fix(entries): retag cryptomining pair to T1496.001, add beacon host-role caveat

[Gerrrt]

Actions the two live findings from the weekly corpus-review routine (#59). Report-first filed them; this applies them.

1. Cryptomining pair: T1496 → T1496.001 (Compute Hijacking)

entries/red/resource-hijack-xmrig.md + entries/blue/cryptomine-pool-detect.md

ATT&CK gained sub-techniques under T1496 Resource Hijacking (.001 Compute Hijacking, .002 Bandwidth Hijacking, .003 SMS Pumping, .004 Cloud Service Hijacking). MITRE places cryptocurrency mining under .001 Compute Hijacking — verified against the live technique page, which lists the XMRig-using actors (Blue Mockingbird, TeamTNT, Rocke, APT41) under it.

Both halves move together so the pair's attack tags stay in sync. The parent technique is not deprecated, so this is a sharpening, not a correction of something broken — the drift gate stays green either way. The red entry's source: line was updated to match.

2. web-service-c2-beacon: host-role tuning caveat

The entry's prose is explicit that you pivot off source process rather than domain — but the deployable SPL only excludes a hardcoded Windows desktop image list (chrome/edge/firefox/Teams/OneDrive/outlook/Dropbox/slack/Code).

On servers and CI/build agents that under-delivers on the promise: python.exe, node.exe, curl.exe, git.exe and agent binaries under \ProgramData\ legitimately make repeated 443 calls to package registries and SaaS APIs all day, clearing conns>3 AND active_hours>2. The user_writable weighting actively works against you there, since agent installs live in exactly those paths.

Added a tuning paragraph directing a split by host role (or a CMDB/asset join), with its own exclusion list and a higher floor for server/CI fleets. Detection mapping itself is sound (T1102.002, Sysmon 3) — this is prose only, the SPL is unchanged.

Not included

Finding #2 from the report — the missing Entra directory-role escalation pair (the M365 analogue of gws-super-admin ↔ gws-admin-audit, plus the same shape of gap for AWS IAM privilege escalation) — is a corpus-scope prioritization call rather than a defect, so it is tracked separately in #62 instead of being bundled here.

Verification

Ran the ci.yml gates locally against this branch:

• ./gen-views.sh --check → green (standalone: no flat-view targets; tag-only frontmatter changes don't alter rendered blocks regardless, since the render is title/prose/SPL)
• pairing-graph + slot-coverage loop → exit 0, no broken pairs, no unhandled slots

CHANGELOG.md [Unreleased] updated in the same commit. No release cut — see #60, which correctly reports the tree had nothing to ship at the time; this PR is the first delta since v2.6.0.

[Copilot]

Pull request overview

Updates corpus metadata and documentation based on the weekly corpus-review findings: it sharpens the ATT&CK technique mapping for the cryptomining pair and adds host-role tuning guidance to the web-service C2 beacon detection entry, with corresponding changelog notes.

Changes:

• Retagged the cryptomining red↔blue pair from T1496 to T1496.001 (Compute Hijacking) and updated the red entry source line.
• Added a host-role tuning caveat to web-service-c2-beacon to warn about server/CI noise characteristics (prose-only; SPL unchanged).
• Documented both updates under [Unreleased] in CHANGELOG.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
entries/red/resource-hijack-xmrig.md	Retags the red-side cryptomining entry to T1496.001 and updates its MITRE source reference.
entries/blue/cryptomine-pool-detect.md	Retags the blue-side detection entry to T1496.001 to keep the pair in sync.
entries/blue/web-service-c2-beacon.md	Adds host-role tuning guidance to better set deployment expectations for server/CI fleets.
CHANGELOG.md	Records the retag and tuning-caveat changes under [Unreleased].

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.