docs/analysis-pipeline

Threat Detection Matrix

The analysis pipeline detects 13 threat categories using a combination of YARA pattern matching, LLM semantic analysis, and sandbox execution monitoring.

Prompt Injection

CRITICAL
YARA:3 rules
LLM:✓ Active
Sandbox:✓ Active

Command Injection

CRITICAL
YARA:2 rules
LLM:✓ Active
Sandbox:✓ Active

Credential Harvesting

CRITICAL
YARA:1 rule
LLM:✓ Active
Sandbox:✓ Active

Data Exfiltration

CRITICAL
YARA:1 rule
LLM:✓ Active
Sandbox:✓ Active

SQL Injection

CRITICAL
YARA:1 rule
LLM:✓ Active
Sandbox:○ N/A

System Manipulation

HIGH
YARA:1 rule
LLM:✓ Active
Sandbox:✓ Active

Unicode Steganography

HIGH
YARA:1 rule
LLM:✓ Active
Sandbox:○ N/A

Autonomy Abuse

MEDIUM
YARA:1 rule
LLM:✓ Active
Sandbox:○ N/A

Capability Inflation

MEDIUM
YARA:1 rule
LLM:✓ Active
Sandbox:○ N/A

Detection Coverage

13
YARA Rules
9
Threat Categories
3
Analysis Engines