NetScaler_forensik/VALIDATION.txt

VALIDATION SCOPE

CPython 3.14.8 on macOS/ARM64. Windows and Linux were not executed in this
validation environment. Synthetic path checks do not replace target-OS tests.

CODE AUDIT

136 tests passed with Python warnings treated as errors in 37.031 seconds.
Strict mypy passed for 37 source files. Ruff lint and format checks passed for
38 files. The enabled
lint families are E, F, I, UP, B, SIM, RUF and PERF; this is not a claim that every
optional rule from every analyzer is enabled.

Reproduce from the source directory:
    uv sync --locked
    uv run python -W error -m unittest discover -s tests
    uv run mypy
    uv run ruff check src tests typing_stubs
    uv run ruff format --check src tests typing_stubs

Tests cover archive preparation, encrypted and nested archives, original file
preservation, multi-appliance parsing, time ambiguity, update evidence, bounded
decoding, defanging, rule packs, correlations, incomplete results, interruption
and release hygiene. Sigma tests exercise supported semantics, decoded views,
explicit unsupported-feature rejection and local matching limits.

A separate sequential CLI matrix passed all 21 invocations with warnings fatal:
common and advanced help, scan/extract/decode/indicators/inventory, JSON output,
implicit folder and archive inputs, current-folder discovery of multiple
archives, encrypted 7z input, URL decoding and Base64 decoding.

RELEASE INSTALLATION

A wheel and source distribution were built. Locked runtime requirements were
exported with hashes and installed into a fresh virtual environment outside the
source tree, followed by the wheel without dependency resolution. Installed-package
verification is repeated after changes to code or bundled intelligence. Source
metadata is included so the packaging allowlist test remains active.
CLI help, bundled Sigma matching and the 246-entry public IOC catalog passed.

The wheel includes 47 public Sigma rules and the attributed public reference
catalog. Private packs are opt-in, gitignored and excluded from both release
formats. Artifact inventories and text contents were checked for private
case indicators, identities, home paths, logs, evidence and runtime directories.
Tests and examples use synthetic documentation addresses.

Runtime versions checked: pySigma 1.5.1, regex 2026.9.29, PyYAML 6.0.3,
py7zr 1.1.3, pyzipper 0.4.0, rich 15.0.0, rich-argparse 1.8.0, tzdata 2026.4.
The lockfile records all dependency versions.

INTERPRETING RESULTS

No private incident data is required to run these software tests. Independent
real-dataset findings are retained in separate customer case folders in their
BERICHT.txt reports, outside this shared tool and its release.
Original inputs are hashed before and after analysis. Forensic coverage limits
are retained even when software tests and code checks pass: binary logs,
ambiguous timestamps, invalid UTF-8 and failed decoding are not silently fixed.

A match, decoded command or correlation is not proof of execution or compromise.
Passing software tests does not establish investigation completeness. The local
Sigma evaluator implements the subset documented in RULES.txt, not every Sigma
feature or a Splunk query exporter.

Scanning is sequential with buffered input/output, bounded decoding caches and
an approximately 8 MiB SQLite page cache. File inventory, archive metadata,
custom rule packs and result volume still affect total process memory. There
is no hard process-wide CPU or RAM quota and no automatic parallel worker pool.

INTELLIGENCE REFRESH CHECKS

All 37 requested public URLs were retrieved or attempted and recorded, including
access errors, application-only responses and verified alternate source URLs.
The inventory has 52 sources, 246 unique indicators and 41 behavior patterns,
expressed as 47 Sigma rules. All source/indicator/rule joins are checked.

Every catalog indicator has a literal positive test; 245 have raw and decoded
Sigma positives. The legitimate customsnmpd pathname is deliberately excluded
from standalone Sigma matching and retains its contextual catalog occurrence.
All IPv4 values are checked against prefix/suffix overmatching. HTTP tests cover
percent encoding, Base64, no padding, nesting, Referer and additional headers.
Original raw text and decoding spans remain verified.

The preceding frozen baseline completed two independent real datasets: 2,405
files and 4,043,139 records, with every original/reference hash preserved. That
full run predates this intelligence refresh and decoding-gate change. Its counts
and timings must not be presented as a full-run test of the updated rule pack.
Updated bounded real-data findings are retained in the corresponding customer
BERICHT.txt reports. Temporary verification outputs are not required runtime inputs.

