool_name, command, arguments
Shell or interpreter execution; common in normal development and strongest when chained.
execution.encoded_payload
- Category
- execution
- Severity / score
- high / 50
- Targets
- command, arguments
Encoded payload decoding; incident-response or build tasks can be benign.
network.download
- Category
- download
- Severity / score
- low / 20
- Targets
- command, arguments, url
Download by curl, wget, PowerShell, or fetch; expected setup often matches.
install.package_manager
- Category
- install
- Severity / score
- low / 20
- Targets
- command, arguments
Package-manager execution; review package source and surrounding actions.
exfil.outbound_upload
- Category
- exfiltration
- Severity / score
- high / 60
- Targets
- command, arguments, url
Upload or object-storage copy; authorized artifact uploads can match.
persistence.shell_profile
- Category
- persistence
- Severity / score
- high / 45
- Targets
- command, arguments, file_path
Shell profile, cron, service, or launch-agent changes; setup flows can be legitimate.
approval.bypass.context
- Category
- approval_bypass
- Severity / score
- high / 45
- Targets
- assistant_context, command, arguments, tool_result
Language about hiding, no-confirm, or bypassing approval; quoted policy text can match.
tool.injection.shape
- Category
- tool_injection
- Severity / score
- high / 55
- Targets
- assistant_context, tool_name, arguments
Tool-call-shaped content in model output; parser tests and copied logs can match.
mcp.tool_metadata.prompt_injection
- Category
- mcp_prompt_injection
- Severity / score
- high / 60
- Targets
- assistant_context, arguments, tool_result
MCP metadata or output with instruction-override language; security fixtures can match.
network.controlled_test_domain.darkroast
- Category
- exfiltration
- Severity / score
- high / 45
- Targets
- command, arguments, url, assistant_context, tool_result
Controlled Dark Roast Cyber test-domain references; fixtures and validation commands can match.
exfil.dns_encoding
- Category
- exfiltration
- Severity / score
- high / 55
- Targets
- command, arguments
Encoded data in DNS tooling; demos and troubleshooting require context.
exfil.encoded_http
- Category
- exfiltration
- Severity / score
- high / 50
- Targets
- command, arguments
Encoded data sent to HTTP endpoints; expected API payloads can match.
credential.cloud_harvest
- Category
- credential_harvesting
- Severity / score
- high / 50
- Targets
- command, arguments, file_path
Cloud, Kubernetes, Docker, or service-account credential paths; authorized CLI troubleshooting can match.
supply_chain.publish
- Category
- supply_chain
- Severity / score
- high / 45
- Targets
- command, arguments
Package publishing commands; correlate with release intent and credential access.
mcp.server_enumeration
- Category
- mcp_enumeration
- Severity / score
- medium / 40
- Targets
- command, arguments, assistant_context, tool_result
MCP server/tool probing; inventory and integration tests can match.
Chain modifiers
Chain modifiers do not duplicate base rule logic. They add risk when multiple signals appear in the same session window or when exact rule IDs form a more dangerous combination.
Bundled Telltale chain modifiers
chain.secret_then_network
- Trigger
- secret_access + download
- Score add
- +35
Secret access near network activity materially increases exfiltration risk.
chain.download_then_execute
- Trigger
- download + execution
- Score add
- +35
Download followed by execution is a common malware pattern.
chain.shell_encoded_payload
- Trigger
- execution.shell + execution.encoded_payload
- Score add
- +10
Shell execution of decoded payload content should cross the triage threshold.
chain.install_then_persistence
- Trigger
- install + persistence
- Score add
- +30
Package installation plus profile or service persistence requires triage.
chain.mcp_injection_then_egress
- Trigger
- mcp_prompt_injection + exfiltration
- Score add
- +35
MCP prompt injection near outbound egress is the first high-signal alert use case.
chain.credential_then_publish
- Trigger
- credential_harvesting + supply_chain
- Score add
- +40
Credential harvesting followed by package publishing is a supply-chain attack pattern.
chain.harvest_then_exfil
- Trigger
- credential_harvesting + exfiltration
- Score add
- +35
Credential harvesting followed by exfiltration is a data-theft pattern.
chain.mcp_enumeration_then_injection
- Trigger
- mcp_enumeration + mcp_prompt_injection
- Score add
- +30
Enumeration followed by injection suggests targeted MCP attack behavior.
Risk scoring thresholds
Each tool call starts at zero. Rules and modifiers add points. Severity is derived from the final score unless triage overrides it.
Artifact Paths
0-19
informational Log notable activity only.
20-49
low Log detection with matched rule details.
50-69
medium Log detection and include expanded context fields.
70-89
high Run guard and triage model, then emit triage result.
90+
critical Run triage and emit alert-ready event.
First high-signal use cases
The Telltale use-case documentation defines concrete fixture-driven behaviors that should produce useful alerts without using real credentials or attacker infrastructure.
- UC-001: fake MCP prompt injection to a controlled Dark Roast Cyber test domain; expected rules include mcp.tool_metadata.prompt_injection and network.controlled_test_domain.darkroast, with chain.mcp_injection_then_egress when egress is present.
- UC-002: credential harvesting before package publish; expected rules include credential.cloud_harvest, supply_chain.publish, and chain.credential_then_publish.
- UC-003: DNS exfiltration with encoded payload; expected rules include execution.encoded_payload, exfil.dns_encoding, and chain.shell_encoded_payload.
Validate and preview rules
Use validation and fixture tests before writing scan output. This keeps detection changes deterministic and catches invalid regexes or unsupported targets.
cargo run --bin telltale -- rules validate --rules config/rules/tool-call-regex.yamlcargo run --bin telltale -- scan --once --dry-run --root tests/fixtures/session_storesRun from the Telltale repository. Fixture scans should not write real monitoring output unless --allow-fixtures and an explicit dev sink are intentionally used.
How to use this page during an investigation
- Start with event fields: rule_ids, categories, risk_score, severity, client, session_id, tool_name, and response.*.
- Read the rule explanation and false-positive caveat before opening local raw session stores.
- Treat chain modifiers as stronger evidence than single low-signal activity such as ordinary shell use or package installation.
- Use source capability notes before interpreting missing fields; some clients do not preserve user intent, workspace, call IDs, or error state.