Background
QA round 4 (pyflakes) on 2026-05-03 surfaced three local variables in dart_mcp that are parsed from evidence but currently unused — each represents a real, documented detection pattern that was scaffolded but not yet wired into the findings emitter. They are tagged _<name>_deferred with # noqa: F841 so static analysis stays green and the deferral is self-documenting.
The three patterns
1. sift_mftecmd_timestomp — $SI.modified < $FN.modified (Pattern 3)
File: dart_mcp/src/dart_mcp/sift_adapters/mftecmd.py
Variable: _fn_mt_deferred
MITRE: T1070.006 (Timestomp)
Why it matters: This is the most common timestomp signature observed in the wild — attackers usually call SetFileTime which only writes to $SI, leaving $FN (updated by NTFS itself, not by the attacker) as ground truth. Patterns 1 and 2 are already emitted; Pattern 3 is parsed but not evaluated.
2. analyze_kerberos_events — unusual-workstation TGT (4768)
File: dart_mcp/src/dart_mcp/__init__.py
Variable: _unusual_tgt_deferred
MITRE: T1558 (Steal or Forge Kerberos Tickets)
Why it matters: A 4768 (TGT request) from a source IP the user has never authenticated from before is one of the strongest lateral-movement signals available pre-EDR. The tgt_sources dict that feeds this is already populated; the diff-vs-history evaluator and finding emit are the missing pieces.
3. detect_ransomware_behavior — image-path filtering
File: dart_mcp/src/dart_mcp/__init__.py
Variable: _img_deferred
MITRE: TA0040 (Impact) / T1486 (Data Encrypted for Impact)
Why it matters: Currently we only match service-stop signatures against the cmdline. Several real-world ransomware families (e.g. Lynx, Akira loaders) use legitimate-looking cmdlines but executables planted in %TEMP% / %APPDATA% / \Users\Public\ — image-path filtering catches them.
Why deferred
Activating any of these three patterns would (correctly) increase the finding count on the existing test corpora and on examples/sample-evidence/. The hackathon submission ships with a stable baseline measured by scripts/measure_accuracy.py; a baseline shift mid-window risks misreading as either a regression (if a previously-passing case now over-flags) or an artificial improvement (if the test corpora happen to validate the new pattern). Cleaner to do all three at once after the window closes, with a re-baseline.
Acceptance criteria
Background
QA round 4 (
pyflakes) on 2026-05-03 surfaced three local variables indart_mcpthat are parsed from evidence but currently unused — each represents a real, documented detection pattern that was scaffolded but not yet wired into the findings emitter. They are tagged_<name>_deferredwith# noqa: F841so static analysis stays green and the deferral is self-documenting.The three patterns
1.
sift_mftecmd_timestomp—$SI.modified < $FN.modified(Pattern 3)File:
dart_mcp/src/dart_mcp/sift_adapters/mftecmd.pyVariable:
_fn_mt_deferredMITRE: T1070.006 (Timestomp)
Why it matters: This is the most common timestomp signature observed in the wild — attackers usually call
SetFileTimewhich only writes to$SI, leaving$FN(updated by NTFS itself, not by the attacker) as ground truth. Patterns 1 and 2 are already emitted; Pattern 3 is parsed but not evaluated.2.
analyze_kerberos_events— unusual-workstation TGT (4768)File:
dart_mcp/src/dart_mcp/__init__.pyVariable:
_unusual_tgt_deferredMITRE: T1558 (Steal or Forge Kerberos Tickets)
Why it matters: A 4768 (TGT request) from a source IP the user has never authenticated from before is one of the strongest lateral-movement signals available pre-EDR. The
tgt_sourcesdict that feeds this is already populated; the diff-vs-history evaluator and finding emit are the missing pieces.3.
detect_ransomware_behavior— image-path filteringFile:
dart_mcp/src/dart_mcp/__init__.pyVariable:
_img_deferredMITRE: TA0040 (Impact) / T1486 (Data Encrypted for Impact)
Why it matters: Currently we only match service-stop signatures against the cmdline. Several real-world ransomware families (e.g. Lynx, Akira loaders) use legitimate-looking cmdlines but executables planted in
%TEMP%/%APPDATA%/\Users\Public\— image-path filtering catches them.Why deferred
Activating any of these three patterns would (correctly) increase the finding count on the existing test corpora and on
examples/sample-evidence/. The hackathon submission ships with a stable baseline measured byscripts/measure_accuracy.py; a baseline shift mid-window risks misreading as either a regression (if a previously-passing case now over-flags) or an artificial improvement (if the test corpora happen to validate the new pattern). Cleaner to do all three at once after the window closes, with a re-baseline.Acceptance criteria
_*_deferredvariables either consumed (renamed back to plain identifier + emit logic added) or explicitly removed if the pattern is decided againstpyflakesclean across the package (no F841 suppressions left)tests/test_qa_pass_regressions.pyextended with one assertion per re-activated patternscripts/measure_accuracy.pyre-run, baseline updated inPhase-1.md