A separate frozen-baseline, warm-cache repeated-sample experiment used the same
30,720 records per mode: one/two/four processes took 12.555/6.230/3.913 seconds.
All twelve per-job outputs were semantically equivalent. Four processes used a
conservative aggregate peak sum of 262.9 MiB. This is a throughput experiment,
not an implemented parallel scanner, hard memory cap or full-archive forecast.

The final gate also checks every public IOC encoded as padded and unpadded
Base64, including all-uppercase tokens and four-character encodings. Canonical
short/full-field decoding requires a printable UTF-8 roundtrip and is bounded
to 4-4096 characters. This does not attempt to decode every ordinary word.

PREVIOUS INSTALLATION AND RUNTIME SMOKE CHECK

The previous installed wheel passed all 106 tests with warnings treated as errors
in 28.839 seconds in a fresh environment outside the source tree. Locked
runtime installation used 33 dependencies. CLI help, default Sigma matching and
uppercase-only Base64 decoding passed. After relocating the interpreter into
the shared tool directory, the same 106 tests passed in 29.001 seconds and CLI
help passed again. Python imports and module paths no longer depend on an
obsolete analysis checkout. These checks validate software operation, not
customer-specific compromise conclusions.

EXTENSIBLE RULE PACK REGRESSION

The current source passes 134 tests, including recursive pack loading, offline
validation, typed indicator boundaries, overlapping references, contextual Sigma
conditions, numeric selectors, limits and encoded command probes. Catalog
metadata cannot bypass a Sigma condition. The release was rebuilt after these
changes. The older installed-wheel result above is not a test of this revision.

A bounded private regression verified 19,625 original referenced log lines from
two separate investigations, including all 94 recorded finding families in the
earlier investigation. Public-rule matching completed without matching errors.
The case-IOC run recorded one literal matching timeout; an independent retry of
that original record completed with a finding and no matching error. The initial
partial coverage remains recorded; decoding-candidate errors are reported
separately and are not silently treated as successful decoding.

The bounded regression is not a repeat of the earlier full 4,043,139-record run.
A subsequent Unicode literal-lookup guard has synthetic regression coverage,
but the entire private fixture set was not rerun after that guard. These checks
validate known examples and important negative cases, not zero false positives
or complete detection of all future attacks. Private evidence is not shipped.

CLI RESULT PRESENTATION

CLI scans produce SUMMARY.txt, matched-event FINDINGS.csv and IOCS.csv at the
result root. Complete machine-readable evidence is retained under details/;
prepared inputs remain under inputs/. Tests cover separation of context from
matches, preservation of JSON evidence, authorized-test labels, spreadsheet
formula protection and no-matches wording. Direct engine.scan callers retain
the flat layout. A synthetic CLI smoke check confirmed the new directory layout.

REAL-DATA OUTPUT PRESENTATION CHECK — 2026-10-05

The CLI was run against 19,625 referenced original lines from two independent
private datasets, with each dataset's own IOC pack. Source files were verified
against their recorded hashes before and after processing. This was a bounded
presentation regression, not a new full-dataset scan.

The runs produced 14,633 and 2,461 matched-event CSV rows respectively. Every
CSV event ID, source reference, indicator status and defanged indicator was
checked against the full JSON event. Summary counts and partial status agreed
with the JSON summary. The JSON retained 123 and 1,448 additional context/error
events excluded from the matched-event CSV. Decoding output was present in
13,019 and 344 matched events; authorized-test labels were preserved.

Both runs exited 2 with partial coverage: 12,510 and 1,584 failed decoding
candidates remain reported. No matching errors occurred in these runs. Private
source mapping and validation results remain outside the public release.

A subsequent presentation correction exposes original-file SHA-256 matches in
SUMMARY.txt even without an event match. Three focused presentation tests passed,
including this separate hash-only case; Ruff, formatting and strict mypy passed.

DEPENDENCY COMPATIBILITY FIX — 2026-10-05

Version 1.0.0 was installed in an isolated environment with pySigma 2.0.0.
The bundled-rule validation reproduced the reported RE2 rejection of lookahead
syntax. Version 1.0.1 constrains pySigma to >=1.5.1,<2, keeping the existing
detection patterns and timeout-protected matching unchanged.

Reinstalling the corrected package in that same environment automatically
replaced pySigma 2.0.0 with 1.5.1. All 47 bundled Sigma rules validated, with
246 explicit active indicators. All 138 tests passed against the installed
package with Python warnings treated as errors. A new regression checks the
reported lookahead pattern against raw and decoded text, including negative
cases. Ruff lint, formatting and strict mypy across source and tests passed.
This verification did not rerun the complete private forensic datasets.

