Repository navigation
test(atomic): gate the proven allow_failure tests and fix the offensive-cmdlet atomic - #112
Merged
Merged
Conversation
…ive-cmdlet atomic Six allow_failure atomics passed in every recent hosted run (4 Windows Defender/ps_module/WMI-5861, 2 macOS YARA) and never gated; promote them. windows_ps_module_offensive_cmdlet failed in every run: it defined Invoke-Mimikatz as a session function, which Module Logging (4103) does not record as a CommandInvocation. Define it in a throwaway module instead; it stays allow_failure until CI shows the alert. Record that the manual LOLBin network_connection rule fired in 2 of 21 runs.
Karib0u
enabled auto-merge (squash)
October 10, 2026 13:21
The throwaway-module version fired on the hosted Windows runner (PASS in the PR run), so drop allow_failure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
From the global audit: an
allow_failureatomic satisfies theatomiccoverage gate even if it never fires. Measured over the last ~25 successful hosted runs on main:windows_ps_module_defender_tamper,windows_defender_exclusion_added,windows_defender_realtime_disabled,windows_wmi_permanent_consumer_bindingmacos_coinminer_yara_fixture,macos_yara_memory_fixturewindows_ps_module_offensive_cmdletallow_failureuntil CI proves itwindows_lolbin_outbound_connectmanualwith a reason); reason updatedOffensive-cmdlet atomic
It defined
Invoke-Mimikatzas a session function. Module Logging (4103) records commands belonging to a logged module, so noCommandInvocation(Invoke-Mimikatz)record was produced (the Defenderps_moduletest passes becauseAdd-MpPreferenceis a module cmdlet). The atomic now defines the function in a throwaway.psm1, imports it, and removes it afterwards.Not verified locally (needs Windows). If the Windows job on this PR shows
[PASS] windows_ps_module_offensive_cmdlet, I'll drop itsallow_failurein a follow-up commit here; if it still fails, the rule should becomemanualwith a reason, since it currently claimsatomicwithout evidence.Checks
validate.py,--check-coverage --strict-essential, atomic unit tests, ruff: clean.