feat(entries): add 6 red↔blue pairs across new tactics

[Gerrrt]

What

Grows the corpus from 16 → 22 paired concepts, extending it into tactics it didn't cover before — ticket forgery, SYSVOL credentials, local NTDS theft, WMI execution, and the previously-absent Persistence tactic.

Attack (red)	Detection (blue)	ATT&CK
Golden Ticket (forged TGT)	4769 TGS with no preceding 4768	T1558.001
GPP cpassword (SYSVOL)	5145 SYSVOL Groups.xml read	T1552.006
NTDS.dit dump (ntdsutil/VSS)	4688 ntdsutil/vssadmin + 8222	T1003.003
WMI exec (impacket-wmiexec)	4688 WmiPrvSE.exe child shell	T1047
Scheduled-task persistence	4698 task created	T1053.005
WMI subscription persistence	Sysmon 19/20/21	T1546.003

Each detection follows the corpus philosophy — detect the invariant, not the IOC (the RC4 downgrade, the replication-skipping host behaviour, the WmiPrvSE parent, the fileless WMI consumer).

Why these

The existing corpus was heavy on Credential Access / AD path abuse but had no Persistence or Execution coverage and was missing two marquee techniques (Golden Ticket, local NTDS theft). These six fill those gaps with clean, single-invariant detections.

Verification

• gen-views.sh --check (drift gate, standalone) — pass
• pairing-graph integrity (every pair: resolves and back-references) — pass
• slot-coverage ({{slots}} all handled by htpx) — pass
• bash -n on the scripts — pass

README count + corpus table updated to match.

🤖 Generated with Claude Code

---

Generated by Claude Code

[Copilot]

Pull request overview

Expands the project’s red↔blue “paired concepts” corpus by adding six new ATT&CK technique pairs across newly covered tactics (notably Persistence and Execution), and updates the README corpus summary/table accordingly.

Changes:

• Add six new red technique entries (Golden Ticket, GPP cpassword, NTDS.dit theft via ntdsutil/VSS, WMI exec, scheduled-task persistence, WMI subscription persistence).
• Add six corresponding blue detections (Windows Security 4688/4698/5145/4768+4769, plus Sysmon 19/20/21).
• Update README corpus count and table to reflect 22 paired concepts and new tactic coverage.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Updates corpus count/tactics list and adds six new pairs to the table.
entries/red/wmiexec-impacket.md	New red entry documenting impacket-based WMI remote execution.
entries/red/wmi-subscription.md	New red entry documenting WMI event-subscription persistence.
entries/red/schtask-persist.md	New red entry documenting scheduled-task persistence via schtasks.
entries/red/ntds-ntdsutil.md	New red entry documenting offline NTDS.dit theft via ntdsutil/VSS.
entries/red/gpp-cpassword.md	New red entry documenting SYSVOL GPP cpassword discovery/decrypt workflow.
entries/red/golden-ticket.md	New red entry documenting Golden Ticket forging and usage.
entries/blue/wmiexec-4688.md	New blue detection for WMI exec via 4688 WmiPrvSE child processes (SPL).
entries/blue/wmi-subscription-sysmon.md	New blue detection for WMI subscription persistence via Sysmon WMI eventing (SPL).
entries/blue/schtask-4698.md	New blue detection for suspicious scheduled task creation via 4698 (SPL).
entries/blue/ntds-ntdsutil-4688.md	New blue detection for NTDS theft behaviors via 4688 + 8222 correlation (SPL).
entries/blue/gpp-cpassword-5145.md	New blue detection for GPP XML reads from SYSVOL via 5145 (SPL).
entries/blue/golden-ticket-4769.md	New blue detection for TGS activity without preceding TGT issuance (4768/4769 SPL).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Gerrrt]

Kept as-is. The IN(...) wildcard caveat applies to the where command's IN() function; this is a base-search IN, where Splunk (6.6+) does expand * in the value list. It's also the established house style in this corpus — the existing potato-seimpersonate-4688 blue entry uses the identical New_Process_Name IN ("*\\cmd.exe","*\\powershell.exe") construct — so changing it here would only introduce inconsistency.

---

Generated by Claude Code