2026-10-05: Abgeschlossene Erweiterung der Dateisystemanalyse
TAR.GZ und entpackte Exportverzeichnisse; Inhaltsmuster, bekannte SHA-256,
Netzwerk-IOCs, zusätzliche Fall-IOC.csv, Metadaten und Artefakt-Prüfliste.
Elf zusätzliche quellendokumentierte Regeln. Exportbefehl und paralleler
Batch-Aufruf im README, CLI-Hilfe einschließlich Grenzen aktualisiert.
149 Tests erfolgreich, darunter elf Dateisystemtests. Ruff/Mypy geprüft.
Die Erweiterung verarbeitet Archive ohne Ausführung enthaltener Programme.
Unvollständige gzip-Streams werden als Verarbeitungsfehler ausgewiesen.
Zusätzliche strukturierte Logkorrelation ist optional; der Batch-Helfer aktiviert sie nicht.
Erkennungsgrenzen: FILESYSTEM_COVERAGE.txt. Validierung ist keine Clean-Garantie.


SUPPLEMENTAL REVIEW CHECKS — 2026-10-05

Version 1.0.2 adds ten low-severity Sigma review rules and eleven filesystem
content checks, plus candidate web-tree file names and BLX configuration paths.
The default Sigma catalog validates with 57 rules; public indicators remain
246. Unverified additional indicators are kept in an optional private pack.

All 151 tests passed with warnings treated as errors. Ruff lint, formatting and
strict mypy passed. Positive and negative controls exercise each new Sigma rule
on raw and decoded views. Filesystem tests cover original anomalous bytes,
configuration path restrictions and suppression of an error-message lookalike
inside a binary package. Eleven filesystem tests passed after increasing the
stream overlap to 8 KiB for bounded patterns spanning a block boundary.

An isolated installed package also validated all 57 rules. All 25 supplemental
private indicator values matched raw and Base64-decoded text in a separate
private check. This demonstrates matching behavior, not malicious attribution.

Two existing configuration/program exports were rescanned: 5,361 and 5,319
regular files, with no read errors and no hits from the added checks. Existing
heuristic candidates remain separate from newly added checks. A retained larger
snapshot inventory was compared against all 12 supplemental SHA-256 values:
53,696 file hashes, no match. This inventory comparison did not reread the
original larger archive and does not prove current system integrity.


RELATIVE OUTPUT REGRESSION

A real-data run completed analysis but failed while finalizing a relative output
path. Preparation resolves paths internally; the CLI now resolves its preparation
root before constructing relative provenance references. A regression verifies
SUMMARY.txt and each manifest input root when --output is relative. All 152 tests
then passed with warnings treated as errors; Ruff and strict mypy passed.

The completed run's output was recovered only after every one of its 851 input
inventory entries matched a freshly prepared copy. It processed 1,117,532 records:
two missing-file review events, no supplemental IOC or file-hash hit. Status
remains partial: ten binary-file read stops and 106,842 decoding failures, with
no matching or inventory errors. These counts are not compromise indicators.


A separate supplemental log recheck completed over 4,604,594 records in 1,711
files using four triage-library workers. Original and working-copy SHA-256
inventories matched. No supplemental rule, indicator or original-file hash hit
was found. Coverage remains partial: 788 text read stops (776 database files,
12 binary login/scoreboard files) and 1,338,016 decoding failures. No matching
errors occurred. This focused recheck did not repeat unchanged public rules or
perform another correlation pass. A failed earlier database run was excluded.

The streaming recheck agreed with the standard engine on raw, Base64, URL-encoded,
process-list and benign fixtures. Saved process/permission collection records
were reviewed separately. Private rules, indicators, records and evidence remain
outside the public repository. These results do not establish absence of compromise.

PUBLIC INDICATOR UPDATE 1.0.3 - 2026-10-05

Added seven IPv4 addresses and nine SHA-256 search candidates to the default
catalog and Sigma selectors. Nine duplicate supplied indicators retain their
existing metadata. New entries are reference_only with explicitly empty source
lists; no malicious attribution is asserted. Total: 262 indicators, 57 rules.

Validation: 152 tests passed with warnings treated as errors. Full catalog
matching tests cover raw and decoded views and IP boundaries. Ruff check, Ruff
format check and mypy passed. Wheel and source distribution built successfully;
the wheel contains all 262 indicators. Added lines were checked for customer
identifiers, local user paths and common secret markers. No case evidence or
private files were included. Existing source records remain unchanged.