v0.0.75

Changelog

Features

• 0bc83d7 feat(rules): add 18 threat-detection rules across 6 categories (#237)
• 3fd8581 feat(rules): add 3 credential-access rules — k8s, gpg, password managers
• 42924b0 feat(rules): add 3 sensitive-edit rules — SSH keys, /etc/hosts, container/IaC
• 0891ab8 feat(rules): add 6 rules across risky-command, context-exfiltration, source-control
• 8c83eee feat(rules): add 6 threat rules — agent-control, resource-consumption, approval-abuse

Bug Fixes

• b7f90c1 fix(rules): add unshare short-flag detection (-m/-n/-p/-i/-u/-C/-A/-r)
• ccbd956 fix(rules): allow sudo anchor on ssh-tunnel-egress
• 29bdb56 fix(rules): anchor approval-bypass -rf/-fr flags to rm-like binary basename
• a7b237d fix(rules): detect top-level /tmp and /var redirects in disk-fill-attempt
• 29a7721 fix(rules): drop disjunct 2 in archive-then-upload to require archiver-pipe-curl shape
• bce3d67 fix(rules): extend sandbox-escape launchers to nohup/setsid/command/exec
• ff1b9f8 fix(rules): require token boundaries on protected-branch names
• 2e8a27c fix(rules): tighten approval-bypass rm-anchor to require /tmp/ path prefix
• 4bfcf42 fix(rules): tighten kubernetes-secret-file-read token path patterns
• 6006da8 fix(rules): tighten modprobe module-name match against info subcommands

Other

• 682cf74 Add opt-in content capture to inventory with redaction (#239)
• 3b60e45 Add opt-in full-content capture to endpoint inventory
• 19dce12 Extend MCP event schema (#238)
• c814fdd Update agent instructions to include packaging vector (#235)
• c2a32a4 Update detection docs page (#236)
• a47ad25 Update onboarding docs, add script to sign + notarize packages (#233)
• 715a5d1 Update onboarding tag (#234)
• e315184 docs(detections): document 18 new threat rules across 6 categories
• d6822b1 extend mcp schema
• b44dacc fix duplicate events
• 0e654b1 fix json rpc id lookups
• 53d9a9d fix redaction
• 6640be3 fix redirects
• 49a42c6 post tool testing
• d2196b4 update content
• b6dd494 update docs
• 21d61dd update docs
• fa42de6 update docs, add script to notarize
• 8143f84 update instrs
• 67a9a9a update tag

Installation

Homebrew (macOS/Linux)

brew tap asymptote-labs/tap
brew install beacon

Manual Download

Download the appropriate archive for your platform from the assets below, extract it, and add the binary to your PATH.

Quick Start

beacon endpoint install
beacon endpoint status
beacon endpoint wazuh print-config

Threat detection rules

beacon ships with a small built-in baseline. Install the full threat-rule
pack (attached as threat-rules.tar.gz below) and scan your local telemetry:

beacon rules pull https://github.com/asymptote-labs/agent-beacon/releases/download/v0.0.75/threat-rules.tar.gz
beacon rules list
beacon scan